This Data Processing Agreement ("DPA") applies when you use Nemi in the course of a business, profession, or organization and, in doing so, process personal data about other people through the Service. It is the written agreement required by Article 28(3) of the General Data Protection Regulation (GDPR).
The DPA is part of our Terms of Service (Section 10) and takes effect automatically when you start using the Service in that way. You do not need to sign a separate document, and we do not need to countersign one. If your organization requires a signed copy or a version on your own paper for its records, email support@nemilab.com and we will provide one.
If you use Nemi purely for your own personal or household purposes, this DPA does not apply to you; only our Terms of Service and Privacy Policy do.
Current version: 2.19, effective November 1, 2026. Version 2.19 changes who sends the shares and invitations an authorized user sends by email to other people (a share link, a workspace, Business, folder, document or calendar invitation, a request for files, a new review round). Once an authorized user's account has been moved to the new arrangement, we no longer send those from our own address through Amazon Web Services in Frankfurt: on a plan with Nemi Mail they are sent from that user's own Nemi Mail address through Amazon Web Services in Ireland (eu-west-1) and stored in their mailbox like their other mail, and on a plan without it they are not sent at all. Both Amazon Web Services rows in Annex 3 now say so. Calendar event invitations are still sent from Frankfurt. No sub-processor is added or removed. Version 2.18, effective November 1, 2026, records Nemi Mail in Annexes 1, 2 and 3. Where an authorized user's plan includes it, they can hold an email address with us, receive and send mail with it, on our mail domain, nemimail.com, or on a domain of their own, and link mail accounts they already have. Amazon Web Services is added to Annex 3 for that purpose, in Ireland (eu-west-1), as a separate row from the email delivery it already did for us in Frankfurt: it receives and sends that mail, checks it for spam and viruses, and holds each received message in a landing bucket only until we have copied it. Annex 1 now names the people who write to or receive mail from an authorized user as data subjects, and records that we build a search index of keyed word fingerprints per mailbox, keep a 30 day record of mail we did not deliver, and keep a list of addresses that bounced or complained so that no Nemi Mail address writes to them again. Mail an authorized user links from Google, Microsoft or an IMAP provider is processed at that provider under the user's own agreement with it; those providers are not our sub-processors. The assistant inside Nemi can work with a user's mail on their instruction, under the same terms as everything else it reads, and never sends it. Version 2.17, effective October 26, 2026, adds GitHub to Annex 3: the installer of Nemi Link, the Mac app, is stored at GitHub and delivered from there when somebody downloads it or an installed copy updates itself, so GitHub receives the IP address of whoever downloads it. It receives no Customer Data. No category of data changes. Version 2.16 changes Annex 1 and the code sandbox row in Annex 3: an account holder can now switch internet on for their own sandbox. It is off unless they do, and while it is on, the program running there can reach websites, so whatever is in that sandbox, including the files loaded into it on their instruction, can be sent onward by it, to destinations neither we nor Amazon Web Services choose or see. That is the account holder's decision, made per account and explained to them before it takes effect. Account holders can also set how the assistant works for them; what they write about themselves and their instructions are sent to the language model with each of their messages. No sub-processor is added. Version 2.15 widens the Linkup row in Annex 3 and the web search sentence in Annex 1: the assistant inside Nemi can now search the web too, sending Linkup only the search words the model wrote, as Nemi AI in connected apps already could. No sub-processor is added and no category of data changes. Version 2.14 changes who runs the language model behind the assistant and AI forms. Google is added to Annex 3: the first choice is now a model run by Google on Vertex AI in the European Union. Microsoft stays in Annex 3 as the backup, running a second model on Azure in the EU data zone, and receives a request only when Google cannot take it. The request names those two hosts in that order and forbids any other, requires zero data retention and forbids training, as before. No category of data changes. Version 2.13, effective the same day, adds Amazon Web Services (Bedrock AgentCore and S3) to Annex 3 for a new purpose and records the code sandbox in Annex 1. Where an account holder on the Max or Business plan asks the assistant for work