Privacy at Nimbus

Operator

Nimbus is operated by Good Agents, Inc., a Delaware corporation, with its principal place of business at 4502 Banister Lane, #2, Austin, TX 78745, United States. Contact support@nimbus.fan.

Account and workspace information

We collect account information such as the installing user's email, Slack workspace identifiers, subscription state, and configuration needed to operate Nimbus for that workspace.

Slack interaction data

Nimbus processes messages where it is mentioned or invited so it can understand the active request and respond. Raw message text is not stored long-term; durable memory is limited to extracted knowledge and operational context used to improve future work.

Usage and billing records

We keep usage, task, billing, and diagnostic records needed to operate the service, prevent abuse, troubleshoot issues, and explain account activity to workspace administrators.

Providing Nimbus

We use data to install and configure Nimbus, respond to Slack requests, maintain workspace memory, route approved integrations, and provide dashboard and billing features.

Reliability and safety

We use operational records to debug failures, protect production systems, audit important actions, and keep tenant workspaces isolated from each other.

Model providers

Customer workspace content is sent to configured commercial model providers only as needed to complete requested work. Nimbus does not share customer workspace content with model providers for training.

Service providers

We use infrastructure, payment, authentication, and AI service providers to run Nimbus. These providers receive data only as needed for the service they provide.

No sale of personal data

Nimbus does not sell personal data.

Legal requests

We may disclose information when required by law or to protect Nimbus, our customers, or the public from fraud, abuse, or security threats.

What a customer can connect

If a customer connects Google, Nimbus receives only the permissions they approve on Google's screen. One connect covers their name and email, Gmail, Drive, Docs, Sheets, Slides, Tasks, and Calendar. Gmail: read a message or thread they name, add or remove a label, archive, mark read or unread, save a draft, and send mail they asked to send. Nimbus does not permanently delete mail. Drive: search files and read the contents of a file they name, including a Doc exported as text, a Sheet as cell values, and a PDF or text file Nimbus did not create, and create a new file for that job. Docs: read a Doc they already have and append or replace its text. Sheets: read a cell range they name and update that range. Slides: read a deck they already have and add or change slide text. Nimbus can also create a new Doc, Sheet, or deck. Tasks: list task lists and tasks, add a task, and mark it complete or update its title. Calendar: list events, and create, move, or delete the event they named. Nimbus does not ask for Google Forms, Google Ads, YouTube, Analytics, Search Console, or Gemini on that connection.

How we use Google data

We use Google data only to do the job that customer asked for in their own workspace. We do not sell Google data. We do not use it for advertising. We do not use it to train general or foundation models. Nimbus's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where it is stored and who sees it

Connection tokens are stored for that customer workspace so a later job they ask for can run. The content needed for a job may be sent to the model provider configured for that workspace, only to finish that job, and not for that provider's training. We do not give one customer's Google data to another customer.

Disconnect and deletion

A customer can disconnect Google from the Nimbus connections page. They can also email support@nimbus.fan and ask us to delete stored Google data for their workspace.

What a customer can connect

If a customer connects Meta (Facebook), Nimbus receives only the permissions they approve on Facebook's screen. That connection can include their public name and profile photo, the Facebook Pages they manage, and, under the pages_read_user_content permission, the text of a Page post and its reaction, comment, and share counts. Nimbus does not read the text of comments on those posts. It can also include the business portfolios they can access, the ad accounts in those portfolios, and campaign names. For a campaign they name, Nimbus can read Impressions, Conversions, Spend, Clicks, and Reach. After they confirm in Slack, Nimbus can pause or resume that same campaign. Nimbus does not create campaigns or change budgets on this connection. With the customer's permission, Nimbus reads their connected Instagram professional account's profile (username, follower and media counts), recent media (caption, link, like and comment counts), and account insights (reach and follower count), to answer their requests. It never posts.

How we use Meta data

We use Meta data only to do the job that customer asked for in their own Slack workspace, including showing who connected, listing Pages and portfolios, quoting a Page post and its reaction, comment, and share counts when they ask (the post text and those counts are read under pages_read_user_content; the text of comments is not read), reporting those five campaign numbers, and pausing or resuming a campaign they named and confirmed. We do not sell Meta data. We do not use it to train general or foundation models. We do not use it to run ads for anyone else.

Where it is stored and who sees it

The connection token is stored for that customer workspace so a later job they ask for can run. The content needed for a job may be sent to the model provider configured for that workspace, only to finish that job, and not for that provider's training. We do not give one customer's Meta data to another customer.

How to ask for deletion

A customer can disconnect Facebook from the Nimbus connections page. They can also ask us to delete the stored Facebook or Instagram connection, and the data we saved only because of that connection, by emailing support@nimbus.fan or by following the instructions at /data-deletion (https://www.nimbus.fan/data-deletion). We complete that deletion within 30 days.

What we receive

When a merchant installs Nimbus: AI Operations Agent, Nimbus can read product records and theme files so it can review the change the merchant asked for in Slack. Theme files are only read for that review. Nimbus does not collect customer email, phone numbers, or order records from Shopify for this app.

Why

Nimbus reads theme files only for that review. A product change is applied only after the merchant confirms it in Slack, and the previous product record is kept so that change can be restored from Slack.

How long we keep it

Product backups are kept so a product change can be restored from Slack. Theme files are only read for the review. Product backups are deleted when Shopify sends shop/redact.

How to ask for deletion

Uninstalling the app removes the store token. When Shopify sends shop/redact, Nimbus deletes the store token, the product backups, and the Slack link for that store. You can also email support@nimbus.fan.

Access and deletion

Customers can request access, correction, export, or deletion of account data. Workspace memory is retained for the duration of the subscription and deleted according to the retention commitments on our security page.

Revoking Slack access

Workspace administrators can revoke Nimbus from Slack workspace settings under Manage Apps. Revocation prevents future Slack access for that workspace.