Privacy policy

The controller of the personal data described here is:

Your account. Your name and email address, the organization name, the members you invite and their roles, and a hash of your password. We never store the password itself.

What you configure. The providers, endpoints, buckets, apps, campaigns and schedules you set up, and the credentials for the provider accounts you connect. Credentials are encrypted at rest.

What the gateway does. A record of each request routed: when, which endpoint or alias, which provider answered, the response status, how long it took, how many tokens or bytes it involved, and which API key made it. This is what the usage charts and the audit trail are built from.

Payment. Handled by Paddle. We receive the subscription state, the plan and the country Paddle determined for tax. We never see or store your card details.

Technical. IP address, user agent and timestamps in server logs, kept for security and debugging.

• Card numbers. Those go to Paddle and never reach us.
• The content of what you route, beyond what delivering a request requires. We record that a request happened and how it went, not the prompt, the response or the object.
• Anything from third-party advertising or analytics trackers. The public site carries none.

• To perform the contract — your account, your configuration and the routing you asked for.
• Legitimate interests — keeping the service secure, debugging it, preventing abuse, and the usage records that show you what you are using.
• Legal obligation — tax and accounting records, principally held by Paddle as merchant of record.

We do not sell personal data and we do not share it for advertising. It reaches other parties only where the service cannot work otherwise:

• Paddle — payment, invoicing, tax and refunds, as merchant of record.
• The providers you configure — requests you ask us to route are sent to them, under their own privacy terms and on your account with them.
• Our hosting and database providers, who store the data on our behalf under contract.
• Anyone we are legally required to disclose to, where we are satisfied the request is valid.

The service runs on infrastructure outside Bangladesh, so your data is transferred and stored internationally. Where personal data of people in the UK or the EEA is transferred, we rely on the standard contractual clauses our hosting providers offer.

• Account and configuration data: while your account exists, then 30 days after it is closed so you can export it.
• Provider credentials: deleted immediately when you delete the provider or the account.
• Request records and audit trail: retained while the account exists, as the usage history the dashboard shows.
• Server logs: a short rolling window, kept for security and debugging.
• Invoices and tax records: as long as the law requires, held by Paddle.

You can ask for a copy of your personal data, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, or ask for it in a portable form. Much of this you can do yourself from the dashboard; for the rest, write to us.

If you think we have handled your data badly, tell us first — we would rather fix it. You also have the right to complain to the data protection authority where you live.

The dashboard sets one cookie, gw_session, which keeps you signed in. It is strictly necessary, httpOnly, and there is no way to use an account without it. Your theme choice is kept in your browser’s local storage, which never reaches us. There are no advertising or analytics cookies.

If this policy changes materially we will give notice to the address on your account and change the date at the top of this page.

Questions, or any request about your data, go to hello@nimions.com.