that needs a program, the assistant writes one and runs it in a virtual machine of its own for that conversation, at Amazon Web Services in Frankfurt, and the files it loads into it on that instruction are processed there. Amazon Web Services was already a sub-processor for email; this is a different service and a different category of data, so it has its own row. No other sub-processor changes. Version 2.12 adds Linkup to Annex 3 and records web search in Annex 1. An app an authorized user connected can use Nemi AI with web search turned on; when the model decides to search, the search words it wrote are sent from our servers to Linkup, which returns matching web pages. Linkup receives the search words and nothing else of the conversation. It is a French company and does not commit to processing searches only in the European Union, so this Annex does not claim it does. OpenRouter is not used for web search, because it offers web search only outside the EU. No other sub-processor and no other category of data changes. Version 2.11 adds one paragraph to Annex 3 about apps that offer Sign in with Nemi. Your authorized users can now sign in to apps made by other developers and allow such an app to reach Customer Data within their own role in your workspaces, permission by permission. Those developers are not our sub-processors, for the same reason a connected AI assistant is not: the user chooses the app and instructs us to give it what they approved. No sub-processor is added and no category of data changes. Version 2.10, effective October 11, 2026, corrects three statements that no longer matched the Service, and changes nothing about how it works. Annex 1 said the assistant was the only processing in which content leaves the European Union in order to be read; since version 2.5 it does not leave the EU, and Annex 1 now says so. Annex 1 listed back-up of the content you upload among the processing operations; uploaded files are not backed up, as Annex 2 already said. Annex 2 now also states that files larger than 500 MB are not scanned for malware, which was already the case. No sub-processor and no category of data changes. Version 2.9, effective October 10, 2026, records dictation in Annex 1 and widens the Soniox row in Annex 3: where an account holder's plan includes voice minutes, they can dictate into Nemi AI, a document or a long text field, and while they do their own browser sends their microphone audio to Soniox in its European Union region, the same provider and region already used for live captions. The audio does not pass through us, and the text comes back to that browser only. No sub-processor is added and Soniox's region does not change. Version 2.8, effective October 4, 2026, adds Apple to Annex 3: notifications to the Nemi iPhone apps are delivered through the Apple Push Notification service, which receives the title and text of each notification and can therefore receive the name of a file, a document or a person. Notifications were already delivered this way before this version, and Annex 3 should have named Apple then; it did not. No category of data changes. Version 2.7, effective October 3, 2026, Version 2.7 changes Annex 3 only: every request to the AI sub-processors now requires zero data retention, enforced by the router rather than left to the host, and images sent to the model are always re-encoded, so their metadata is never sent. No sub-processor and no category of data changes. Version 2.6 changes Annex 2 only: Customer Data written in the Service is now additionally encrypted by the application before it reaches our database, and the measures against guessing and flooding and against active content in uploaded files are now described. Before this version, Annex 2 described encryption at rest only as the storage provider's, which was accurate: our database held that content unencrypted. No sub-processor and no category of data changes. Version 2.5 changes where OpenRouter processes content and adds AI forms to Annex 1. Every request to the language model now goes through OpenRouter's gateway in the European Union, where it is decrypted in the EU, passed only to hosts in the EU and not logged, so both the route and the model are in the EU; OpenRouter remains a United States company and its row in Annex 3 keeps the transfer safeguard. Version 2.2 below said the step in front of the model ran outside the EU, which was true then and is not now. Annex 1 now also records AI forms: where a form's creator makes it an AI form, the people who fill it in answer an interviewer run by the same model, and the form's questions, the creator's note about it and the answers given in that conversation are sent to the providers in Annex 3. The creator can require respondents to sign in to a Nemi account or enter a password before that conversation starts; we check the sign-in and do not record the respondent's identity with the form, the answers or the usage record. No sub-processor is added or