Nimlo builds the operating systems, workflows and brand architecture behind founder-led companies. To do that work we handle information about our clients, their teams and their audiences. This page explains what we collect, why, who we share it with, how long we keep it, and what you can ask of us.
Who we are
Nimlo Growth, Lda is the controller of the personal data described here.
Nimlo Growth, Lda
Praça Pescadores, 21, 2.º Esq.º
4450-222 Matosinhos, Portugal
NIF PT519252764
For anything about your data, write to info@nimlo.co. Karwan Nisstany and Liam van As answer these messages themselves.
What this policy covers
This policy covers our website nimlo.co, our operating system at os.nimlo.co, our investor portal at investor.nimlo.co, and the work we do for clients. When we work inside a client's own systems, the client remains responsible for that data and we act on their instructions as a processor.
What we collect
When you contact us
Your name, email address, phone number, company and the content of your message. You give us this when you write to us, book a call or fill in a form.
When you work with us as a client
Contact details of the people we work with, and the business information needed for the engagement: plans, documents, content, figures and the accounts we are given access to.
When you sign in to the Nimlo OS
Team members and invited clients sign in with Google. We receive your name, email address and profile picture. If you connect Google Calendar or Google Drive, we access them read only, to show your schedule and to list and read the files in the client folders you work in.
When a client connects an Instagram account
A client can connect an Instagram professional account to the Nimlo OS through Instagram's own login. With the client's permission we receive and store:
- The account's ID, username, profile picture and follower and post counts.
- An access token that lets us act for the account within the permissions granted.
- Insights on the account and its posts: views, reach, likes, comments, saves, shares, follows and watch time.
We use this only to publish posts that the client has approved, at the time the client chose, and to show the client how its account and posts perform. We do not read or send direct messages, we do not post anything that has not been approved, and we do not use this data for advertising or sell it to anyone.
When you use the investor portal
Investors in Nimlo receive an account with their name and email address. We keep the documents, updates and messages exchanged through the portal.
Technical data
Our servers log basic technical information such as IP address, browser and time of access, to keep the services secure and working.
Why we use it, and on what basis
- To deliver the work agreed with our clients. The basis is the contract with the client.
- To answer your questions and keep in touch about our work. The basis is our legitimate interest in running and growing our business.
- To publish approved content and report results for connected Instagram accounts. The basis is the contract with the client and the permission given through Instagram's login.
- To keep our services secure and to prevent misuse. The basis is our legitimate interest.
- To keep accounts, invoices and records as the law requires. The basis is our legal obligations.
- Where we ask for your consent, for example for optional cookies or newsletters, the basis is that consent. You can withdraw it at any time.
Transfers outside the European Union
Some of these services process data outside the European Economic Area, mainly in the United States. Where they do, the transfer is covered by the EU Standard Contractual Clauses or by the EU-US Data Privacy Framework.
How long we keep it
- Client and project data: for the length of the engagement and up to two years after it ends, unless the client asks us to delete it sooner.
- Instagram access tokens: until the client disconnects the account or the engagement ends. Insights and follower history are deleted with the connection.
- Messages and enquiries that did not lead to work: up to two years.
- Invoices and accounting records: as long as Portuguese law requires, currently ten years.
- Server logs: up to 90 days.
Removing an Instagram connection and its data
You can remove Nimlo's access to an Instagram account at any time:
- In Instagram, go to Settings, then Website permissions, then Apps and websites, and remove Nimlo. Instagram tells us, and we delete the access token, the stored insights and the follower history for that account.
- Or email info@nimlo.co from the account owner's address, naming the Instagram account. We delete the data within 30 days and confirm in writing.
Posts that were published to Instagram stay on Instagram. You manage those in Instagram itself.
Your rights
Under the GDPR you can ask us to:
- Give you a copy of the personal data we hold about you.
- Correct data that is wrong or incomplete.
- Delete your data, where we no longer need to keep it.
- Limit how we use your data, or object to a use based on our legitimate interest.
- Send your data to you or to another company in a common format.
- Withdraw a consent you gave.
Write to info@nimlo.co. We answer within one month. If you are not satisfied with our answer, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados, at cnpd.pt, or to the authority in the country where you live.
Security
Access to our systems is limited to the people who need it and protected by sign-in. Connections are encrypted, access tokens and credentials are kept apart from the rest of our data, and links we create to hand files to Instagram are signed and expire within two hours.
Children
Our services are meant for businesses and are not directed at children under 16. We do not knowingly collect their data.
Changes to this policy
When we change how we handle personal data, we update this page and the date at the top. If a change matters to our clients or investors, we tell them directly.