TRUST CENTER

Trust Center

How noem.ai handles your data: AI processing, subprocessors, retention, Messenger and Instagram access, and security. Every governing document in one place.

Last updated October 21, 2026

Governing documents

If this page and a signed agreement or the DPA differ, the signed agreement and then the DPA control.

Roles

For the content your business puts into noem.ai and the conversations your bots have with your customers, you are the controller and Madain Corp (dba noem.ai) is your processor. You decide what data is collected and are responsible for giving your end users any required notice and obtaining any required consent. We process that data only on your instructions, as set out in the DPA. Our Privacy Notice covers data we control as a business, such as your account and billing details.

AI processing

Which providers process messages

Conversation text, including Messenger and Instagram messages, is processed by large language models from OpenAI and Anthropic, accessed through their commercial APIs. The model used for a given bot depends on its configuration and may change as better models become available. Image, voice, and research features use Stability.ai, ElevenLabs, and Perplexity. All are listed on our subprocessor list.

What is sent to the model

Only what is needed to generate a reply:

The incoming message and recent conversation history for that thread
Your bot's Instructions and the relevant passages retrieved from its Knowledge
Contact details the conversation needs, such as a first name or a detail the customer provided
Technical metadata required for the request

Analytics, security logs, billing data, and API credentials are not sent to AI providers.

Training and human review

No training on your content. We do not use your conversations, Knowledge, Instructions, or contacts to train or fine-tune AI models, ours or anyone else's.
Provider no-training terms. We use OpenAI and Anthropic under their commercial API terms, under which customer API data is not used to train their models. Providers may keep API data for a limited period, typically up to 30 days, solely for abuse and misuse monitoring.
Product improvement. We may use aggregated or de-identified usage data (for example, message volumes, feature usage, and error rates) to operate and improve the service. This data does not identify you or your customers.
Human review. Our staff do not routinely read your conversations. Review happens only as described under Staff access.

Subprocessors and processing locations

Our complete, current list of subprocessors, including purpose, data categories, and location, is published here: noem.ai subprocessor list.

Location. Customer data is primarily processed and stored in the United States (AWS, Google Cloud, and MongoDB Atlas). Some subprocessors may process data in other countries as stated on the list.
International transfers. Transfers of personal data from the EEA, UK, and Switzerland rely on the European Commission's Standard Contractual Clauses, as set out in the DPA.
Changes. We notify customers by email at least 7 days before adding or replacing a subprocessor. You may object on reasonable data protection grounds as described in the DPA.

Retention and deletion

While your account is active

Data	Retention
Conversations and messages	Kept until you delete them, delete the project, or close your account
Contacts	Kept until you delete them, delete the project, or close your account
Knowledge and Instructions	Kept until you delete or replace them
Analytics	Kept for the life of the account; may be retained afterwards in aggregated or de-identified form
Function, application, and security logs	Up to 90 days, unless needed longer to investigate a security incident or abuse
Backups	Daily backups on a rolling 7-day cycle

What deletion removes

Deleting a thread removes that conversation's messages from the active platform.
Deleting a project removes its bots, Instructions, Knowledge, conversations, contacts, and channel connections, including stored Messenger and Instagram tokens.
Closing your account deletes or returns customer data within 30 days, as set out in the DPA.

What may remain after deletion

Copies in backups, until they roll off the 7-day backup cycle
Logs, until they expire (up to 90 days)
Aggregated or de-identified data, which no longer identifies you or your customers
Billing and account records we must keep for tax, accounting, fraud prevention, or legal reasons
Copies held by AI providers for abuse monitoring, for their limited retention period (typically up to 30 days)

Deletion confirmation. Customers on a paid plan with a DPA in place may request written confirmation of deletion at [email protected].

Export

You can export conversation and contact data for a project in a machine-readable format. To request an export scoped to a specific contact, for example to answer a data subject request from one of your customers, contact [email protected] and we will assist as described in the DPA.

Messenger and Instagram

Who operates the Meta app

The noem.ai Meta app is operated by Madain Corp (dba noem.ai), San Diego, California. You connect your Facebook Page and Instagram professional account through Meta's standard login and consent screen, which shows the exact permissions requested before you approve them.

Permissions we request

We request only the permissions needed to receive and reply to messages on the Pages and accounts you choose to connect. These are permissions to list your Pages, read and send Page and Instagram messages, and subscribe to message webhooks. We do not request permission to post content, manage ads, or read your personal Facebook profile beyond basic identity.

How we use Meta data

Data received from Meta is used only to provide the messaging service you configured. We do not sell it, use it for advertising, or use it to train AI models. Our use of Meta Platform Data complies with the Meta Platform Terms. Meta app review and Data Use Checkup status is available to customers on request.

Tokens

Access tokens are encrypted at rest and used only by our servers.
Long-lived tokens are refreshed through Meta's standard token flow while the connection is active.
Disconnecting a channel or deleting the project deletes the stored token.

How to fully disconnect

In noem.ai, disconnect the Messenger and Instagram channels in your project's channel settings (or delete the project). This stops all replies and deletes the stored tokens.
In Meta, remove the noem.ai app under Facebook Settings > Business Integrations and under Instagram Settings > Apps and websites. This revokes our access on Meta's side.
To also delete conversation history, delete the threads or the project, or request deletion at [email protected].

Staff access

Access to customer data is limited to personnel who need it, based on role, and is logged.
Our account and support teams access your conversations, Knowledge, or settings only when you request help or grant access for a support issue, and only for as long as needed to resolve it.
Other access is limited to investigating security incidents or abuse, maintaining the service, and complying with law.
Personnel with access are bound by confidentiality obligations.

Security and incidents

Data is encrypted in transit (TLS) and at rest on our hosting providers.
Production systems run on AWS, Google Cloud, and MongoDB Atlas, with access controls, backups, and monitoring.
Payment card data is handled by Stripe and never stored on our servers.

Breach notification. If we confirm a personal data breach affecting your data, we will notify you without undue delay, and in any event within 72 hours of confirmation, with the information you need to meet your own obligations. Details are set out in the DPA.

Security questionnaires. We answer customer security questionnaires on request.

Contact

Privacy and data requests: [email protected] or our privacy request form.
Security and data protection officer: [email protected].
Madain Corp (dba noem.ai), San Diego, CA, United States.