Privacy Policy

This policy explains what personal data Nemu collects when you use nemu.cc, the gateway, the chat, the computer, the reader and the console, why we use it, who we share it with and what control you have over it. Nemu is the data controller for the account, content and usage data described here.

Two other kinds of party process your data under their own policies: Dodo Payments, which sells you our plans as Merchant of Record, and the model, search and integration providers you choose to connect or route requests to.

Account data

Email address, username, name, company name and how you signed in.

Security data

IP address, browser and device identifiers, session records and sign-in events, used to keep your account safe and to stop abuse.

Billing data

Your plan, subscription status, renewal dates, amounts paid, invoice links and the customer and payment identifiers Dodo Payments gives us. We never receive or store your full card number.

Content you store

Chat threads, uploaded files, generated images, saved memories, computer projects, prompts, workflows and website indexes.

Credentials you add

Provider API keys, connector credentials and integration tokens.

Usage metadata

Request counts, tokens, latency, the model and provider used, credit spend and error rates.

Support data

The messages you send us.

Provider keys and connector credentials are encrypted at rest in a dedicated key vault. A stored key is decrypted only in memory for the request that needs it, and the console only ever shows its last characters.

Requests that pass through the gateway are processed in memory and their bodies are not kept after delivery. Content you create in the chat and the computer, such as threads, files, images, memories and projects, is stored so you can come back to it, until you delete it or delete your account.

We do not sell your keys or content, and we do not use your prompts, completions, files or documents to train Nemu models or any third-party model.

• To provide the service you signed up for: routing, storage, credits, quotas, billing and support. The legal basis is our contract with you.
• To secure the service: detecting fraud, abuse, attacks and credential misuse, and enforcing rate limits and bans. The legal basis is our legitimate interest in a safe service.
• To keep records required by law, such as accounting and tax records. The legal basis is legal obligation.
• To understand how the product is used through aggregate analytics, only after you accept analytics cookies. The legal basis is your consent.
• To send service emails such as verification, security alerts, invoices and changes to these policies. We do not send marketing email without your consent.

Dodo Payments is our Merchant of Record and authorized reseller. When you buy a plan, Dodo Payments collects your name, email address, billing address and payment details, processes the payment, calculates tax and keeps the transaction records the law requires. It acts as an independent controller for that data under its own privacy policy.

Dodo Payments shares with us only what we need to run your subscription: who paid, for which plan, the amount, the currency, the status and the invoice. Card details stay with Dodo Payments and its payment processors.

We share personal data only with parties that help us run the service, under contract and only for that purpose:

• Hosting and edge delivery: Vercel and Cloudflare, including Cloudflare object storage for files and images.
• Servers we operate for the database, the vector search index, caching and the computer.
• Payments: Dodo Payments.
• Transactional email: Resend.
• Model, search and integration providers that you connect or route a request to, which receive the content of that request.

We do not sell personal data. We may disclose data when the law requires it or to protect the rights and safety of our users and the service. A current sub-processor list and details of international transfer safeguards are available from [email protected].

We keep account data, usage metadata and saved configuration for as long as your account is active. Chat threads, files and other content stay until you delete them or delete your account. Security logs are kept for as long as they are needed to investigate abuse.

You can delete all your chats or your whole account from the account settings. Deleting your account removes the account and the data we hold against it, including chats, saved configuration and our copy of your billing records. Dodo Payments keeps its own transaction records for as long as tax and accounting law requires.

We use encryption in transit and at rest, scoped access controls, audit logging and a least-privilege key vault. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach as the law requires. Security reports go to [email protected].

This marketing site sets no advertising or cross-site tracking cookies. The console and the chat set a small number of cookies that the product cannot work without, and we ask before anything else is set.

Strictly necessary

Your session, device identifiers that protect the session from being stolen, your active workspace, and a token that protects forms against forgery. These cannot be switched off.

Preferences

Theme, sidebar state and the last model you used, kept in local storage on your own device.

Analytics

Aggregate page and feature counts, only after you accept them, and never joined to the content of a thread.

You can withdraw that choice at any time by clearing site data in your browser, which removes the stored preference along with it.

Where you use Nemu to process personal data belonging to your own customers, you are the controller and Nemu is the processor. Our Data Processing Agreement sets out the instructions we act on, the security measures we keep, the sub-processors we use and how we handle a request from one of your users.

The DPA applies automatically to paid accounts. Write to [email protected] for a countersigned copy.

Depending on where you live, you can ask to access, correct, export or delete your personal data, to restrict or object to some processing, and to withdraw consent you gave. Write to [email protected] and we reply within the time the law sets, normally one month. If you are in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.

The service is not meant for anyone under 18, and we do not knowingly collect data from children.

We may update this policy. We announce material changes in the product or by email before they take effect, and the date at the top shows the latest version.

Questions about privacy go to [email protected].