Privacy Policy

1. Information We Collect

We collect information you provide directly: account details (name, email, password), organization information, account connections (OAuth tokens, domain verification data), lead data you upload (names, emails, company info), and campaign content you create.

We automatically collect: usage data, device information, IP addresses, and email engagement metrics (opens, clicks, replies, bounces).

2. How We Use Your Information

We use your information to provide and maintain the Service, send emails on your behalf through configured mailboxes, track email deliverability and engagement, enforce sending limits and domain reputation protections, communicate with you about the Service, and comply with legal obligations.

3. AI Features

Nimu uses AI to generate suggestions and to trigger actions based on the prompts you provide. The AI operates on your instructions to help you draft content, plan campaigns, and carry out tasks within the Service.

The AI operates only on the data you direct it to, such as campaign content, prospect lists, and your workspace profile. This may include business contact data you have chosen to work with, which we process on your behalf as described in the Lead & Recipient Data section. We do not use your data, or your recipients' data, to train AI models, and we never sell it. Your own account credentials, such as login details and connected-account tokens, are never sent to the AI.

For error handling and reliability, we design our logging to capture non-identifying identifiers (such as an internal user or workspace ID) rather than the personal data contained in your prompts.

4. Third-Party Integrations & Connected Accounts

Nimu lets you connect third-party accounts to power specific features. You choose which accounts to connect, and you can disconnect them at any time from your settings. When you connect an account, we store the access and refresh tokens needed to operate the integration, encrypted at rest, along with basic profile information (such as your name and email on that account) to identify the connection.

• Google (Gmail): With your permission, Nimu sends email from your Gmail account on your behalf using the send-only scope. We do not read, import, or store your Gmail inbox or messages.
• Google (Sign-in): You may sign in with your Google account, which shares your basic profile (name and email) with us.
• Google Ads: If you connect Google Ads, Nimu reads campaign performance metrics and can pause or enable campaigns you manage, at your direction.
• LinkedIn and X (Twitter): If you connect these accounts, Nimu publishes posts you create to them on your behalf. Nothing else is accessed.

Google API Limited Use disclosure. Nimu's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features you have enabled, do not transfer it except as necessary to provide those features or as required by law, do not use it for advertising, and do not allow humans to read it except with your consent, for security purposes, or as required by law.

5. Data Storage & Security

Your data is stored on Supabase (PostgreSQL) with encryption at rest and in transit. Connected-account tokens and API credentials are encrypted before storage. We use industry-standard security measures to protect your data. No system is 100% secure, and we cannot guarantee absolute security.

Information retrieved through third-party integrations, including connected Google, LinkedIn, and X accounts, is encrypted in transit and at rest. We process such information only as needed to provide the features you have enabled, and we do not sell it.

6. Data Sharing

We do not sell your personal data. We may share data with infrastructure providers (hosting, database, email delivery) as necessary to operate the Service, and when required by law or to protect our rights.

7. Lead & Recipient Data

You are the data controller for any lead or recipient data you upload to the Service. You are responsible for ensuring you have the appropriate legal basis to contact these individuals. Nimu processes this data on your behalf as a data processor.

8. Cookies & Tracking

We use essential cookies for authentication and session management. We use tracking pixels in sent emails (when open tracking is enabled by you) and link tracking for click analytics (when click tracking is enabled by you). You control whether tracking is enabled per campaign.

9. Your Rights

You may access, correct, or delete your account data at any time through your account settings. You may export your data. You may request deletion of your account and all associated data. Email recipients may unsubscribe from your campaigns at any time via the unsubscribe link included in every email.

10. Data Retention

We retain your data for as long as your account is active. Upon account deletion, we remove your data within 30 days, except where retention is required by law. Aggregate, anonymized analytics may be retained indefinitely.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service.

12. Contact

For privacy-related questions, contact us at privacy@nimu.app.