Hermes Agent

The ToS explicitly states that Nous Research uses user data for AI training without a default opt-out. Section 12.3(a) grants Nous Research a broad license to use Your Data for 'training, fine-tuning, refining, grounding, evaluating, developing, operating, testing, and enhancing machine learning and artificial intelligence models.' While Privacy Mode exists as an opt-out mechanism mentioned in the Privacy Policy, it is prospective only and does not retroactively protect previously collected data. The ToS further states that 'aggregated, anonymized, or de-identified data and any models, outputs, or derivatives developed therefrom may be used by Nous Research for any purpose.' This indicates data feeds the AI training pipeline by default.

“[ToS] Section 12.3(a): 'You hereby grant Nous Research a non-exclusive, worldwide, royalty-free, fully paid-up, transferable, and sublicensable license to use, reproduce, modify, create derivative works from, and otherwise process Your Data for... training, fine-tuning, refining, grounding, evaluating, developing, operating, testing, and enhancing machine learning and artificial intelligence models.'”

The ToS grants Nous Research an extraordinarily broad, perpetual, irrevocable, and sublicensable license over user content. Section 12.3(a) explicitly permits Nous Research to use, reproduce, modify, and create derivative works from Your Data for any purpose, including commercial purposes. Section 12.3(c) states that 'Service Data may be used by Nous Research and its affiliates, licensees, successors, and assigns' without restriction and 'to third parties for any lawful purpose, including for such third parties' own use, analysis, and product development.' This license survives account termination under Section 17.3.

“[ToS] Section 12.3(c): 'you hereby grant Nous Research the right to provide, license, or otherwise make available Your Data and Service Data to third parties for any lawful purpose, including for such third parties' own use, analysis, and product development.'”

The documents reveal broad third-party sharing rights with minimal restrictions. The Privacy Policy states that Nous Research 'may disclose personal information and Service-related data, including prompts, inputs, outputs, usage data, telemetry, trace data, and related interaction information, with affiliates, business partners, research collaborators, infrastructure providers, analytics providers, model providers, and other third parties.' Section 12.3(c) of the ToS explicitly permits providing 'Your Data and Service Data to third parties for any lawful purpose.' No published sub-processor list is referenced, and DPA requirements for sub-processors are not clearly established.

“[Privacy] 'We may also disclose personal information and Service-related data, including prompts, inputs, outputs, usage data, telemetry, trace data, and related interaction information, with affiliates, business partners, research collaborators, infrastructure providers, analytics providers, model providers, and other third parties for purposes consistent with this Privacy Policy.'”

The ToS provides limited clarity on data retention periods. Section 9.2 states that upon termination, 'Nous Research will store Your Data for a period of six months' should the user wish to reopen the account or export data, and then 'deletes or returns all the personal data to the controller after the end of the provision of services.' However, Section 12.3(c) indicates that 'aggregated, anonymized, or de-identified' data and derivatives 'may be used by Nous Research for any purpose' without clear termination limits. The Privacy Policy does not specify clear retention timelines beyond the general reference to Section 9.2. Backup retention and the treatment of derivatives created from user data are not clearly addressed.

“[ToS] Section 9.2: 'Upon termination, Nous Research will store Your Data for a period of six months, should you wish to reopen the Account to resume the use of the Nous Research Services or to export Your Data, unless instructed otherwise by you. Nous Research deletes or returns all the personal data to the controller after the end of the provision of services.'”

The ToS grants users ownership of AI Outputs but with significant ambiguity. Section 8.4 states: 'you shall own all right, title, and interest in AI Outputs generated specifically for you through your use of the Nous Research Services; provided, however, that Nous Research retains all rights in the underlying models, algorithms, training data, and technologies.' However, Section 12.3(a) permits Nous Research to use outputs to improve models and create derivatives, and Section 12.3(c) allows licensing outputs to third parties. The language 'provided, however' creates uncertainty about whether Nous can exercise derivative rights over user-generated outputs. Users cannot assert exclusive IP ownership in the outputs if Nous retains rights to create derivatives.

“[ToS] Section 8.4: 'you shall own all right, title, and interest in AI Outputs generated specifically for you through your use of the Nous Research Services; provided, however, that Nous Research retains all rights in the underlying models, algorithms, training data, and technologies used to generate such AI Outputs.'”

The documents do not reference SOC 2 Type II, ISO 27001, HIPAA, or formal GDPR compliance certifications. The ToS Section 4.2 mentions that 'Nous Research will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Your Data, as described in the Guidelines,' but no specific Guidelines or security documentation are provided in the submitted documents. The Privacy Policy mentions 'reasonable security measures' but provides no evidence of third-party compliance audits or published trust certifications. A Data Processing Agreement clause exists (Section 9), but no separate DPA document or trust page is referenced.

“[ToS] Section 4.2: 'Nous Research will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Your Data, as described in the Guidelines.' [Privacy] 'We implement and maintain reasonable security measures appropriate to the nature of the personal information that we collect, use, retain, transfer or otherwise process.'”