removed. Version 2.4 adds Soniox to Annex 3 and changes what Annex 1 says about meetings. Live captions used to run in each participant's own browser and send nothing anywhere; they are now one transcription of the whole meeting, and the host's browser sends the mixed audio of everybody in it to Soniox in their European Union region. That is a change of kind rather than of degree: the audio of a conversation now reaches a company we chose, on the host's decision, for every person in the room including guests with no account. Annex 1 no longer says we never process the live audio of a meeting without qualification, because with captions on the audio leaves the host's browser, and we say so even though it does not pass through us. No other category of data changes. Version 2.3 records one addition in Annex 1: a recipient looking at one of your links that has expired can now ask you to resend it, and doing so records a note they may write and, where there is one to record, their email address. Recipients of your share links were already named as data subjects and nothing changes about who they are; what is new is that they can write something you then read. No sub-processor is added and Annex 3 is unchanged. Version 2.2 changes who runs the language model behind the assistant, which is a change to Annex 3 and to where content is processed. Baseten, Parasail, Modal and DeepInfra are removed: they ran an open-weights model, all four were in the United States, and none of them receives anything now. Microsoft is added in their place, running the model on Azure and pinned to Azure's EU data zone, so the inference itself no longer leaves the EU. OpenRouter is unchanged and remains in the United States: it receives and decrypts every request in order to route it, so the model runs in Europe while the step in front of it does not, and this Annex says both rather than the flattering half. No category of data changes and nothing new is collected. Version 2.1 extends the Annex 1 record of the assistant inside Nemi: it can now be asked to write and rearrange the account holder's own folio, so what it sends can include the whole of that page, including the contact address and the location published on it. No sub-processor is added, and nothing that was already listed changes. Version 2.0 names all four companies that may run the language model behind the assistant, where 1.8 named only the first of them. Thirteen companies offer that model and one of them is in China; we allow a closed list of four, all in the United States, so content belonging to a customer cannot reach a host this Annex does not name. Adding one is a change to this document before it is a change to a setting. Version 1.9 completes the Annex 1 record of the assistant inside Nemi that version 1.8 introduced earlier the same day: a message now also carries what the account holder had open or selected on screen when they sent it, so Annex 1 names that as well. No sub-processor is added. Version 1.8 adds OpenRouter and Baseten to Annex 3 and records the assistant inside Nemi in Annex 1: on the Max and Business plans, an account holder can ask an assistant to act for them, and answering costs sending part of the content to a model gateway and to the company running the model, outside the EU. This is the first sub-processor that receives content in order to read it rather than to store or deliver it, so Annex 1 now says which parts and on whose instruction. Version 1.7 records folios in Annex 1: a page a person publishes about themselves, which we serve publicly on their instruction and about whose visitors we record nothing beyond a count of how many times the page was opened. No sub-processor is added. Version 1.6 adds ISRG (Let's Encrypt) to Annex 3: a workspace on Creator and higher can connect a domain it owns for its public links, and serving those links over HTTPS means obtaining a certificate for that hostname. Version 1.5 corrected Annex 1: earlier versions stated that we do not process the audio, video or shared screens of a meeting at all. That is true of the live streams and untrue of a recording a participant makes on their device, which is uploaded to their workspace and stored like any other file.
Processor: GuusLab, trading as Nemi, Emmaweg 46, 3603 AN Maarssen, province of Utrecht, the Netherlands, KVK 95954600 ("we", "us").
Controller: the account holder or organization that uses the Service and decides what personal data is uploaded to it ("you"). If you are yourself a processor for your own customers, you act as their processor, this DPA makes us your sub-processor, and everything below applies with that reading.
You determine the purposes and means of the processing of the content you upload. We process that content only to provide the Service to you. For our own processing of your account, billing, technical, and communication data we are an independent controller; that processing is described in our Privacy Policy and is not governed by this DPA.
