Who we are
Nimles is operated by Cloud Technologies ([legal entity name], org. no. [org. no.], Sweden), which is the data controller for the personal data described here. Write to [contact email] with any question about this notice.
What this notice covers
nimles.com, the documentation (docs.nimles.com), the Nimles portal (portal.nimles.com), sign-in (auth.nimles.com), the API (api.nimles.com) and the MCP server (mcp.nimles.com), during the developer beta. Products built on Nimles, such as Product Planner and Gårdsbutiker, have privacy notices of their own.
What we collect, and why
- Your account. When you sign up: your email address, your name and a hash of your password. We never store the password itself. Verification and sign-in emails go to the address you gave us. We keep this to give you access to your tenants.
- Your tenants. The tenants you create and what you put in them: users, content, products, orders and so on. You decide what goes there, and you are responsible for the personal data in it; we process it only to run the service for you. [A data processing agreement for tenant data is to be added.]
- API keys. The clients you create, a hash of each secret (the secret itself is shown once and never stored) and the roles you assign.
- Logs and telemetry. Requests to our services are logged with their time, the address they came from, the path and the result, in Azure Application Insights, to run the service, find faults and stop abuse. They are kept for 30 days.
Cookies
nimles.com and docs.nimles.com set no cookies. auth.nimles.com sets the cookies that keep you signed in and protect its forms against forgery; they expire when you close the browser, or after 30 days if you choose to stay signed in. portal.nimles.com keeps a session cookie while you use the portal, tied to that sign-in. These cookies are essential. We serve no advertising and use no third-party tracking or analytics cookies.
Where your data is, and who else processes it
Nimles runs on Microsoft Azure in the European Union, in the Sweden Central region. Emails are sent through Azure Communication Services, with Europe as the data location, and AI features use Azure OpenAI. Microsoft is our sub-processor for all of this.
When you use the portal, your browser also talks to Google: the portal loads its font from Google Fonts and its maps from Google Maps, so Google receives those requests with your IP address. If you choose to sign in with a Google or Microsoft account on auth.nimles.com, that provider processes the sign-in; the choice is yours, and a password works too.
The payment, logistics and accounting providers a tenant connects (such as Stripe, Klarna, Fortnox or DreamLogistics) are that tenant’s own processors, chosen and contracted by the tenant, not by us.
Your rights
Under the GDPR you may ask for access to, correction or deletion of your personal data, and you may complain to the Swedish Authority for Privacy Protection (IMY). Write to [contact email]. When you ask us to delete your account, we delete it together with [what is deleted with the account: the tenants you alone own?].
Changes
This notice will change as the beta does. The current version is always at nimles.com/privacy.