Privacy Policy

Nemu is the data controller for the account and usage data you provide to operate the service. We process personal data lawfully, fairly, and only for the purposes described here. Where you route requests to third-party model providers using your own keys, those providers process your content under their own policies.

• -Account data: name, email, organization, and billing details.
• -Usage metadata: request counts, tokens, latency, model and provider used, and error rates, recorded off-path.
• -Configuration: workspaces, routing rules, quotas, and prompts you save.
• -Support data: messages you send us.

Provider API keys you add (BYOK) are encrypted at rest in a dedicated key vault and used only to authenticate the requests you make. We do not sell your keys or prompt content, and we do not use your prompts to train models.

Request and response bodies are processed in memory to deliver the service and are not retained by default beyond what is needed for delivery and abuse prevention. You control any optional logging in the Platform.

We use data to provide, secure, and improve the service: routing and failover, enforcing quotas and credits, billing, analytics, and support. We process usage metadata to operate dashboards and detect abuse. We do not use your prompts, completions, or documents to train Nemu models or any third-party model.

We share data with infrastructure subprocessors (hosting, vector search, payments) under contract, and with the model and search providers you choose to route to. We do not sell personal data. A current list of subprocessors is available on request and in our DPA.

We retain account and billing records for as long as your account is active and as required for legal and accounting purposes. Usage metadata is kept for a limited analytics window. You can delete saved configuration and request account deletion at any time.

We apply encryption in transit (TLS, with mTLS available) and at rest, scoped access controls, audit logging, and a least-privilege key vault. No system is perfectly secure, but we work to protect your data and to notify you of incidents as required by law.

This marketing site sets no advertising or cross-site tracking cookies. The console and the chat set a small number of cookies that the product cannot work without, and we ask before anything else is set.

• -Strictly necessary: your session, your active workspace, and a token that protects forms against forgery. These cannot be switched off.
• -Preferences: theme, sidebar state and the last model you used, kept in local storage on your own device.
• -Analytics: aggregate page and feature counts, only after you accept them, and never joined to the content of a thread.

You can change or withdraw that choice at any time from Cookie settings in the site footer, or by clearing site data in your browser.

Where you use Nemu to process personal data belonging to your own customers, you are the controller and Nemu is the processor. Our Data Processing Agreement sets out the instructions we act on, the security measures we keep, the sub-processors we use, and how we handle a request from one of your users.

The DPA applies automatically to paid accounts. Write to legal@nemu.cc for a countersigned copy, the current sub-processor list, or details of international transfer safeguards.

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Contact us to exercise these rights; we respond within the timeframes required by applicable law.

We use essential cookies for authentication and session management, and limited analytics cookies to understand product usage. You can control non-essential cookies through your browser or our cookie settings.

Questions? Contact privacy@nemu.cc.