We process personal data on your behalf only on your documented instructions, including for transfers to a third country. Your instructions are:
We will inform you if, in our opinion, an instruction infringes the GDPR or other applicable data protection law. If we are required by EU or Member State law to process personal data beyond your instructions, we will inform you of that requirement before processing, unless the law prohibits it on important grounds of public interest.
We do not use the content you upload for our own purposes. We do not sell it, we do not use it for advertising, and we do not use it to train AI models. Where the assistant inside Nemi sends part of it to the sub-processors in Annex 3, that is your instruction rather than our purpose, and the request carries an instruction that it may not be used for training either.
Nemi is a general purpose file sharing and collaboration platform. It is not built or certified for data that requires additional safeguards. As set out in Section 7 of the Terms of Service, you must not upload, store, request, or collect through the Service:
This exclusion applies to every part of the Service, including the questions you ask in a Nemi form or through an upload link. We do not sign business associate agreements under HIPAA and we make no representation that the Service meets any sector-specific framework.
You warrant that the personal data you upload stays within these limits. If you breach this section, you remain responsible toward the people whose data it is and toward your supervisory authority, and Section 15 of the Terms of Service (indemnification) applies.
We treat the personal data we process on your behalf as confidential. Access is limited to the people who need it to provide, secure, or support the Service, and those people are bound by a duty of confidentiality that survives the end of their engagement. We do not disclose the content you upload to third parties except as described in Section 7 (sub-processors) and Section 11 (government and legal requests).
We implement appropriate technical and organizational measures under Article 32 GDPR, taking into account the state of the art, the costs of implementation, and the risks of the processing. The measures in force are listed in Annex 2. We may update them as the Service evolves, provided the level of protection does not decrease.
You give us general written authorization to engage the sub-processors listed in Annex 3. Each sub-processor is bound by a written agreement that imposes data protection obligations equivalent to those in this DPA, and we remain fully liable to you for their performance.
If we intend to add or replace a sub-processor, we will announce it on this page and, where we hold your email address for the account, notify you at least 30 days before the change takes effect. You may object on reasonable data protection grounds within that period by emailing support@nemilab.com. If we cannot offer you a reasonable alternative, you may terminate your subscription with a refund of the unused prepaid portion, as your exclusive remedy.
The Service gives you direct control over the personal data you process through it: you can view, correct, export, and delete files, documents, form responses, and workspace members yourself, at any time.
If a person exercises a right under Articles 15 to 22 GDPR against you and you cannot answer them using those tools, we will assist you with appropriate technical and organizational measures, at your request and at our reasonable cost where the effort goes beyond routine support.
If a request reaches us directly and it concerns data we process on your behalf, we will not answer it ourselves. We will forward it to you without undue delay, unless we are legally required to respond.
We notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting personal data we process on your behalf. The notification goes to the email address of the account owner, and to the organization owner for a Business organization.
Our notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned as far as known, the likely consequences, and the measures we have taken or propose to take. We assist you with the notification you may have to make to your supervisory authority under Article 33 and to affected people under Article 34. Reporting to your own supervisory authority remains your responsibility as the controller.
On request, we provide reasonable assistance with data protection impact assessments and prior consultations under Articles 35 and 36 GDPR, taking into account the nature of the processing and the information available to us. In practice this means providing the documentation on this page and answering specific questions about how the Service processes data.
If a public authority requests access to personal data we process on your behalf, we will inform you before we disclose anything, unless the law prohibits it. We review each request for validity, we do not grant direct or unrestricted access to any authority, and we disclose no more than the request legally requires.
We store files and send email within the European Union. Where personal data is transferred outside the European Economic Area, for example to Google or Stripe in the United States, the transfer relies on an adequacy decision such as the EU-US Data Privacy Framework, or on Standard Contractual Clauses approved by the European Commission, together with supplementary measures where needed. Annex 3 lists the location of each sub-processor.
