Privacy at Nimora.

What we use, why we use it, and how you stay in control.

Who operates Nimora

Manna Digital Consulting, S.L. operates Nimora. Our Spanish tax ID is B64597438. Our registered office is Carrer Bellaterra 6, bxos, 08940 Cornellà de Llobregat, Barcelona, Spain. Contact privacy@getspm.com for privacy questions or requests.

For customer workspaces, the customer organization determines the purposes and permissions for its data and normally acts as the controller. We provide the service as a processor. For account, security and service operations data, our role depends on the processing involved.

Data and purposes

Nimora processes:

  • Account and organization details needed for sign-in and membership.
  • Messages, documents, requests and results users add to their workspace.
  • Authorized connections and the information requested from connected services.
  • Technical, security, audit and cost records needed to run and protect the service.

We use this information to provide requested features, enforce permissions, maintain security, investigate issues, provide support and meet applicable obligations. Depending on the processing, the legal basis is the service contract, legitimate interests in security and operations, legal obligations or consent where required. Connecting a service authorizes the access described in that connection. The customer determines the legal basis for data it adds to its workspace.

Google data

When you connect Google, Nimora receives basic identity information to associate the account with your connection.

  • Read-only Calendar: Nimora can retrieve authorized calendars, event titles, dates, times, attendees, locations, descriptions and availability, subject to the permissions on each calendar and event.
  • Read-only Gmail: Nimora can search and retrieve messages, including sender, recipients, subject, date, snippets and selected message bodies, to answer your requests. If you enable mailbox monitoring, it can identify information relevant to your work.

These read-only permissions do not authorize sending, modifying or deleting email. Connecting Google is optional. You can disconnect the account in Nimora or revoke access in Google to stop future reads.

Access tokens are held by the credential service. Connections and derived data remain within the authorized organization and user scope. Relevant Google content may be processed by the configured AI model provider to produce a response or assessment visible in Nimora. Processing is limited to the requested feature and its permissions.

We do not sell Google data or use it for advertising, commercial targeting or credit decisions. Our use and transfer of information from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Our personnel do not read Google messages without affirmative agreement for specific data, a security need or a legal requirement.

How we protect data

These safeguards apply to sensitive information, including authorized Gmail and Calendar content:

  • Encrypted connections: public Nimora services use HTTPS/TLS. Connections to Google APIs and the configured cloud AI providers use HTTPS/TLS.
  • Protected credentials: OAuth access and refresh credentials are encrypted at rest with AES-256-GCM by the credential service. Server-side tools use credentials only within the authorized connection; raw credentials are not returned to the browser or sent to the AI model.
  • Protected files: canonical document files, including saved exports and recordings, are encrypted at rest with AES-256-GCM. Transactional workspace records and search indexes are held in access-controlled databases; this is distinct from file and credential encryption.
  • Access isolation: authenticated accounts, workspace membership, roles, resource permissions and connection scopes are checked by the backend. Database row-level controls and workspace-scoped repositories restrict cross-organization access. A shared link or a hidden UI control does not replace authorization.
  • Limited processing and oversight: tools retrieve information for the authorized feature. Relevant content may be sent to the AI provider configured for the workspace, under the applicable service terms and settings. Google API data is not used to train or improve generalized AI models. Security and audit records support investigation without recording raw OAuth secrets.
  • Retention and revocation: authorized users can disconnect Google access and request deletion. Stored content, indexes, audit records and backups follow their applicable retention and recovery rules; disconnecting does not imply immediate erasure of every retained copy.

No security measure eliminates every risk. If we identify a security incident involving personal data, we investigate, contain it and notify affected customers or authorities where required.

Sharing and retention

Infrastructure, identity and AI model providers may process information needed for the feature you use, under the applicable permissions and configuration. We do not share personal data with advertisers or data brokers. Shared connections can only be used by people authorized under the workspace’s access policy.

We retain data for as long as needed for the workspace and purposes described here, subject to applicable retention settings, deletion requests and legal or security obligations. Audit records may have different retention periods from workspace content. Disconnecting an account stops future reads; it does not automatically delete records that must be retained. Contact your workspace administrator or privacy@getspm.com to ask about or request deletion of specific data.

Your rights

You can request access, correction, deletion, restriction, objection or portability where applicable by writing to privacy@getspm.com. You may also contact the relevant data protection authority. We will update this page if the practices described here change materially.