Compliance

1. What Nous is

Nous is an enterprise AI agent platform. It executes tasks across each organization’s systems, requests approval from the people defined by the organization, and records every step in an audit log.

2. When you interact with AI

There is no live AI chat connected to this Site. The conversations and screens shown are illustrative simulations using fictitious data.

In customer deployments, each organization configures its channels (chat, email, messaging, or voice) and end-user notices in accordance with applicable regulations, including the duty to inform users when they interact with an AI system.

3. What AI decides and what people decide

Each organization configures which actions require approval, who approves, with what quorum, and under what delegations. Actions marked as subject to approval are not executed without the required signature. Some workflows use no AI model at all and follow deterministic rules.

Nous is not designed to make solely automated decisions with legal or similarly significant effects on individuals (employment, credit, housing, insurance, health, education, public services). If a customer uses Nous to support such decisions, the customer is responsible for complying with applicable rules and maintaining human oversight. EBM CONSULTING will provide the corresponding technical documentation.

4. Which models it uses

Each customer chooses where Nous runs (on its own hardware, in its private cloud, or as a managed service) and which models it uses:

• models running inside its own infrastructure, or
• models from external providers authorized by the customer.

5. Generated content

Texts and results produced by Nous may contain errors. They are intended for review by responsible personnel before being used outside the organization.

6. Contact

Questions or claims regarding the use of AI: info@socosoft.com.

Organization-level configuration

Each organization decides which approvals require a certificate-backed digital signature.

How to choose

Google may process this data in the United States. See "International transfers" on the Privacy page.

On your first visit you will see a banner with two buttons of equal visual weight, "Accept" and "Reject", plus "Configure". You can change your choice at any time from "Cookie settings" in the footer or using the button below. You can also delete cookies in your browser. We honor the Global Privacy Control (GPC) signal as a rejection of analytics unless you explicitly accept.

Cookie settings

Procedure

We will not discriminate against you for exercising these rights.

1. Email info@socosoft.com with the subject line "Data rights".
2. Include your name, the right you wish to exercise, and a contact method. Where necessary, we will ask to verify your identity. You may act through an authorized representative.
3. We will respond within the statutory timeframe applicable in your country (see section 7).
4. Exercising your rights is free of charge.
5. If you are not satisfied with our response, you may file a complaint with your national supervisory authority (see section 7).

1. How we protect information

• Role-based access control and explicit approval for actions defined by the organization.
• Audit trail recording every executed step.
• Secrets and credentials stored in an isolated vault.
• Encryption in transit.

2. Shared responsibility

When Nous runs on customer hardware or private cloud, the customer administers the infrastructure, backups, and network access. When it runs as a managed service, EBM CONSULTING operates the infrastructure under the Agreement. In both cases, the customer defines roles, approvals, and authorized models.

3. Incidents

If we detect an incident affecting personal data, we will notify affected customers without undue delay, as well as supervisory authorities and affected individuals within the timeframes required by each law (for example, 48 hours in Peru and 72 hours in the EU). See annexes (section 7).

4. Reporting a vulnerability

Email info@socosoft.com with the steps to reproduce the issue. We will acknowledge receipt promptly. We will not pursue legal action against security researchers who act in good faith, do not access third-party data beyond what is necessary to demonstrate the issue, and give us a reasonable timeframe to remediate before public disclosure. You can also check /.well-known/security.txt.

Annex A · Peru

• Statutes: Law 29733 (Personal Data Protection Law) and its Regulations approved by Supreme Decree 016-2024-JUS (in force since March 30, 2025).
• Supervisory authority: National Authority for Personal Data Protection (ANPD), Ministry of Justice and Human Rights.
• Rights: information, access, rectification, cancellation, objection (ARCO), portability, and objective processing (not being subject solely to automated decisions).
• Response timeframes: those set forth in the Regulations of Law 29733 (DS 016-2024-JUS) for each right.
• Data bank registry and contact channel: processing is subject to the National Registry of Personal Data Protection regime of the ANPD. Inquiries and requests are handled at info@socosoft.com.
• Incidents: notification to the ANPD within 48 hours and to affected data subjects within the same period; for digital security incidents, also to the National Digital Security Center.
• Commercial email: any promotional email sent to recipients in Peru complies with Law 28493 (clear identification and unsubscribe mechanism).
• AI: Law 31814 and its regulations (DS 115-2025-PCM, published September 10, 2025): transparency and human oversight obligations for high-risk uses, with phased timelines by sector.
• Inquiries and claims: nousengine.co is an informational site, does not conduct online sales, and Nous is contracted by enterprises under a separate agreement. Any inquiry or claim is handled at info@socosoft.com.