You can delete files, documents, and your entire account from the Service at any time; deletion in the app is the primary way to get your data returned or erased. Exports are available in standard formats through the Service.
On termination of your account, we delete the personal data we process on your behalf. For uploaded files, deletion is immediate and permanent: file storage holds one copy, so nothing can be restored afterwards, by us or by anyone else. Residual copies in our database backups are removed within 30 days. We retain data beyond that point only where EU or Member State law requires it, for example the seven year Dutch tax retention period for billing records, and only for as long as that obligation lasts.
On the free plan a file is deleted 30 days after it was uploaded, or 30 days after a paid plan ended, whichever is later, as described in the Terms of Service.
Two things behave differently and you should plan around them. Everything Trace recorded about a link is deleted the moment you revoke that link, so exercising a recipient's erasure request can be done by you, immediately, without asking us. And a vault folder cannot be exported by us in readable form at any point, on termination or before it: only a member holding the key can decrypt it, so make sure somebody in your organization still holds one before an account is closed.
We make available to you the information necessary to demonstrate compliance with Article 28 GDPR, primarily through this DPA, our Privacy Policy, and written answers to your questions.
If that is not sufficient for your compliance obligations, you may audit us, or mandate an independent auditor who is not a competitor of ours and who is bound by confidentiality. Audits take place at most once per twelve months, on at least 30 days written notice, during business hours, without disrupting the Service, and at your cost. An additional audit may take place after a personal data breach affecting your data, at our cost. We may require the auditor to sign a confidentiality agreement, and access to data belonging to other customers is never part of an audit.
Liability under this DPA is subject to the limitations in Section 14 of the Terms of Service, to the extent permitted by applicable law. Nothing in this DPA limits the rights of data subjects or the liability that Article 82 GDPR places on us directly.
If this DPA conflicts with the Terms of Service or the Privacy Policy on the processing of personal data we handle on your behalf, this DPA prevails.
We may update this DPA to reflect changes in the Service, in our sub-processors, or in applicable law. Material changes follow the procedure in Section 17 of the Terms of Service, and sub-processor changes follow Section 7 above. The date at the top of this page shows when it was last revised.
This DPA is governed by Dutch law, and disputes go to the competent courts in the Netherlands, as set out in Section 18 of the Terms of Service.
For questions about this DPA, a signed copy, an audit request, or a sub-processor objection:
GuusLab (trading as Nemi)
Emmaweg 46
3603 AN Maarssen, province of Utrecht
The Netherlands
KVK: 95954600
Email: support@nemilab.com
We have not appointed a Data Protection Officer: our processing does not meet the criteria of Article 37 GDPR. Data protection questions go to the address above and are handled by us directly.
| Subject matter | Providing the Nemi file sharing, storage, conversion, and collaboration platform to you. |
| Duration | For as long as your account exists, plus the retention periods in Section 13. |
| Nature and purpose | Storage, transmission, sharing, previewing, conversion, compression, malware scanning, collaborative editing, form collection of the content you upload (uploaded files are not backed up, see Annex 2), plus the analytics we show you about your own shares. Where you switch on Trace for a share link, that additionally includes engagement analytics about the people who open it, described in Section 3.10 of our Privacy Policy: we record and present it on your instruction, and you decide whether to use it and against whom. Where you put a share under review, it includes the comments, pins and approval decisions your reviewers leave. For Nemi Meet we additionally connect meeting participants to one another and store the meeting chat and attendance record; we do not process the live audio, video, or shared screens themselves, which travel directly between participants and are never received by us in a form we could store. Where the host of a meeting switches on live captions, that host's browser mixes the microphone audio of every participant, guests included, and sends it to the sub-processor in Annex 3 that transcribes it, in that provider's EU region. We do not receive that audio either, and it does not pass through our servers, but we name the provider and we say that it happens, because it is our feature and our choice of provider: the live audio of a meeting is processed by a company we engaged, on the host's instruction, for the whole room. The text that comes back is passed between participants and not stored by us; the transcript written into the host's meeting notes at the end is content in their workspace and is processed as any other content is. Where an account holder dictates instead of typing, their own browser sends their microphone audio, for as long as they dictate, to the same sub-processor in Annex 3 in the same EU region; we do not receive that audio, the text comes back to their browser only, and it becomes part of whatever they then save or send, which we process as any other content. We also record the number of seconds of captioning and of dictation an account has used in the current month, in order to enforce a monthly allowance of voice minutes. Where a participant uses Meet's device-side recording, their browser produces a video file of the call as they received it and uploads it to their workspace, and we then process that file as we process any other file content: it is stored, and it is not deleted when the meeting is. For a direct Beam transfer we introduce two devices to each other and process nothing else: the file never reaches us. For a vault folder we store ciphertext we are not able to decrypt, so our processing of its contents is limited to storing and returning bytes we cannot read. Where a person publishes a folio, we serve that page and its media to whoever opens it, on their instruction, and the only thing we record about a visit is a counter on the page itself: no address, no location, no device and no per visit record. Where an account holder on a plan that includes it uses the assistant inside Nemi, we send their message, that conversation, and the results of the actions the assistant took, to the sub-processors in Annex 3 that run the language model, so that it can answer and act. This happens per message and only on that instruction; the request goes through OpenRouter's gateway in the European Union to a model run by Google on Vertex AI in the European Union, or, when Google cannot take it, to a model run in Azure's EU data zone, so the content stays in the European Union while it is read. We send every such request with an instruction that it may only be served by a host that does not retain it and may not be used to train a model, and the conversation itself is stored in Nemi on that account until they delete it. Where the assistant inside Nemi, or an app an authorized user connected using Nemi AI with web search turned on, decides to search, the search words the model wrote are sent to the search sub-processor in Annex 3, and the pages it returns are passed to the model and to the account holder or that app; nothing else of the conversation is sent to it. Where the assistant needs to run a program for that account holder, it runs the program it wrote in a virtual machine of its own for that conversation at the sandbox sub-processor in Annex 3, in Frankfurt, and the files it loads into it on their instruction (files they may open themselves, never a vault, and files they attached) are processed there; what the program makes comes back to them as a download held for 24 hours, and the virtual machine and everything in it are deleted when the conversation goes quiet and at most an hour after it started. The virtual machine has no internet access unless that account holder switched it on for their own account; where they did, the program running there can reach websites and so send what is in it, including those files, to destinations of its choosing, which we do not see or control. Where an account holder sets how the assistant should work for them, what they wrote about themselves and their instructions are sent to the language model with their messages, as part of the request described above. Where an authorized user's plan includes Nemi Mail, we receive, store, send, filter and search their mail, on our mail domain or on a domain they own, through the mail sub-processor in Annex 3 in Ireland: a received message lands in a bucket in that region only until we have copied it into our file storage, encrypted by us; its subject, preview and text are encrypted in our database, and a search index of keyed fingerprints of its words, under a key belonging to that mailbox alone, lets them search it. Incoming mail is checked for spam and viruses, its attachments are scanned on our own infrastructure, first-time senders wait in a screener for the user's decision, and we keep, for 30 days and without content, a record of mail we did not deliver, with the sender and recipient addresses and the sending server's address. Delivery, bounce and complaint reports about mail the user sent are kept for 30 days, and an address that bounces permanently or complains is kept on a list no Nemi Mail address writes to again. Pictures in a message are fetched by our server and only once the user asks for them. Where the user links a mail account they hold at Google, Microsoft or an IMAP provider, we import its last 90 days of mail and keep it in step on their instruction, and mail they send from it is sent by that provider. Files the user uploads into a message they write are scanned the same way before the message leaves, and the message waits until they are. Where attachments go as a share