Privacy Policy

Information We Collect

We collect information that you provide directly to us when you:

• Create an account and use our platform
• Connect your social media accounts
• Contact our customer support
• Subscribe to our newsletters or marketing communications
• Respond to surveys or participate in promotions

This information may include:

• Personal identifiers (name, email address, phone number)
• Account credentials
• Billing information — payments are handled by our payment processors (Stripe for website purchases, Apple for App Store purchases, and Google for Google Play purchases); we receive transaction records but never your full card number
• Social media account access tokens
• Content you create, upload, or store on our platform

Information We Collect Automatically

When you use our Services, we may automatically collect certain technical information:

• Device and app information, such as device model, operating system version, app version, and language settings
• Usage information, such as the features you use and the screens you view, collected through Google Analytics for Firebase
• Diagnostic information, such as error reports and performance data, used to keep the Services reliable
• Log information, such as IP address, browser type, and access times, when you use our website or API

In our mobile apps, analytics and advertising measurement are switched off by default and only begin if you agree to them in the app. If you agree, this includes an advertising identifier and a limited set of events shared with our advertising partners, described in Advertising and Measurement below. You can change your answer at any time in the app under Settings, and we stop immediately.

Mobile Applications

This Privacy Policy also applies to the Nimply mobile apps for iOS and Android. In addition to the information described above, the mobile apps involve the following:

• Push notifications. If you enable notifications, we store a device push token (via Firebase Cloud Messaging) to deliver them. You can turn notifications off at any time in your device settings.
• Photos and media. The app only accesses photos and videos you explicitly choose — through the media picker or by sharing content into the app. We never scan your photo library in the background. Selected media is uploaded to your Nimply media library so you can use it in posts.
• Sign in with Apple and Google. If you sign in with Apple or Google, we receive your name and email address from that provider to create and identify your account.
• Advertising identifier. If you agree to analytics and advertising in the app, we use your device advertising identifier so our advertising partners can tell which app installs came from our ads. On iOS we ask through the system App Tracking Transparency prompt first. See Advertising and Measurement.

Cookies and Similar Technologies

On our website we use cookies and similar technologies for three things:

• Essential. Signing you in, keeping your session secure, and remembering your preferences. These are always on, because the site cannot work without them.
• Analytics. Understanding which pages people visit and where they get stuck, so we can improve them.
• Advertising. Measuring which of our ads bring people to Nimply, and showing our ads to people who have already visited us.

Analytics and advertising cookies are loaded through Google Tag Manager, and we use Google Consent Mode to control them. In the European Economic Area, the United Kingdom, and Switzerland they stay switched off until you accept them. Everywhere else they are on unless you decline. Either way, the banner shown on your first visit lets you choose, and you can change your choice at any time from the same banner.

Our mobile apps do not use cookies. They use the advertising identifier described below instead.

Advertising and Measurement

We advertise Nimply on other platforms. To know which ads are worth paying for, we need to see what happens after somebody clicks one. This section explains exactly what that involves, because it is the part of this policy most likely to matter to you.

On our website. When you accept advertising and analytics cookies, we share events such as signing up, starting checkout, and completing a purchase with Google, through Google Analytics and Google Ads, and with TikTok, through the TikTok pixel. This tells us which campaign, and which ad, led to a sign-up.

In the mobile apps. If you agree to analytics and advertising in the app, we share a limited set of events with our advertising partners: that you installed the app, opened it, created an account, created your first post, started a trial, or bought a subscription or credit pack, along with the amount and currency of a purchase. Those events go to:

• Google, through Google Analytics for Firebase, which is connected to Google Ads.
• TikTok, through the TikTok Business SDK, so that TikTok can tell which app installs came from a TikTok ad and help us show those ads to people more likely to find Nimply useful.

Advertising identifiers. To connect an ad click to an install, our advertising partners need a device identifier. On Android this is the Google Advertising ID, which you can reset or delete at any time in your device settings under Google and then Ads. On iOS this is the Identifier for Advertisers, and Apple requires us to ask you first: the app shows the system App Tracking Transparency prompt, and we only use the identifier if you allow it. If you say no, we do not use it, and iOS measurement falls back to Apple SKAdNetwork, which reports results to advertising networks in aggregate without identifying you. You can change your answer at any time in iOS Settings, under Privacy and Security, then Tracking.

Matching. So that a purchase can be matched to the right ad, we also send our advertising partners a scrambled (hashed) form of your email address and your Nimply account identifier. The scrambling happens on your device before anything is sent, it is one-way, and the original values cannot be recovered from it.

What we never share. Your posts, drafts, replies, messages, media, analytics about your own audience, and the contents of the social accounts you connect are never shared with advertising partners, and never used to target ads. Advertising partners receive the events and identifiers described above and nothing else.

Turning it off. In the app, open Settings and turn off Usage analytics. That single switch stops analytics and advertising measurement together, on both platforms, and takes effect immediately. On the website, decline analytics and advertising in the cookie banner. Declining never limits any Nimply feature.

Browser Extension (Nimply Sidekick)

Nimply Sidekick is our browser extension. It reads the post, comment, image, or article you are looking at — only when you click it — and lets you save it to your workspace or draft from it. It does not read pages in the background, does not track your browsing, and does not access cookies. It never posts, likes, follows, or messages on your behalf.

Because browser stores require a policy specific to the extension, the full detail — what it collects, when, where it goes, how long it is kept, the Chrome Web Store Limited Use statement, and how someone whose public post was saved can request removal — lives on a dedicated page: Nimply Sidekick Browser Extension Privacy Policy. This Privacy Policy applies to the extension wherever that page does not say otherwise.

