Privacy Policy

Nimbus is a desktop software product developed and sold by FoogleGiber LLC, a United States limited liability company. We operate the website getnimbus.net and the Nimbus desktop application (collectively, the “Service”).

FoogleGiber LLC is the data controller for personal data processed through the Service. If you have questions about this policy, contact us at privacy@getnimbus.net.

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data under the following lawful bases:

• Contractual necessity (Art. 6(1)(b)): processing required to deliver the Nimbus software license you purchased, validate your license, and provide customer support.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, abuse detection, service improvement analytics, and direct marketing about product updates to existing customers. You may object to direct marketing at any time.
• Consent (Art. 6(1)(a)): where we rely on consent (e.g., optional newsletter sign-up), you may withdraw it at any time without affecting the lawfulness of prior processing.
• Legal obligation (Art. 6(1)(c)): tax records, accounting, and responding to valid law-enforcement requests.

Retention periods may be extended to comply with legal obligations, resolve disputes, or enforce our Terms of Service. When the retention period expires, data is irreversibly deleted or anonymized within 30 days.

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) — request deletion of your data, subject to legal retention obligations.
• Restriction — limit how we process your data while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Automated decision-making — we do not subject you to decisions based solely on automated processing that produce legal effects.

To exercise any of these rights, email privacy@getnimbus.net. We will respond within 30 calendar days. We may require proof of identity before fulfilling certain requests. There is no fee unless the request is manifestly unfounded or excessive.

If you believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local supervisory authority. For EEA residents, a list of authorities is maintained at edpb.europa.eu.

FoogleGiber LLC is based in the United States. Personal data is processed and stored in the US and, where infrastructure providers offer it, the EU (Frankfurt, Ireland). For transfers from the EEA, UK, or Switzerland to the US, we rely on:

• Standard Contractual Clauses (SCCs) incorporated into our data processing agreements with each sub-processor.
• The EU-US Data Privacy Framework where the sub-processor is certified (Stripe, Vercel).

A copy of the relevant SCCs can be requested at privacy@getnimbus.net.

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption in transit (TLS 1.3) for all Service endpoints.
• Encryption at rest (AES-256) for all persistent data stores.
• Hardware security modules (HSMs) for Ed25519 license-signing keys.
• Mandatory multi-factor authentication for all production-access personnel.
• Annual third-party penetration testing of the licensing API.
• Immutable audit logging for all administrative data-access events.

No method of electronic storage or transmission is 100% secure. In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Art. 33–34.

Nimbus is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, contact us immediately. We will delete the data within 72 hours of verification.

We may update this Privacy Policy from time to time. Material changes will be communicated via:

• Email to the address associated with your Nimbus account.
• A prominent notice on the Nimbus dashboard.
• An update to the “Last updated” date at the top of this page.

Continued use of the Service after changes become effective constitutes acceptance of the revised policy. If you disagree with the changes, you may close your account and request data deletion as described in Section 7.

For all privacy-related inquiries: