Privacy Policy

1. Introduction

Nimbus Value, LLC, a Virginia limited liability company ("Nimbus Value," "we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our sales enablement platform (the "Service"). Please read this policy carefully.

Your use of the Service is also governed by our Terms of Service, which incorporate this Privacy Policy by reference. The Service is a business-to-business product intended for use by organizations and business professionals; it is not directed to consumers acting in a personal capacity.

Where we rely on your consent (for example, when you accept this policy at account registration or authorize a Google account connection), we obtain your affirmative consent and maintain a record of it.

This policy also serves as our notice at collection under California law and describes the rights available to residents of U.S. states with comprehensive privacy laws. See Section 9 (Your Rights).

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address, company name, and website
• Profile information: sales assessment responses and theme preferences
• Business data: customer information, goals, initiatives, KPIs, and business cases you create
• Communications: messages sent through the in-app chat feature and support requests
• Documents: files and artifacts you upload to the platform

You are responsible for ensuring that you have all rights, consents, and legal bases required to provide any third-party personal information (such as your customers' contact details) to the Service, as further described in our Terms of Service.

2.2 Information Collected Automatically

• Usage data: pages visited, features used, and interaction patterns
• Device information: browser type, operating system, and screen resolution
• Log data: IP address, access times, and referring URLs
• Cookies and similar technologies for session management and preferences

2.3 Google User Data

Nimbus Value's Mail and Calendar features let you use your Gmail, Google Calendar, and Google contacts inside the Service. They work only after you choose to connect your Google account and grant permission on Google's consent screen. You can decline any individual permission; the features that depend on it are then unavailable.

What we access, and why

How we use Google user data

Google user data is used only to provide and improve the user-facing Mail and Calendar features you see in the Service:

• Reading, writing, and organizing your mail and calendar inside Nimbus Value, including search, drafts, sending, scheduling, and reminders.
• Sales context. Matching the people in your email threads and meetings to the customer and contact records you keep in Nimbus Value, and showing related customer information next to them.
• AI assistance. Sorting incoming threads, writing a one-line summary of each, summarizing threads on request, and drafting suggested replies and follow-ups. Suggested replies may use a small sample of your own recent sent messages so they match your writing style. See "AI processing of Google user data" below.
• Actions you approve. Nimbus Value does not send an email on your behalf unless you approve it or have turned on an automation that sends it. You can set a short window after approving in which to undo a send. Automations are off until you turn them on in your settings and can be turned off at any time; they are limited to replying to a meeting request with times you have made available (and placing the meeting on your calendar), sending a follow-up reminder, archiving newsletters, and replies from a response assistant you create and switch to automatic mode. Replies that involve pricing or money, or customers flagged as at risk, are always held for your review.
• Updating your Nimbus Value records when you choose to. From an email, you can add a contact, customer, goal, note, or task to your Nimbus Value account, or update an initiative. These become part of your Nimbus Value business data and follow the retention terms in Section 8.
• Team follow-up view. If you are a member of a team in Nimbus Value, the manager of that team can see your open email follow-ups (subject line, the other party's name and email address, the related customer, and status) and summary response-time statistics. Managers cannot see message content through this view.

Nimbus Value's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not:

• use Google user data for advertising, including personalized, retargeted, or interest-based advertising;
• sell Google user data, or use it for credit-worthiness or lending decisions;
• use Google user data to train, fine-tune, or improve generalized artificial-intelligence or machine-learning models, or allow our AI provider to do so; or
• transfer Google user data to others except as needed to provide or improve the features described above, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with your prior consent.

AI processing of Google user data

The AI features above are provided by Anthropic Claude models running on Amazon Bedrock, a service of Amazon Web Services (AWS). When an AI feature runs, the relevant parts of a thread (such as the subject, sender, and message text) and the related Nimbus Value customer information are sent to Amazon Bedrock in AWS regions in the United States to generate the result. Amazon Bedrock does not store these inputs or outputs to train models and does not share them with the model provider. AI-generated summaries and drafts are stored with your account as described below. If you choose to ask the Nimbus Value assistant about an email thread, the text of the thread that you send becomes part of that chat conversation.

Human access

Nimbus Value personnel do not read your Google user data, except (a) with your explicit permission, for example to investigate a support request you raise; (b) when necessary for security purposes, such as investigating abuse or a security incident; (c) to comply with applicable law; or (d) when the data has been aggregated and anonymized for internal operations. Access to production systems is limited to authorized personnel.

Google user data sharing

We do not sell, share, transfer, or disclose Google user data to third parties, except:

• to Amazon Web Services, which hosts the Service and provides the Amazon Bedrock AI processing described above, under written data-processing terms;
• to other members of your Nimbus Value organization only as described under "Team follow-up view" above, or when you choose to add information from an email to shared Nimbus Value records; and
• when required by law, regulation, or legal process.

When an email contains images hosted elsewhere, Nimbus Value may retrieve those images through its own servers so that your device does not contact the sender's image host directly.

Google user data retention and deletion

We keep only a working copy of your Google data, and most of it expires automatically:

• Cached mail (message metadata, content, and AI summaries): 30 days. Downloaded attachments: 7 days.
• Cached calendar events: until 60 days after the event ends.
• Contact names and email addresses, suggested actions and drafts, follow-ups, and your Mail and Calendar settings: kept while your Google account is connected.

You can disconnect your Google account at any time from the Connected Services page in Nimbus Value. Disconnecting immediately revokes Nimbus Value's access at Google and stops all syncing, and we delete the Google user data we hold for that account, including cached mail, calendar, and contacts and data derived from them, within 30 days. You can also remove Nimbus Value's access from your Google Account permissions page. Records you chose to add to your Nimbus Value account from an email (such as a contact or task) are part of your business data and are not deleted when you disconnect. To request deletion of your Google user data at any time, contact privacy@nimbusvalue.com; we will complete the deletion within 30 days.

Google user data security

Google user data is protected using the measures described in Section 7, including encryption in transit and at rest. The long-lived credential that lets Nimbus Value access your Google account (the OAuth refresh token) is encrypted with a dedicated AWS KMS key; short-lived access tokens are held only in memory and are never stored. Message bodies are additionally encrypted with a dedicated AWS KMS key.

2.4 Categories of Personal Information We Collect

For transparency and to satisfy California's notice-at-collection requirement, the following table describes the categories of personal information (using the categories defined under the California Consumer Privacy Act) that we may collect. Any category we collect may be disclosed to the service providers and processors described in Section 5 for the business purposes described in Section 3.

2.5 Meeting Recordings

The Service includes an optional meeting-recording feature. It records a meeting only if you invite the feature by providing a meeting link within the application; if you do not invite it, the Service does not record your meetings. When you invite it, the feature captures the meeting audio and video, including any content shared on screen, and we generate a transcript and AI-derived summaries and analyses from the recording.

Meeting recordings, transcripts, and related outputs are treated as Customer Data and are handled, retained, and deleted as described in Sections 5, 8, and 9. They are processed using our cloud infrastructure and trusted third-party services, and are never used to train AI models.

You are responsible for providing any notice to, and obtaining any consent from, all meeting participants that applicable law requires before you invite the recording feature to a meeting. Some states require the consent of all participants to record a conversation; you are responsible for meeting those requirements.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Create and manage your account
• Process your sales assessments and generate profile insights
• Power AI-driven features including suggestions, analyses, and recommendations
• Facilitate collaboration within your organization
• Respond to your requests and provide customer support
• Monitor and analyze usage trends to improve user experience
• Detect, prevent, and address technical issues, fraud, and security threats
• Comply with legal obligations and enforce our Terms of Service

We collect and use personal information only for the purposes described in this policy and do not use it for materially different purposes without providing notice and, where required, obtaining consent.

4. AI and Data Processing

Our Service uses artificial intelligence as a core part of the platform to provide features such as customer analysis, goal recommendations, initiative scoring, news aggregation, product analysis, and chat assistance. AI features are integrated throughout the Service and are part of the standard user experience. When AI-powered features are used:

• Your input data is processed by Anthropic Claude models running on Amazon Bedrock (Amazon Web Services) to generate responses; research features may also send search queries, such as a company name, to a web-search provider
• We do not use Customer Data or any identifiable information about you, your organization, or your customers to train, fine-tune, or improve any AI or machine-learning model
• AI-generated content is based on the data you provide and publicly available information
• Data sent to AI providers is limited to what is necessary for the specific feature being used

AI-generated content may contain errors and is provided for informational purposes only. As described in our Terms of Service, you are responsible for reviewing and validating AI-generated output before relying on it.

4.1 Service Improvement

With your affirmative opt-in consent, we may use aggregated, de-identified data — meaning data that has been stripped of any information that could identify you, your organization, or your customers — to analyze usage patterns and improve the quality and relevance of our features. Where you have not opted in, we do not perform such aggregate analysis on your Customer Data. This aggregated data cannot be used to identify any individual user or organization. We will never use your identifiable business data, customer information, or content to train, fine-tune, or improve any AI or machine-learning model. You may grant or withdraw your opt-in consent at any time through your account settings. Google user data (as described in Section 2.3) is never used for service improvement or model training in any form, regardless of opt-in status.

5. Data Sharing and Disclosure

We may share your information for the business purposes described in this policy, with the following categories of recipients:

• With other members of your organization as configured by your organization administrator
• With service providers and subcontractors who assist us in operating the Service (such as cloud hosting, AI processing, and payment processing), under written agreements that restrict their use of your information to providing services to us. A current list of subcontractors is available upon request at privacy@nimbusvalue.com
• When required by law, regulation, legal process, or enforceable governmental request
• To protect the rights, property, or safety of Nimbus Value, our users, or the public
• In connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case we will provide prior notice before your personal information becomes subject to a different privacy policy

We do not sell your personal information, and we do not share it for cross-context behavioral advertising (as those terms are defined under California and other state privacy laws). We have not sold or shared personal information in the preceding 12 months.

6. Data Location

The Service is offered to users located in the United States, and your information is stored in the United States (AWS US East, N. Virginia region) and processed in AWS regions in the United States. AI processing through Amazon Bedrock takes place in U.S. AWS regions, except that content you include in a request to generate a document may be processed in AWS regions outside the United States. Google user data processed by the Mail and Calendar features is processed only in U.S. AWS regions. If you access the Service from outside the United States, you do so on your own initiative and consent to the transfer to and processing of your information in the United States, where data protection laws may differ from those of your jurisdiction.

7. Data Security

We implement security measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Secure authentication via AWS Cognito
• Role-based access controls within organizations
• Encryption of sensitive credentials using AWS KMS (Key Management Service)
• Data stored in AWS infrastructure in the US East (N. Virginia) region

While we strive to protect your information, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

Security incident notification

In the event of a Security Incident affecting your personal information or Customer Data, we will notify you without undue delay and in any event within seventy-two (72) hours of confirming the Security Incident, and we will notify applicable regulators as required by applicable law. Our notice will describe the nature of the incident, the categories of information affected (to the extent known), the steps we have taken and are taking in response, and any recommended steps for you. "Security Incident" means a confirmed breach of Nimbus Value's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, your personal information or Customer Data. Unsuccessful attempts and routine security events that do not result in unauthorized access do not constitute a Security Incident.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or anonymize your personal information within 90 days, except for the specific categories of records identified below that we are required or permitted by law to retain for longer. The long-retention categories are limited to the specific records described — not your entire account — consistent with data-minimization principles. The following schedule applies:

Because we are required to keep the records above, a request to delete your information will be honored except as to those records; see Section 9. When the retention period ends, we delete or de-identify the information in the ordinary course.

9. Your Rights

9.1 Rights available to you

Depending on your state of residence and applicable law, you may have some or all of the following rights:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your personal information
• Export your data in a portable format
• Object to or restrict certain processing of your information
• Withdraw consent where processing is based on consent

Because the Service is a business-to-business product, several state privacy laws apply only to information about individuals acting in a personal or household context and may not cover business-contact data processed through the Service; California's law is broader and is addressed in Section 9.2. When you request deletion, we will honor it except for records we are required or permitted by law to retain — such as the subscription, billing, and consent records described in Section 8.

9.2 California residents (CCPA/CPRA)

To the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), applies to us, California residents have the following rights regarding the personal information described in Section 2.4:

• Right to know / access. You may request the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclose it.
• Right to delete. You may request deletion of your personal information, subject to the retention exceptions in Section 8 and other exceptions permitted by law.
• Right to correct. You may request correction of inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell your personal information and do not share it for cross-context behavioral advertising, so no opt-out is necessary and we are not required to provide a "Do Not Sell or Share My Personal Information" link.
• Right to limit use of sensitive personal information. We do not collect or use sensitive personal information for purposes that would trigger this right.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes, so California's "Shine the Light" law (Cal. Civ. Code § 1798.83) does not apply. Retention. We retain each category of personal information for the periods described in Section 8.

9.3 Other U.S. state privacy rights

Residents of other states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, and a growing number of others — may have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, the sale of personal data, and certain profiling that produces legal or similarly significant effects.

We do not sell personal data, engage in targeted advertising, or conduct profiling that produces legal or similarly significant effects, so those opt-out rights generally do not apply. Many of these laws also exclude data processed in a commercial or employment context, so they may not apply to the business-contact information processed through the Service. Where a law grants you these rights, you may exercise them as described in Section 9.4, including the right to appeal a decision.

9.4 How to exercise your rights

To exercise any of these rights, contact us at privacy@nimbusvalue.com. We will respond within the timeframe required by applicable law and may need to verify your identity before fulfilling a request; we will not fulfill a request we cannot reasonably verify. You may use an authorized agent to submit a request on your behalf, subject to verification of the agent's authority.

If we decline a request, we will explain why, and you may appeal by replying to our response with the subject line "Appeal"; we will respond to appeals as required by applicable law. We will not discriminate against you for exercising your privacy rights. If you use the Service through an organization account, some requests may need to be directed to and fulfilled through your organization administrator, who controls that account's data; in that case we act on that organization's behalf and will refer your request to them.

10. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising cookies. You can configure your browser to refuse cookies, but this may affect your ability to use the Service.

11. Children's Privacy

The Service is a business product that is not intended for, or directed to, individuals under the age of 16, and we do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice within the Service before the changes take effect, and we will update the effective date and version number above. Prior versions are archived and available upon request. Your continued use of the Service after the effective date of an updated policy constitutes acceptance of the changes; where required by law, we will obtain your consent.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Nimbus Value, LLC
Email: legal@nimbusvalue.com
Mailing address: 26572 Cadmus Ct., Centreville, VA 20120