Annex B · Ecuador

• Statutes: Organic Law on Personal Data Protection (LOPDP, Official Register Supplement 459, May 26, 2021) and its General Regulations (Executive Decree 904, 2023).
• Supervisory authority: Superintendency of Personal Data Protection (SPDP).
• Rights: information, access, rectification and update, erasure, objection, portability, suspension of processing, and not being subject to decisions based solely on automated assessments.
• Contact channel and incidents: inquiries and rights requests at info@socosoft.com; incident notifications to the SPDP and data subjects within the timeframes established by the LOPDP.

Annex C · Colombia

• Statutes: Statutory Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Single Decree 1074 of 2015).
• Supervisory authority: Superintendency of Industry and Commerce (SIC), Personal Data Protection Delegation.
• Rights: know, update, and rectify your data; request proof of authorization; be informed of its use; revoke authorization or request deletion; lodge complaints with the SIC after exhausting our direct procedure; free access.
• Timeframes: inquiries, 10 business days, extendable by 5; claims, 15 business days, extendable by 8 (Law 1581, Arts. 14 and 15).
• Information processing policy: the Privacy page together with this annex serves as our information processing policy under Decree 1377 of 2013.

Annex D · Chile

• Current statute: Law 19.628 on the protection of private life (rights of access, rectification, cancellation, and blocking).
• Law 21.719 reform: published December 13, 2024, reforming Law 19.628. Recognizes access, rectification, erasure, objection, portability, and blocking; regulates automated decisions; requires breach notification; and creates the Personal Data Protection Agency.
• Supervisory authority: Personal Data Protection Agency, upon entry into force of Law 21.719.

Annex E · Bolivia

• Framework: Bolivia protects the right to privacy under the Political Constitution of the State (Art. 21.2) and through the Constitutional Privacy Protection Action (Arts. 130 and 131), along with sector rules in General Telecommunications and ICT Law 164 (2011) and Supreme Decree 1793 (2013).
• Our commitment: we extend to individuals in Bolivia the same rights and safeguards set out on the Privacy page. You can exercise them using the procedure in section 4.

Annex F · United States

• California (CCPA, as amended by CPRA) and state privacy laws: we honor the rights to know, delete, correct, opt out of sale or sharing (we do not sell or share personal data), and limit the use of sensitive personal information (we do not collect it), as well as non-discrimination for exercising privacy rights. Categories of data are listed in section 2 of the Privacy page. We likewise respond to requests from other U.S. states at info@socosoft.com.
• Commercial email (CAN-SPAM Act, 15 U.S.C. 7701 et seq.): our commercial emails identify the sender, avoid deceptive subject lines, include our location in Lima, Peru, and provide an opt-out mechanism processed within 10 business days.
• Children (COPPA): the Site is not directed at children under 13 and we do not knowingly collect their personal data.
• Colorado AI rules (SB 26-189) and California bot disclosure (Bus. & Prof. Code § 17940 et seq.): Nous is not designed to make standalone consequential decisions about consumers; where a customer configures workflows subject to automated-system documentation or disclosure duties, EBM CONSULTING provides the applicable technical documentation.
• Accessibility and DMCA: see section 6 regarding accessibility. The Site does not host user-uploaded content.

Annex G · European Union / EEA

• Regulation: Regulation (EU) 2016/679 (GDPR).
• Controller and contact: EBM CONSULTING S.A.C., RUC 20557438191, Lima, Peru · info@socosoft.com.
• Articles 13 and 14 disclosures: provided across sections 1 to 13 of the Privacy page (identity, purposes and legal bases, legitimate interests, recipients, international transfers and safeguards, retention, rights, right to withdraw consent, right to lodge a complaint, automated decisions, and data sources).
• Rights: access, rectification, erasure, restriction, portability, objection, and not being subject to automated decision-making (Arts. 15 to 22). Response timeframe: 1 month, extendable by 2 additional months (Art. 12.3).
• Complaints: before the supervisory authority of your EU/EEA Member State (see the European Data Protection Board directory at edpb.europa.eu).
• International transfers: see "International transfers" on the Privacy page (adequacy decisions, EU-U.S. Data Privacy Framework, or Standard Contractual Clauses under Decision (EU) 2021/914).
• Incidents: notification to the supervisory authority within 72 hours (Art. 33) and to affected individuals when there is a high risk (Art. 34).
• Cookies: Directive 2002/58/EC, Art. 5.3: prior consent required for non-essential cookies.
• AI: Regulation (EU) 2024/1689 (EU AI Act). See section 1 of this page.