People (records about your audience)

Nimply’s People feature keeps one record for each person who contacts one of our customers through a connected social account — someone who comments on a post, sends a message, or joins a group. In this section, “customer” means the business using Nimply, and “person” means the member of their audience. For these records the customer is the data controller and Nimply is the processor acting on their instructions, as set out in our Data Processing Agreement.

What a record contains. The platform account identifier, display name, username, profile link and avatar the platform gives us; the messages, comments and mentions exchanged with that customer; and whatever the customer adds themselves — tags, notes, a lead with contact details the person supplied, a request such as a booking, and a record of consent.

• Only from interactions. Records are created from conversations that already happened. Nimply does not import follower lists or audiences, does not buy, scrape or enrich data, and does not add details the person never gave.
• No profiling. We infer no demographics, no sensitive characteristics and no interests. Automatic labels reflect counts of a person’s own interactions with that customer and nothing else.
• No automatic linking across platforms. Two accounts on different platforms are only treated as the same person when the customer confirms it.
• LinkedIn and Pinterest are excluded. Their developer terms do not permit storing people this way, so those identities are refused when they arrive and no record is created.
• No marketing sends. People contains no broadcast or bulk-messaging feature and is not an email or SMS list.

How long records are kept. Each customer sets a retention window between six and thirty-six months, defaulting to twenty-four. Where a platform’s own terms require a shorter period, that shorter period applies: YouTube and TikTok identities are held for thirty days unless the person interacts again. A nightly process anonymises identities past their window and deletes records that nothing else keeps alive.

Deletion. Deleting a person removes the record, their platform identities, notes, tags, timeline, consent records and leads; deletes the memories our AI agents formed about them; redacts the contents of agent runs that quoted their messages; and asks HubSpot to delete the contact where the customer synced one. Deletion signals from a platform — a Meta data-deletion callback, a TikTok revocation, an X account that no longer exists — trigger the same removal without anyone asking.

If you are the person, not the customer. Ask the business you were talking to: they control the record and can delete it from their side. If you cannot reach them, or you do not know which business holds it, write to privacy@nimply.io with the platform and the account you used and we will pass the request on and, where we are permitted to act, action it ourselves.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send administrative messages and updates
• Respond to your comments, questions, and requests
• Provide customer service and technical support
• Send marketing communications (with your consent)
• Monitor and analyze usage patterns and trends
• Detect, prevent, and address technical issues
• Protect the security and integrity of our platform

Data Sharing and Disclosure

We do not sell your personal information. We share it in the following situations, and no others:

• Social platforms you connect. When you connect an account and publish through Nimply, your content and instructions go to that platform, using the access you granted.
• Service providers who run the platform. Supabase for accounts and sign-in, Amazon Web Services for our servers and databases, and Cloudflare for hosting and media delivery.
• Payment processors. Stripe for website purchases, Apple for App Store purchases, and Google for Google Play purchases.
• Analytics and advertising partners. Google, for Google Analytics, Google Analytics for Firebase, Google Tag Manager, and Google Ads. TikTok, for conversion measurement on our website and for app install measurement in the mobile apps. Only where you have agreed, and only the events and identifiers listed in Advertising and Measurement.
• Messaging providers. Firebase Cloud Messaging and the Apple Push Notification service to deliver push notifications, and our email provider to send account and support email.
• AI providers. OpenAI, Google, and Anthropic process the prompts and content you submit to our AI features, through our backend, to produce the output you asked for. They are not permitted to use it to train their models.
• Legal authorities. Where we are required by law, or where we need to establish or defend legal claims.
• A buyer or successor. If Nimply is involved in a merger, acquisition, or sale of assets, subject to this Privacy Policy continuing to apply.

Connecting a Facebook Page on Android uses the Facebook SDK. It is there only so you can sign in to Facebook and choose a Page, and its advertising and app-event features are switched off in our build.

Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information, including:

• Access to your personal information
• Correction of inaccurate or incomplete information
• Deletion of your personal information
• Restriction or objection to processing
• Data portability
• Withdrawal of consent

To exercise these rights, please contact us at hello@nimply.io.

For analytics and advertising specifically, you do not need to contact us. You can decide for yourself at any time:

• In the mobile apps. Open Settings and turn Usage analytics off. This stops analytics and advertising measurement on both iOS and Android at once, and takes effect immediately.
• On iOS. Open iOS Settings, then Privacy and Security, then Tracking, to allow or refuse our use of the advertising identifier. Refusing does not limit any feature.
• On Android. Open your device settings, then Google, then Ads, to reset or delete your advertising identifier.
• On our website. Use the cookie banner to accept or decline analytics and advertising cookies, and to change your mind later.

Account Deletion

You can delete your Nimply account at any time:

• In the mobile app: open Settings and choose "Delete account".
• By email: send a deletion request to hello@nimply.io from the email address on your account.

Deleting your account permanently removes your account, the workspaces you own, and their contents — including posts, connected channel access tokens, agents, and media. This cannot be undone. We may retain limited records where required by law (for example, billing and tax records).

Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Services. When you delete your account, we delete or anonymize your personal information, except where we need to retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, accidental loss, alteration, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure, so we cannot guarantee absolute security.

International Data Transfers

Your information may be transferred to, and processed in, countries other than the country in which you reside. These countries may have data protection laws that are different from the laws of your country. We take steps to ensure that your information receives an adequate level of protection in the countries in which we process it.

Children's Privacy

Our services are not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy, please contact us at: