Essentials Privacy Policy

01 Introduction

This Privacy Policy explains how NimbusNow LLC ("NimbusNow," "we," or "us") collects, uses, and shares information in connection with NimbusNow Essentials (the "Service") and our sign-up at nimbusnow.com. It applies to the company that subscribes to the Service and to the individual users your organization authorizes.

This Policy works alongside our Terms & Conditions. Capitalized terms not defined here have the meaning given in the Terms.

02 Information we collect

• Account and contact information you provide at sign-up, including your company display name, headquarters address, the name and work email of the person setting up the account, and the people records you add for your users.
• Billing information, which is collected and processed by our payment processor (Stripe). We do not store full payment card numbers.
• Customer Content, meaning the data you and your authorized users enter into or generate within the Service, such as incidents, work orders, knowledge articles, support groups, and related records.
• Usage and technical data, such as log data, IP address, device and browser information, and similar information generated when you use the Service or our website.

03 How we use information

We use information to provide, operate, and maintain the Service; to set up and administer your account; to process billing and payments; to provide L1 support; to secure and protect the Service; to comply with our legal obligations; and to communicate with you about your account, billing, and service matters.

04 The BMC platform and subprocessors

The Service is hosted on the BMC Helix platform provided by BMC Software, Inc. ("BMC"). BMC processes Customer Content on our behalf as a subprocessor in order to host and operate the platform. In connection with the platform, the following additional subprocessors may process data:

• BMC Software, Inc. (hosting)
• Oracle America, Inc. (foundational platform component)
• Aiven Oy (managed database services)
• Cloudflare, Inc. (SaaS security services)

Your use of the platform is also subject to BMC's applicable terms and security practices. We may update our list of subprocessors as our providers change.

05 Payment processing

Payments are processed by Stripe. When you provide payment details at sign-up, that information is handled by Stripe under its own terms and privacy policy. We receive only the limited billing information needed to manage your subscription, not your full card details.

06 Data retention

We retain account and billing information for as long as your subscription is active and as needed to meet our legal, tax, and recordkeeping obligations. Customer Content stored in the platform is retained, archived, and deleted in accordance with BMC's terms, under which Customer Content is generally archived after two (2) years and deleted after seven (7) years, with backups kept on a rolling 14-day window. You are responsible for exporting any data you wish to keep before the end of your term.

07 How we share information

We share information with:

• Service providers and subprocessors (including BMC and the parties listed in Section 4, and Stripe) who process it on our behalf to deliver the Service;
• Authorities or other parties where required by law, regulation, legal process, or to protect our rights, safety, or property; and
• A successor entity in connection with a merger, acquisition, financing, or sale of assets.

We do not sell your personal information.

08 Security

We use commercially reasonable organizational and technical measures to protect information. The BMC platform maintains its own security program, including third-party audits such as ISO 27001 and SOC 1 / SOC 2. No system is completely secure, and you are responsible for safeguarding your account credentials and controlling who you authorize to access the Service.

09 International data transfers

The Service is hosted in the data center location associated with your BMC subscription. Some subprocessors may process limited data in other locations (for example, Aiven is based in Finland). Where applicable data protection laws require, we and our subprocessors rely on appropriate safeguards for such transfers.

10 Your privacy rights

Depending on your location, you may have rights to access, correct, delete, or restrict the processing of your personal information, or to object to certain processing, under laws such as the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). To exercise these rights, contact us at essentials@nimbusnow.com.

Where we process Customer Content on your organization's behalf, we will direct requests from individual users to your organization. We will respond to requests consistent with applicable law and our obligations to BMC.

11 Cookies and analytics

Our website may use cookies and similar technologies to operate the site, remember your preferences, and measure usage. You can control cookies through your browser settings; disabling some cookies may affect how the site works.

12 Children's privacy

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

13 Changes to this policy

We may update this Policy from time to time. We will post the updated Policy with a revised "last updated" date and, where appropriate, provide notice. Your continued use of the Service after the effective date means you accept the updated Policy.

14 Contact

Questions about this Privacy Policy or our data practices? Contact essentials@nimbusnow.com.