This Privacy Policy describes how NimbusLabs, LLC ("NimbusLabs", "we", "us", or "our") collects, uses, and discloses your personal information when you visit our website at nimbuslabs.com or our store at shop.nimbuslabs.com (together, the "Site"), use our services, make a purchase, use our NetSuite applications, or otherwise communicate with us (collectively, the "Services"). For purposes of this Privacy Policy, "you" and "your" means you as the user of the Services, whether you are a customer, website visitor, or another individual whose information we have collected pursuant to this Privacy Policy.
Please read this Privacy Policy carefully. It describes what we collect and how we use and disclose it; it is a notice of our practices, not a request for your agreement.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Site, update the "Last updated" date and take any other steps required by applicable law.
How We Collect and Use Your Personal Information
To provide the Services, we collect and have collected over the past 12 months personal information about you from a variety of sources, as set out below. The information that we collect and use varies depending on how you interact with us.
In addition to the specific uses set out below, we may use information we collect about you to communicate with you, provide or improve the Services, comply with any applicable legal obligations, enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.
Our NetSuite Applications
NimbusLabs also makes applications that run inside your company's NetSuite account, NimbusDash and NimbusQL (the "Applications"). They run in your NetSuite account; NimbusLabs holds no shared credentials for that account and has no access to it or to the data in it unless your administrator gives it. If your administrator gives NimbusLabs access to your account for installation or support, it is through a role assigned to named NimbusLabs personnel, each signing in with their own login, for that task, and it lasts until your administrator removes it; our Data Processing Agreement covers what we can see there. When you contact us for support, we use your request and our correspondence about it only to provide support, and we delete them with anything you sent with them; we keep no separate record of the request. Anything you send so that we can diagnose an issue, such as a screenshot or an export, we process on your company's behalf under our Data Processing Agreement, only to resolve the request; it is held in our support email, which Microsoft hosts for us, never in cloud file storage, and we delete it from our active mailboxes and permitted working copies within 90 days after the request is resolved, or sooner as the Data Processing Agreement sets out; a deleted item can remain recoverable in our email service for a time afterward, as section 10.3 of that agreement describes. The Applications send NimbusLabs the following:
- Acceptance of the Applications' terms. Your administrator accepts the agreement that governs an Application either when installing it, in NetSuite's installer, or, once the Application offers it, inside the Application, where an administrator of your NetSuite account can also accept our Data Processing Agreement for your company. When the terms are accepted at installation, NetSuite records the acceptance for us: we receive your NetSuite account number and company name, the bundle version installed, the installation date and the date the terms were most recently accepted, and NetSuite keeps the identity of the accepting user in your own account, not in ours. When they are accepted inside an Application, the Application sends the acceptance to us: we record your NetSuite account number, the NetSuite environment it was accepted in, the Application and its version, your company name, the document and version accepted and the version of our Data Processing Agreement then in force, the time, and the accepting administrator's NetSuite internal ID and role. That internal ID identifies the administrator only within your NetSuite account, and the record holds no name, email address or IP address. We keep either record as evidence of acceptance for as long as the agreement and our records of it are needed.
- License validation. When an Application checks its license, it sends your NetSuite account number and the company information NetSuite holds for your account: the company's name and legal company name, its website and general email address, and its country, state and time zone. We use this to validate the license, to administer your account and to contact your company about it.
- Notice address. If your administrator sets an email address for legal and data-protection notices in an Application, it sends us that address and we store it for your account. It may be an individual's work email address rather than a general mailbox. We use it only to send you notices under the agreement that governs the Application and our Data Processing Agreement, such as notice of a new subprocessor, and we keep a record of each notice we send to it. Where none is set we use your company's general email address above. An address your company gave us in writing, in a signed agreement, in a signed copy of the Data Processing Agreement or by email to legal@nimbuslabs.com, takes precedence over one set in an Application, and the Application does not change it: it is changed the same way, by writing to legal@nimbuslabs.com. An address set in an Application can be changed or removed there, or by writing to legal@nimbuslabs.com.
- Feedback. When a user submits feedback from inside an Application, it sends that user's name, email address and NetSuite role, your company name and account number, and the message. We use this to respond and to improve the Applications.
- Links to our website. When a user follows a NimbusLabs link from inside an Application, our server records the visit's IP address, the country derived from it, the referring page and the browser, as Usage Data.
- Product usage analytics. NimbusDash can send us events that record which of its features are used: the feature event, such as that a dashboard was opened or a setting was changed, with any setting choice made from a fixed list and counts such as the number of widgets on a dashboard, together with the name of the page in use, the NimbusDash version, the type of NetSuite environment and a random identifier for the user's NetSuite login session. The events contain no business-record contents, query text, AI prompts or responses, or other free-form content entered by users, and NimbusDash sets no cookie and loads no Google script in your NetSuite session to send them. Nothing is sent for a user until an administrator of your NetSuite account has acknowledged our notice in NimbusDash and given any authorization it asks for, and that user has chosen to share by clicking Allow. For a new installation of NimbusDash 4.0 or later, the setting that allows sharing can default to on, when NimbusDash confirms with our licensing platform that your account is new; an account that already had a preference keeps it when it upgrades, and a reinstallation or any other newly initialized setting starts off until an administrator turns it on and authorizes sharing for your company. An administrator can turn sharing off for everyone, and each user can stop at any time, in NimbusDash's Settings. Turning sharing off stops future collection; it does not automatically delete information already sent, and the retention periods below and your rights under this Privacy Policy still apply. The events reach our licensing platform from NetSuite's server, with your NetSuite account number and the company information described under License validation. In its active systems the platform keeps a log of each batch for 14 days, with your account number, the time, the NimbusDash and NetSuite versions and the type of environment, the address of NetSuite's server and the location derived from it, and the event names and their number, with every other value and the session identifier masked, and a daily count of events per account for 35 days; copies in our backups last as the Backups row of the retention table below states. We keep these to apply a daily limit, to operate and secure the service and to forward the events. While we hold these records we can connect them to your NetSuite account and to the other records we hold about it: the batch log, which names the events, for 14 days and for longer in backup copies, and the daily count, which records how many events your account sent each day, for 35 days; in an account with a single user, that means to a person. We forward the events, the session identifier, the NimbusDash version, the type of environment and the page name to Google Analytics, from our server's address and without your account number or any user's identity, with advertising uses denied and Google's optional data sharing turned off. Google processes them for us and keeps them for 2 months, without resetting that period on new activity, and deletes expired data monthly; its standard reports keep their totals. We rely on each user's choice to share, which that user can withdraw at any time, and we use the events only to understand and improve how our applications are used, never for advertising or profiling. How Google uses this information is described at How Google uses information from sites or apps that use our services.
- NimbusAI. The Applications' optional AI assistant can run on an AI provider included with your license. On that provider, the content the assistant sends passes through a gateway in NimbusLabs' Microsoft Azure subscription, which is configured to record none of it, on its way to the model service; NimbusLabs' licensing platform receives usage metadata for each request (your account number, request identifiers, token counts, cost, status and times) and never the content. We process that content and the request-level metadata on your company's behalf under our Data Processing Agreement, not for our own purposes and never for advertising. From the request-level metadata we also keep a monthly allowance summary for each account (the account number, the product, the month, the number of calls, the token totals and the cost total, with no request identifiers or request timestamps) as our own business record, for account administration, reconciling the AI allowance we fund, accounting and resolving related disputes, for 24 months after the month it describes, and then delete it. We do not sell or share it or use it for advertising or profiling. What the assistant sends, to whom, and what is kept is on our NimbusAI Data Handling page.
What Personal Information We Collect
The types of personal information we obtain about you depends on how you interact with our Site and use our Services. When we use the term "personal information", we are referring to information that identifies, relates to, describes or can be associated with you. The following sections describe the categories and specific types of personal information we collect.
Information We Collect Directly from You
Information that you directly submit to us through our Services may include:
- Contact details including your name, address, phone number, and email.
- Order information including your name, billing address, payment confirmation, email address, phone number, and the NetSuite account ID you give at checkout.
- Account information including the email address you use to sign in to your customer account and other information used for account security purposes.
