Nimbus for Knack · Terms of Service · Privacy Policy

Nimbus for Knack - Privacy Policy

Version: nimbus-privacy-2026-11-04
Effective date: November 4, 2026
Provider: Avvera Technologies Inc. ("we", "us"). Contact: support@avvera.ca

1. The short version

• Nimbus reads and stores your Knack apps' structure only: the definitions of tables, fields, pages, views, roles, emails, tasks and settings. Its servers do not and cannot read the records in your apps; the only Knack endpoint they call returns structure, and you never give us a credential that can read records.
• Nimbus stores what you tell it about your apps (which fields are PHI, which roles should have access, review marks and answers) and the analysis it produces.
• Do not send us PHI. We are not a HIPAA business associate and do not sign BAAs. Keep PHI out of everything you type into Nimbus or tell an AI assistant using Nimbus.
• Stripe handles payments; we never see your card details.
• We do not sell your data, do not use it for advertising, and do not use it to train AI models.

2. What we collect

a. Account data. Your email address and your password (stored only as a hash by our sign-in system); sessions; and, if you connect an AI assistant, the connection (client name, granted permissions, and refresh tokens stored as hashes).

b. App registration data. The Knack App IDs you register, the app names Knack returns, verification tokens and times.

c. App structure. The structure of each verified app, fetched from Knack's public endpoint, and dated copies of it for change detection. Structure only, no records. Note that the structure can contain whatever text you or your builders put into it, such as field names, descriptions, email templates and rule values; we treat all of it as structure and you are responsible for keeping PHI out of it.

d. Your inputs and the analysis. PHI decisions, intended-access answers, ignored roles, review marks, confirmations and answers to Nimbus's questions, with who recorded them (you, or an AI assistant acting for you) and when; the analysis results (findings, reviews and their state).

e. Usage, security and audit data. Logs of sign-ins, account and billing events, app changes and MCP tool calls (which tool, which app, time, outcome, size), rate-limit counters, error reports and standard server logs (including IP address and browser).

g. Website analytics. We use PostHog to see how the site is used: which screens are opened, device and browser type, approximate location, and a random visitor ID kept in a cookie and browser storage. On public pages (home, sign-up, log-in, pricing) this also includes clicks and session recordings, with typed input masked. Inside your account we record only the name of the screen you open, never your apps' names, structure or analysis.

f. Billing data. Your subscription status, plan, extra-app count, renewal dates and Stripe customer and subscription identifiers. Card details are handled by Stripe only.

3. What we do not collect

The records in your Knack apps: your patients', clients' or users' data, form submissions and table rows. Our servers never request them.

4. How we use your data

To provide Nimbus (fetch structure, run the analysis, show and serve results through the website and the MCP), verify app ownership, bill your subscription, secure the service and prevent abuse, provide support, send service and account email (verification, password reset, billing, security and change notices), and comply with law. We do not sell your data, use it for advertising or use it to train AI models.

When you connect an AI assistant, Nimbus sends it the structure, analysis and answers your requests ask for. From there it is handled by the AI provider you chose, under that provider's terms. We are not a party to that and do not control it.

5. Legal basis (EU/UK users)

Where GDPR or UK GDPR applies: performance of a contract (providing the service you subscribe to), legitimate interests (security, abuse prevention, support, keeping records of what was recorded and by whom), and legal obligation (for example, keeping billing records).

6. Service providers

We use a small number of providers, each receiving only what its function needs: hosting and serverless compute (Vercel), database (Neon), payments (Stripe), email (Resend), rate limiting (Upstash), error reporting (Sentry) and website analytics (PostHog). Primary data residency is the United States. A current list is available on request.

7. Retention and deletion

• Structure copies: kept 30 days, then deleted automatically; the latest structure of each app is kept while the app is registered.
• Your inputs and analysis: kept while the app is registered; deleted when you remove the app or delete your account.
• Audit log and decision ledger: append-only records of what was done, when and by whom. They contain account and app identifiers, not record data, and are kept after an app or account is removed, so the history of decisions and billing events stays verifiable.
• Billing records: kept as required by tax and accounting law (commonly up to 7 years).
• Account deletion: you can delete your account from the Account page. It cancels a running subscription at once and deletes your account, sessions, apps and everything stored for them, except the records kept above.

8. Security

Connections are encrypted (HTTPS). Access is protected by sign-in, OAuth for AI assistants, hashed tokens, per-app ownership checks and rate limits. Passwords and tokens are stored only as hashes. No system is perfectly secure, and we cannot guarantee that your data will never be accessed, lost or disclosed. If a breach affects your personal data, we will notify you and authorities as the law requires.

9. Your rights

Depending on where you live, you may have rights to access, correct, export or delete your personal data, and to object to or restrict some processing. Contact us to use them. We do not sell or share your personal data (including within the meaning of the CCPA).

10. International transfers

Where we serve users in the EU/UK from US infrastructure, transfers rely on an appropriate safeguard such as the Standard Contractual Clauses.

11. Children

Nimbus is for users 18 and older. We do not knowingly collect personal data from anyone under 18.

12. Changes

We may update this policy; we will post the new version with an updated effective date and, for material changes, notify account holders by email.

13. Contact

Privacy questions: support@avvera.ca.