Privacy policy
What Nimbae processes, why it is needed, and how to manage your data.
Last updated
Who to contact
Nimbae is a Cublya product. For questions about personal data or to exercise your rights, email [email protected]. Include Nimbae in your request so it reaches the right product team.
Data we process
Account information includes your name, email address and password hash. If you sign in with Google, Google sends us your name, email address, whether Google has confirmed that address, and your profile picture address. Your workspace includes profiles, documents, cover letters, job preferences, saved answers, applications, activity history, assistant conversations and uploaded files.
When you create an account or accept changed terms, we record which versions of the terms and this policy you accepted, when, your IP address and your browser's user agent. While you are signed in, we record your cookie choice the same way.
We also process service records such as request times, errors, IP addresses where recorded by hosting services, and email delivery events. If you contact us, we receive your email address and the content you send.
Why we use it
We use account and workspace data to provide the features you request: signing in, saving and syncing work, generating documents, managing applications, and sending account or enabled alert emails. This processing is needed to provide the service under our agreement with you.
Support, security, and diagnostic processing help us answer requests, prevent abuse, and maintain the service. These are our legitimate interests, subject to your rights. We keep the record of what you accepted to show which terms apply to your account and which choices you made. Optional analytics rely on your consent.
Without the account or content required for a feature, we cannot provide that feature. You can decline optional analytics and continue using Nimbae.
AI and application tools
When you use AI features, relevant profile, document, job, saved-answer, and conversation content may be sent to OpenRouter and its model providers, or to Google, depending on the configured service and fallback route. AI output can be incomplete or inaccurate. Review generated claims and proposed changes before using them.
Providers have their own processing and retention terms, which can depend on the model and account configuration. Do not assume AI requests have zero retention or are excluded from provider training. Avoid including information you do not want an AI provider to process.
The browser extension reads supported application forms and uses your profile and answers to help fill them. Review the form before submitting. Employers and job boards process submitted applications under their own policies; Nimbae does not control their retention or hiring decisions.
Service providers and transfers
Sign-in runs in the web application and keeps accounts, sessions and acceptance records in our database. The web application, the API, the background services and the database run on our server at netcup in Germany, and Cloudflare carries traffic to them. Uploaded files are stored in Cloudflare R2 in the EU.
Resend sends service emails when enabled. OpenRouter, downstream model providers, and Google process AI requests. If you choose to sign in with Google, Google handles that sign-in. Company logos come from Google's favicon service: our server fetches them, so your browser does not contact Google for them. With your consent, PostHog's European service and Cloudflare Web Analytics receive analytics data.
The web application, the API and the background services write diagnostic logs on the server that runs them. These logs can contain request paths, error messages, and account and workspace IDs. The server sends these logs and its performance metrics to Grafana Labs (Grafana Cloud, hosted in Germany), together with traces of the requests to the API and of the background jobs. The traces record timings, the route pattern of a request rather than its full address, its status, request and job IDs, and the type and code of an error, never its message or the contents of your documents.
Providers may process data outside your country, including outside the European Economic Area. Contact us for information about the providers, processing locations, and transfer arrangements that apply to your data.
Optional analytics
With your consent, Nimbae sends limited product events and your account ID to PostHog to understand how features are used. These events exclude document text, job descriptions, filenames, employer and contact details, your name, and your email. Session replay and automatic interaction capture are off.
With your consent, Nimbae also loads Cloudflare Web Analytics to count visits and measure page speed. It stores nothing on your device, and Cloudflare receives your IP address with each request.
Account-linked analytics can be located using your account ID. Contact the privacy address to request access to or deletion of those records.
Retention, export, and deletion
Workspace records are kept to provide your account and features until you remove them or delete your account. Retention differs for support correspondence, delivery records, diagnostics, provider copies, and backups. Some records may need to remain for security, legal obligations, or resolving claims. Contact us for the retention periods applicable to your data.
Sign-in keeps each session with the IP address and browser it was started from, until you sign out, an expired session is next presented, or you delete your account. To slow down password guessing, it also counts recent attempts per IP address and action; those counters are deleted within two days of the last attempt.
Data settings lets you export a JSON file of profiles, documents, letters, applications, attempts, activity events, and preferences. It does not export every account record, such as assistant conversations or service logs.
Delete account, also in Data settings, deletes your account, your sign-in methods and sessions, the record of what you accepted, your workspaces and your uploaded files at once. Workspaces you own are deleted for everyone in them. Encrypted database backups, kept in Cloudflare R2 for about four to five weeks, still hold the account until they rotate out. For a full personal-data request or deletion across services, contact [email protected]. We may verify your identity before acting. Copies held by employers or in files you downloaded are outside Nimbae's control.
Your rights
Depending on the law that applies to you, you can request access, correction, deletion, restriction, or portability of your personal data, and object to processing based on legitimate interests. You can withdraw consent to optional analytics at any time.
You can also complain to your local data protection authority. We handle requests within the time limits required by applicable law and explain any exceptions or identity checks that apply.
Changes to this policy
We update this page when our practices change and show the revision date above. When it changes, Nimbae shows a notice with a link to it the next time you open the app. Where a change requires a new consent or additional notice, that requirement still applies.
See the terms of service and security information.