- Shopping information including the items you view, put in your cart or purchase.
- Customer support information including the information you choose to include in communications with us, for example, when sending a message through the Services.
Some features of the Services may require you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features.
Information We Collect about Your Usage
We may also automatically collect certain information about your interaction with the Services ("Usage Data"). To do this, we may use cookies, pixels and similar technologies ("Cookies"). Usage Data may include information about how you access and use our Site and your account, including device information, browser information, information about your network connection, your IP address and other information regarding your interaction with the Services.
Information We Obtain from Third Parties
Finally, we may obtain information about you from third parties, including from vendors and service providers who may collect information on our behalf, such as:
- Companies who support our Site and Services, such as Shopify.
- Our payment processors, who collect payment information (e.g., bank account, credit or debit card information, billing address) to process your payment in order to fulfill your orders and provide you with products or services you have requested, in order to perform our contract with you.
- When you visit our Site, open or click on emails we send you, or interact with our Services, we, or the analytics and customer-relationship providers we work with (Google Analytics and HubSpot), may automatically collect certain information using cookies, pixels and similar technologies.
Any information we obtain from third parties will be treated in accordance with this Privacy Policy. Also see the section below, Third Party Websites and Links.
How We Use Your Personal Information
- Providing Products and Services. We use your personal information to provide you with the Services in order to perform our contract with you, including to process your payments, fulfill your orders and subscriptions, send notifications to you related to your account, purchases, subscriptions or other transactions, and create, maintain and otherwise manage your account and the features and functionalities related to it. We may also enhance your shopping experience by enabling Shopify to match your account with other Shopify services that you may choose to use. In this case, Shopify will process your information as set forth in its Privacy Policy and Consumer Privacy Policy.
- Marketing. We may use your contact details to send you promotional and product emails, which you can opt out of at any time using the unsubscribe option in the email, and we use Usage Data to understand how our Site is used and to improve it. We do not use your personal information to show you advertisements on other websites.
- Security and Fraud Prevention. We use your personal information to detect, investigate or take action regarding possible fraudulent, illegal or malicious activity. If you choose to use the Services and register an account, you are responsible for keeping your account credentials safe. We highly recommend that you do not share your username, password, or other access details with anyone else. If you believe your account has been compromised, please contact us immediately.
- Communicating with You and Service Improvement. We use your personal information to provide you with customer support and improve our Services. This is in our legitimate interests in order to be responsive to you, to provide effective services to you, and to maintain our business relationship with you. Content your company sends us so that we can resolve a support request is used only for that request, as described under Our NetSuite Applications, and not to improve our Services.
Cookies
Like many websites, we use Cookies on our Site. For specific information about the Cookies that we use related to powering our store with Shopify, see https://www.shopify.com/legal/cookies. We use Cookies to power and improve our Site and our Services (including to remember your actions and preferences), to run analytics and better understand user interaction with the Services (with your consent where the law requires it, and otherwise in our legitimate interests to administer, improve and optimize the Services). Apart from Shopify's own Cookies on our store, the Cookies set on our Site by third parties are those of Google Analytics, which we use to measure how the Site is used, and HubSpot, which we use to run our contact forms and manage our relationship with you; neither is used to advertise to you on other websites. A video on our pages loads from YouTube only when you click to play it; the player then loads in YouTube's privacy-enhanced mode, contacts YouTube and may set YouTube's own Cookies, under Google's privacy policy.
If you visit from the European Economic Area, the United Kingdom or Switzerland, we ask before setting any optional Cookies. Google Analytics and HubSpot's tracking Cookies are set only after you accept them in our cookie banner; if you decline, or make no choice, neither is set, and a single Cookie remembers your choice. HubSpot's script still tells HubSpot that a page was viewed, without Cookies, and HubSpot counts that view without linking it to you or to any record about you. You can change your choice at any time from the Cookie settings link at the bottom of every page; withdrawing your consent stops Google Analytics, stops HubSpot from recognizing you, and removes both services' tracking Cookies from your browser. HubSpot's contact forms load whatever you choose, since they are how you write to us, and set only a short-lived Cookie that protects them against bots. Our store shows Shopify's own cookie banner to visitors from the same places. Elsewhere, Google Analytics and HubSpot run without asking, and the choices below are yours.
