Who we are and what this covers
Nimbase is operated by Bach Tran, an individual based in Australia ("we", "us"). This policy covers personal information handled through our website, hosted dashboard, API, CLI connections, MCP, integrations, and support. Contact the operator at nimbase.ai@gmail.com.
When an organisation connects its information, it controls which sources, members, projects, agents, and providers it authorises. We process that workspace content to provide the service. For a self-hosted installation, its operator controls hosting and configuration; this policy covers information sent to us, rather than every independently operated installation.
Information we collect
Account information includes your name, email address, authentication records, and organisation membership. Workspace information includes project settings, access permissions, uploaded or connected content, queries, and stored memory. Depending on the source you connect, this may include documents, messages, email threads, repository content, names, timestamps, and related metadata.
We also handle connector authorisations, tokens and any model credentials you provide; support correspondence; and technical information such as IP addresses, browser details, service events, and diagnostic logs. If you purchase a service, we may hold billing contact details and transaction records needed to administer it.
We collect information from you, from authorised workspace members, from services you connect, and through operation of the website and service. You can choose not to provide information, but some features may then be unavailable. Only connect information you have authority to share, including any required permissions for sensitive information.
How we use information
We use information to create and authenticate accounts, synchronise authorised sources, enforce access permissions, index and retrieve knowledge, provide memory and AI features you enable, respond to support requests, maintain and improve the service, administer agreed charges, detect misuse, and meet legal obligations. We do not sell your personal information or workspace content.
AI and memory providers
Nimbase is model and memory provider agnostic. New workspaces default to blocking external model and memory calls. An administrator can authorise external processing through the workspace data policy and provider configuration. When enabled, relevant source passages, queries, metadata, or derived information may be sent to the selected provider to create embeddings, organise memory, or generate answers. External memory providers may store additional copies of permitted content.
Blocking external AI calls does not mean that a hosted workspace is stored on your own device: Nimbase still uses hosting and operational service providers. Changing a provider or data policy also does not automatically erase copies previously sent to a provider.
Nimbase does not train its own general-purpose AI models on your workspace content. Processing for search, embeddings, and memory is part of delivering the features you enable. External providers have their own retention and data-use terms, which may differ by provider, account, or contract. We do not make a universal no-training promise for every provider or custom endpoint. Review the provider's terms before enabling it and choose settings appropriate for your data.
Google-connected information
If you connect Gmail or Google Drive, we request read-only access. Gmail syncs authorised email threads and related message metadata; Google Drive syncs supported file content and metadata from the folder you select. We store and index that information to provide workspace knowledge, search, and memory according to your permissions. These connectors do not send email or modify your Google files.
Google-connected information is used for the user-facing features you authorise, and is not sold, used for advertising, or used to train general-purpose AI models. Any transfer to an AI or memory provider must support those authorised features and comply with the Google API Services User Data Policy, including its Limited Use requirements. Human access is limited to your affirmative agreement for specific data, necessary security investigations, legal requirements, or permitted aggregated internal operations.
You can revoke the connector in Nimbase or remove its access in your Google Account. Revoking access stops future authorised access; request deletion separately for information already stored in Nimbase or a provider.
Hosting and overseas processing
Our hosted application functions and primary database are configured in Sydney, Australia. That does not guarantee that all processing stays in Australia. Analytics, email, job services, network infrastructure, and enabled AI or memory providers may process information overseas, including in the United States. Locations depend on the service and account configuration, especially for a provider you choose. Contact us for the current providers and known locations relevant to your workspace.
Cookies and analytics
Authentication uses cookies or similar storage to maintain sessions. When enabled, PostHog uses browser storage and event information for website and product analytics. Website analytics may record pageviews, link interactions, browser and device information, and page URLs. Product analytics records selected actions and identifiers, such as user or workspace IDs, to understand usage.
The dashboard's analytics configuration disables automatic interaction capture and session recording, and removes URL properties before sending events. This configuration applies to the dashboard; website analytics is configured separately. Browser settings can restrict cookies or storage, although blocking essential storage may affect sign-in. Booking a demo through Calendly is also subject to Calendly's own privacy practices.
Security
We use account authentication, workspace and project permissions, and encryption for stored connector and model credentials. We take reasonable steps to protect information against loss, misuse, and unauthorised access. No system can guarantee absolute security. You can help by protecting credentials, reviewing access grants, and reporting suspected incidents to nimbase.ai@gmail.com.
Retention and deletion
We retain information while it is needed to provide the service and for legitimate security, legal, and record-keeping purposes. We do not currently publish a single fixed retention period for all content, logs, and backups. Contact us for the retention arrangements applicable to your workspace or to request account closure and deletion.
Forgetting a source removes it from authorised retrieval and initiates supported provider cleanup. Disconnecting a connector stops future syncs and does not by itself guarantee deletion of existing copies. Removing a user's account also does not necessarily delete the organisation's records.
External cleanup depends on the provider's capabilities. Some integrations cannot fully purge derived information; for example, Zep may retain information in graph summaries after an episode is deleted. Deletion from a provider's active API does not certify immediate deletion from its backups or logs. We will explain known limitations when handling a deletion request. Information retained for a legal obligation or in backups remains subject to applicable protections.
Your choices and privacy requests
You can request access to or correction of your personal information, request deletion, or ask about how it is used by emailing nimbase.ai@gmail.com. Include the account email and workspace concerned, and describe your request. Do not send passwords or secret keys. We may verify your identity and authority before acting. Where an organisation controls the relevant content, we may need to work with its administrator. We will explain any lawful reason we cannot fulfil a request.
If you have a privacy complaint, contact us with the relevant details. We will acknowledge it, investigate, and respond within a reasonable period. If you are not satisfied, you may contact the Office of the Australian Information Commissioner or another regulator with jurisdiction. Your rights depend on the laws that apply to your circumstances.
Policy updates and contact
We update this policy when our practices change and publish the revised date here. We will provide notice of material changes through the service or email where practicable, and obtain further consent where required. Questions can be sent to Bach Tran at nimbase.ai@gmail.com. See also our Terms of Service.