Privacy Policy

1. Who We Are

NimTrace, Inc. ("NimTrace", "we", "us", or "our") operates the NimTrace cloud operations platform available at nimtrace.com. We are the data controller for personal data processed under this policy.

For questions about this policy, contact us.

2. Data We Collect

Account data

When you create an account, we collect your email address and any company name you provide. This data is stored securely in our own cloud infrastructure.

Cloud account metadata

When you connect a cloud account, we store:

• AWS: Account ID, IAM role ARN, and an ExternalId (a UUID we generate for your tenant)
• GCP: Project ID, alias, and a reference to where the service account JSON is stored in our encrypted secrets vault
• Azure: Subscription ID, alias, and a reference to where the service principal credentials are stored in our encrypted secrets vault

We don't take snapshots of your logs, metrics, or resources, or keep a separate copy of your cloud data. We query it in real time; any of it that appears in a NimTrace answer becomes part of that conversation, covered by the retention rules in the Conversation history section below.

Credentials

GCP service account JSON keys and Azure service principal credentials are stored encrypted in our secrets vault. They are never logged, never returned to the browser, and only accessed by NimTrace's backend at query time.

Conversation history

Chat messages and AI responses are stored in our database so you can access your conversation history. We do not use your conversation content to train AI models.

Usage data

We record a count of chat turns per month per tenant for billing and plan enforcement. We also collect standard web server logs (IP addresses, request paths, timestamps) for security monitoring.

Payment data

Payment information is processed by Stripe. We store only your Stripe customer ID and subscription ID, not your card details.

3. How We Use Your Data

• To provide the NimTrace service: authenticate you, load your cloud accounts, run queries
• To enforce subscription plan limits
• To send you transactional emails (invite to team, password reset, billing receipts)
• To improve the service through anonymised usage analytics
• To detect and prevent abuse and security threats

We do not sell your personal data. We do not use your data for advertising.

4. Data Sharing

We share data with the following sub-processors:

• Cloud infrastructure provider: hosting, data storage, and secure credential storage
• AI model provider: AI model inference (your queries are sent to a third-party AI provider for processing; their privacy policy applies)
• Stripe: payment processing

We do not share your data with any other third parties except as required by law.

5. Data Retention

• Account data: Retained until you delete your account
• Cloud account metadata: Deleted when you remove the account from Settings
• Credentials: Deleted immediately when you remove the cloud connection
• Conversation history: Retained until you delete the thread, or until account deletion
• Usage counters: Retained for 2 months for billing reconciliation, then deleted automatically
• Web logs: Retained for 90 days

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you
• Rectification: correct inaccurate data
• Erasure: request deletion of your data
• Portability: receive your data in a machine-readable format
• Objection: object to processing for certain purposes

To exercise any of these rights, contact us. We will respond within 30 days.

7. Security

We apply the following security measures:

• All data in transit is encrypted using TLS 1.2+
• All data at rest is encrypted using managed encryption keys
• Access to production systems is restricted to authorised personnel
• Cloud queries use short-lived STS tokens (1-hour TTL); no long-lived credentials are used

For a detailed security overview, see our Security page.

8. Cookies

The NimTrace web application uses only functional cookies necessary for authentication (session tokens). We do not use advertising or tracking cookies. The marketing website (nimtrace.com) uses no cookies — it uses Plausible Analytics, a privacy-friendly analytics service that does not use cookies or collect personal data, to understand aggregate traffic to this site.

9. Children

NimTrace is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have received data from a child, contact us.

10. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify you via email. Continued use of NimTrace after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy questions or requests: contact us
NimTrace, Inc.