Most browsers automatically accept Cookies by default, but you can choose to set your browser to remove or reject Cookies through your browser controls. Please keep in mind that removing or blocking Cookies can negatively impact your user experience and may cause some of the Services, including certain features and general functionality, to work incorrectly or no longer be available.
Because we do not sell or share personal information, there is nothing a Global Privacy Control (GPC) signal needs to switch off on our website. On our store, Shopify treats a GPC signal as a request to opt out of the sale or sharing of personal information for the browser or device that sends it and, where it can associate that device with a customer account, for that account too. To learn more about Global Privacy Control, you can visit https://globalprivacycontrol.org/. We do not respond to other "Do Not Track" signals that may be sent from your web browser or device.
How We Disclose Personal Information
In certain circumstances, we may disclose your personal information to third parties for contract fulfillment purposes, legitimate purposes and other reasons subject to this Privacy Policy. Such circumstances may include:
- With vendors or other third parties who perform services on our behalf (e.g., IT management, payment processing, subscription management, data analytics, customer support, email and cloud storage).
- When you direct, request us or otherwise consent to our disclosure of certain information to third parties, such as through your use of login integrations, with your consent.
- In connection with a business transaction such as a merger or bankruptcy, to comply with any applicable legal obligations (including to respond to subpoenas, search warrants and similar requests), to enforce any applicable terms of service, and to protect or defend the Services, our rights, and the rights of our users or others.
Optional AI features of our NetSuite Applications may send content your administrator has authorized to an AI provider. On the provider included with your license, that provider is Microsoft, processing the content on NimbusLabs' Microsoft Azure account as our subprocessor, and the usage records of those requests are held on our licensing platform, which Amazon Web Services hosts for us; on your own OpenAI or Anthropic key, the content goes directly from your NetSuite account to that provider under your own agreement with it. What is sent and what each party keeps is described on our NimbusAI Data Handling page, and the companies that process customer data on our behalf are listed on our Subprocessors page. Neither that content nor those usage records is used for the marketing described elsewhere in this Privacy Policy.
Product usage analytics from NimbusDash, sent only for users who choose to share them, are forwarded to Google Analytics, which processes them for us, as described under Our NetSuite Applications.
We have in the past 12 months disclosed the following categories of personal information about users, to the following categories of recipients: for the purposes set out above in "How we Collect and Use your Personal Information" and "How we Disclose Personal Information", and, in the last two rows, for the advertising purposes those rows describe:
| Category | Categories of Recipients |
|---|---|
|
|
|
|
|
|
We do not ask for sensitive personal information, and we do not use any we receive to infer characteristics about you. If some reaches us anyway, in a support request or while we have access to a customer's NetSuite account for support, we stop the work it affects and tell the customer, as our Data Processing Agreement provides, and we do not continue that work with it. We use it for nothing else, except to keep our services secure and to meet our legal obligations.
We do not "sell" personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are defined in applicable law). Until July 9, 2026, our previous website loaded a Google Ads tag, which let Google collect visitors' cookie identifiers and the pages they viewed for advertising. The Google Ads account it reported to never ran a campaign. Until September 24, 2026, our store also had Shopify Network Intelligence turned on, a Shopify setting that uses a store's customer data together with other merchants' data, including for ad targeting. We removed the tag with that site and turned the setting off, and we have not sold or shared personal information since. The analytics and customer-relationship providers named under Cookies process personal information to provide their services to us. Our store also has a Your Privacy Choices page, where you can record a request to opt out of the sale or sharing of personal information for the browser you are using and, if you enter your email address, for your customer account. How our store treats a Global Privacy Control signal is described under Cookies.
Third Party Websites and Links
Our Site may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms, who may use it as those platforms allow; our own use of it remains subject to this Privacy Policy. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.
Children's Data
The Services are not intended to be used by children, and we do not knowingly collect any personal information about children. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted.
We do not "sell" or "share" (as those terms are defined in applicable law) the personal information of anyone, including individuals under 16 years of age.
Security and Retention of Your Information
Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." In addition, any information you send to us may not be secure while in transit. We recommend that you do not use insecure channels to communicate sensitive or confidential information to us.
How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide the Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies. The periods we apply are these:
| Information | How long we keep it |
|---|---|
| Support requests, our correspondence about them, and content your company sends with them | Deleted within 90 days after the request is resolved, or sooner as our Data Processing Agreement sets out; a deleted item can stay recoverable in our email service for a time afterward, as that agreement describes. We keep no separate record of a support request |
| Requests to exercise privacy rights, complaints, and our responses | 24 months, kept apart from support requests |
| License, account and acceptance records for our applications | As long as the license exists and our records of the agreement are needed |
| The notice address and the notices we send to it | As long as the agreement lasts and our records of it are needed |
| Feedback sent from inside an application | As long as we need it to respond and to improve the applications |
| NimbusAI request-level usage records | While the included provider is in use on your account, then deleted within 30 days after that use ends |
| NimbusAI monthly allowance summaries | 24 months after the month described, then deleted |
| The logs of our applications' requests to our licensing platform | 14 days |
| Product usage analytics from our applications | Our licensing platform's log of each batch, 14 days in our active systems, with copies in backups as the Backups row states; the daily count of events per account, 35 days; in Google Analytics, 2 months, without resetting on new activity, deleted monthly, while standard aggregated reports keep their totals |
| Visits through NimbusLabs links in our applications | 60 days |
| Purchase and subscription events from our subscription provider | 90 days |
| Orders placed in our store | As long as we need them for accounting, tax and the subscriptions they create |
| Website analytics and contact-form records | Our Google Analytics retention settings are 2 months for event data other than key events, and 14 months for user-level data and key-event data. New activity resets the retention period for user-level data only. Google deletes expired data monthly. These settings affect explorations and funnel reports, but not standard aggregated reports. HubSpot keeps contact-form submissions and the contact records they create until you ask us to delete them or we delete them |
| Backups of our systems | Local copies are deleted by a daily job once they are at least 15 full days old; off-site copies are configured to expire at 120 days |
Your Rights
Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.
- Right to Access / Know: You may have a right to request access to personal information that we hold about you, including details relating to the ways in which we use and share your information.
- Right to Delete: You may have a right to request that we delete personal information we maintain about you.
- Right to Correct: You may have a right to request that we correct inaccurate personal information we maintain about you.
- Right of Portability: You may have a right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.
- Restriction of Processing: You may have the right to ask us to stop or restrict our processing of personal information.
- Withdrawal of Consent: Where we rely on consent to process your personal information, you may have the right to withdraw this consent.
- Appeal: You may have a right to appeal our decision if we decline to process your request. You can do so by replying directly to our denial.
- Managing Communication Preferences: We may send you promotional emails, and you may opt out of receiving these at any time by using the unsubscribe option displayed in our emails to you. If you opt out, we may still send you non-promotional emails, such as those about your account or orders that you have made.
You may exercise any of these rights where indicated on our Site or by contacting us using the contact details provided below.
We will not discriminate against you for exercising any of these rights. We may need to collect information from you to verify your identity, such as your email address or account information, before providing a substantive response to the request. In accordance with applicable laws, you may designate an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. We will respond to your request in a timely manner as required under applicable law.
Complaints
If you have complaints about how we process your personal information, please contact us using the contact details provided below. If you are not satisfied with our response to your complaint, depending on where you live you may have the right to appeal our decision by contacting us using the contact details set out below, or lodge your complaint with your local data protection authority.
International Users
Please note that we may transfer, store and process your personal information outside the country you live in. Your personal information is also processed by staff and third party service providers and partners in these countries.
If we transfer your personal information out of Europe, we will rely on recognized transfer mechanisms like the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, as relevant, unless the data transfer is to a country that has been determined to provide an adequate level of protection.
Contact
Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please email us at legal@nimbuslabs.com or write to us at NimbusLabs, LLC, 419 Hidden Hills Lane, Escondido, CA 92029, United States.