Privacy policy
Last updated 21 September 2026
Nomina is operated by Reid Media Pty Ltd (“we”, “us”), an Australian company. This policy explains what we collect, why, where it is kept and who can see it. It is written to be read, not to be survived.
1. Who our users are
Nomina is used by marketing agencies to manage the search and AI visibility of businesses that have engaged them. Our user is the agency. The business is a client record inside the agency’s account, and may be given a read-only view of its own results. We do not collect information about the general public or about a business’s own customers.
2. What we collect
- Business information: trading name, addresses, coordinates, website, category, and the search terms and questions being tracked.
- Account information: the name and email address of the person at the agency who operates the account.
- Measurements we generate: search rankings, answers returned by AI assistants, publicly visible Google Business Profile details, and the scores and recommendations derived from them.
- Google user data, where a business has connected its Google Business Profile. See section 4, which is the important one.
We do not collect payment card details. Payments, where they apply, are handled by a third-party payment processor and we never see the card number.
3. Where it is kept, and for how long
Data is stored in Australia, in a managed PostgreSQL database hosted in Sydney, and the application is hosted by Vercel. Access is restricted at the database level so that an agency can only read its own clients and a business can only read itself. Measurements are retained for as long as the account is open, because the value of the product is the history. On written request we will delete an account’s data within 30 days.
4. Google user data
If a business connects its Google Business Profile, we request access to manage that profile (the business.manage scope). We use it for one purpose: to read the profile so we can measure it, and to make changes that a person at the agency has explicitly approved.
Nothing is written to a Google Business Profile automatically. Every change is queued, shown against the current value, and published only after a person approves that specific change.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- We use Google user data only to provide and improve the features described here.
- We do not transfer Google user data to others except as necessary to provide those features, to comply with the law, or as part of a merger or acquisition.
- We do not use Google user data for advertising, and we do not sell it.
- We do not allow humans to read Google user data except with the account holder’s explicit permission, to resolve a specific problem they have raised, for security purposes, or where the law requires it.
Access tokens are stored encrypted and are used only to act on the profile they belong to. A business can revoke our access at any time from its Google account, and can ask its agency or us to disconnect it.
5. Who else processes data for us
We use a small number of service providers, each handling data only to provide their service to us: our database and hosting providers, a search data provider that returns public search results and AI assistant answers, an email delivery provider, and a payment processor. We do not sell data to anyone, and we do not share it with advertisers.
6. AI assistants
To measure whether a business is named, we send generic customer-style questions to AI assistants, for example “who are the best criminal lawyers in Sydney”. These questions contain no personal information and no client data, and the answers we record are the same answers any member of the public would receive.
7. Your rights
We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may ask us what we hold about you, ask us to correct it, or ask us to delete it. Write to nick@reidmedia.com.au and we will respond within 30 days. If you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner.
8. Security, stated honestly
Access is restricted at the database level rather than only in the interface, credentials are held in a secrets store and never in code, and pages showing client data require a login. No system is perfectly secure, and we will not claim otherwise. If a breach occurs that is likely to cause serious harm we will notify affected users and the Commissioner as the law requires.
9. Changes
If we change this policy we will update the date at the top, and we will tell account holders directly if the change is significant.
10. Contact
Reid Media Pty Ltd, Queensland, Australia. nick@reidmedia.com.au