NimbusNexus privacy & data

Account information including your name, email address, billing address, and (where you are an enterprise contact) company name and role.

Payment information processed by our payment provider — we receive a token and the last four digits, but we do not store full payment card numbers.

Technical data including IP address, browser type, operating system, device identifiers, and pages or API endpoints accessed.

Usage data including the resources you deploy, metering data used for billing, and aggregated performance data.

Communications you send us, including support tickets, abuse reports, and feedback.

Identity verification information where required for sanctioned-jurisdiction screening or higher-tier accounts.

To create and manage your account, provision compute and storage resources, meter usage, and provide support.

To process payments and manage disputes.

To detect, prevent, and respond to fraudulent activity, payment fraud, account takeover, and abuse of the Service.

To detect, investigate, and respond to security incidents.

To understand how the Service is used in aggregate so we can improve it.

To comply with applicable law, respond to lawful requests from public authorities, and enforce our agreements.

For the duration of your account plus the post-termination retention windows in the Terms of Service (60 days for export, then deletion within 30 days from active systems and 90 days from backups).

For at least seven (7) years after the relevant transaction, as required by US tax law and applicable local equivalents.

For up to 24 months, then deleted or anonymized.

For up to three (3) years after the ticket is resolved.

Fortlab is established in the United States. When you use the Service, your personal information may be transferred to, stored in, and processed in the United States and in any country where we or our sub-processors operate.

Adequacy decisions where the destination country has been recognized as providing adequate protection by the European Commission, the UK Information Commissioner's Office, or Swiss authorities.

Standard Contractual Clauses (the European Commission's 2021 SCCs) for transfers to countries without an adequacy decision.

The EU-US Data Privacy Framework, UK Extension, and Swiss-US Data Privacy Framework where the recipient is self-certified.

Our current sub-processors list is published at /sub-processors and updated when we add or change a sub-processor.

the Data Processing Addendum at /dpa.

Ask us to delete your personal information, subject to legal exceptions (e.g. tax records we are required to keep).

Access. Request a copy of the personal information we hold about you.

Correction. Ask us to correct inaccurate or incomplete information.

Deletion. Ask us to delete your personal information, subject to legal exceptions (e.g. tax records we are required to keep).

Portability. Receive your personal information in a structured, commonly used, machine-readable format.

Withdraw consent. Where processing is based on consent, withdraw it at any time.

Object to processing based on legitimate interests, including profiling and direct marketing.

Restriction. Ask us to restrict processing in certain circumstances.

We do not sell personal information. We do not sell or rent personal information to third parties for their own marketing purposes, and we have not done so in the prior 12 months.