nosce.
Sensitive Personal Information Rules
This separate notice explains the highly private material Nosce may process, why it is necessary, who receives it, possible risks, and your controls.
Pre-launch legal draft: the registered sole-proprietor details and privacy email must be completed, and a personal-information impact assessment, lawful cross-border mechanism, and lawyer review must be completed before production use.
1. Potential categories
Free text you enter and structured material derived from it may concern mental state, medical health, intimate or sexual matters, family experiences, religious beliefs, specific identity, financial distress, travel history, or other information whose disclosure or misuse could harm dignity or personal or property safety. Nosce does not require a national ID number, exact birthday, face, fingerprint, financial account, or precise location.
2. Specific purpose and necessity
Processing is limited to responding to current expression; retrieving relevant history; forming inspectable, correctable, and deletable understandings, portraits, reflections, and memory relationships; maintaining account isolation; providing export and deletion; and security.
Without processing sensitive material that may appear in free expression, Nosce cannot provide its core long-term conversation and self-understanding service. You may omit any detail, but separate consent is required for the core service.
3. Potential effects
Risks include privacy, reputational, or property harm from disclosure; emotional distress from model error; incorrect links between past material; unauthorized access if another person controls the account; and reduced control caused by overseas law, provider access, or cross-border transfer. Separate consent, minimum transfer, authentication, account isolation, encryption, correction, and deletion reduce but do not eliminate risk.
4. Recipients and processing
Sensitive content is stored in the Supabase Tokyo project and passes through Vercel US infrastructure. Necessary context is sent to DeepSeek for specific requests, may be sent to Kimi only after a qualifying DeepSeek infrastructure failure, and is sent in text segments to Alibaba Cloud Model Studio when semantic vectors are needed. PostHog should not receive conversation or profile text, but receives a pseudonymous account ID and limited feature events.
Overseas recipients and transfer details appear in the Cross-border Personal Information Rules. Each request is limited to content needed for the current function.
5. External model data use
Nosce does not train its own model on identifiable content. DeepSeek's public terms permit minimal use of input and output under de-identification safeguards to provide, maintain, develop, or improve services, and code alone does not prove its opt-out is enabled. Kimi says API data is not used for training. Alibaba Cloud says pay-as-you-go API data is not used for training but call data is retained where law requires.
Do not accept these rules or use the core service if you cannot accept these provider arrangements.
6. Retention and control
Sensitive content is normally retained until you delete relevant product data or cancel the account. Online business data is deleted after cancellation; provider backups and security logs expire under applicable rotation cycles and cannot be guaranteed to disappear item by item immediately. You can export, delete, correct or remove understandings, and cancel the account to withdraw future consent.
7. Separate consent
Nosce records sensitive-data consent only when you separately check this notice in the centralized confirmation area. Without it, no login code is sent and core service does not open. Material changes to purpose, method, category, recipient, or retention require renewed separate consent. Contact rui@nosce.life with questions.