link, the link cannot be opened until the message leaves and is deleted if the user undoes it. A change the user makes to the mail of a linked account is kept, without content, until the provider accepts it, for about 32 hours at most while the provider is reachable. Where the user's plan includes Nemi AI and they ask, the text of the messages concerned is sent to the AI sub-processors in Annex 3 on the same terms as the assistant, and so is what the assistant inside Nemi reads when they ask it to search their mail, read a conversation or list what people are waiting on them for, which is then kept in that assistant conversation; mail received from a Gmail account through Google is never sent. Nothing is sent by Nemi AI: it can put a message in the user's drafts, and only the user sends. |
| Types of personal data | Whatever you choose to upload or collect: file and document content, form responses, names, email addresses, usernames, workspace and organization membership, share and download events, technical data about uploads, and, for meetings, the display names, attendance times, and chat messages of participants together with the network addresses their browsers exchange in order to connect. Where you switch on Trace, it also includes hashed IP addresses, coarse location derived from them, device, browser and operating system, referring page, and estimated reading time per page or per scene, for each person who opens the link. Where you use review rounds, it includes the names, optional email addresses and comments of your reviewers. Where a recipient asks you to resend a link of yours that has expired, it includes the note they write, if they write one, and an email address where there is one to record. For Gallery it includes the photographs themselves, the camera metadata read out of them, and a numeric vector of picture content computed on the uploader's device. Where the assistant inside Nemi is used, it includes whatever the requested action returns, which may be the text of a document, the cells of a spreadsheet, the answers to a form, the details of an event or a photograph, or, where they ask it about their folio, the whole of that page including the contact address and location they publish on it, together with the account holder's display name, the name of the workspace they have open, and what they had open or selected on screen when they asked: the title of the document, spreadsheet, canvas or form in front of them, the folder they were in, and the name, type and size of the files they had selected or were previewing. Where a form is an AI form, it includes the form's questions, the note its creator wrote about what they want to learn, and the answers and name a respondent gives in that conversation, sent to the model so that it can ask the next question and, at the end, fill in the typed answers in the form's language, together with an optional column of additional notes the respondent sees before sending; the conversation is held only in server memory for at most two hours and never stored, and the answers are kept as ordinary form responses. Special categories under Article 9 GDPR and the data listed in Section 4 are excluded. For Nemi Mail: the content of email messages and attachments, the names and email addresses of senders and recipients, the results of their authentication checks, the sending server's network address for mail we did not deliver, delivery and bounce reports, and the user's decisions about senders. |
| Categories of data subjects | Your employees and colleagues, your clients and customers, recipients of your share links, people who open a link you have switched Trace on for, people who comment on or approve a review round, people who upload through your upload links or Beam, people who fill in your forms (including by answering the interviewer of an AI form), people who join your meetings, people who write to or receive mail from your authorized users in Nemi Mail, and any person appearing in the content you upload. |
| Frequency | Continuous, for as long as you use the Service. |
The following sub-processors are authorized as of the date at the top of this page:
| Sub-processor | Purpose | Data location |
|---|---|---|
| Wasabi Technologies | File and document storage, AES-256 at rest | EU (Amsterdam) |
| Amazon Web Services (SES) | Transactional and notification email delivery, calendar event invitations, and the shares and invitations of authorized users not yet moved to sending from their own Nemi Mail address | EU (Frankfurt) |
| Amazon Web Services (SES, S3, SNS) for Nemi Mail | Receives and sends the mail of Nemi Mail addresses and custom mail domains, including the shares and invitations an authorized user sends by email from their own address, checks incoming mail for spam and viruses, holds each received message in a landing bucket until it is copied (deleted at once, and after one day at the latest), and reports deliveries, bounces and complaints. A separate account and configuration from the email delivery row above. | EU (Ireland, eu-west-1); US company (EU-US Data Privacy Framework, SCCs) |
| Stripe | Subscription payments and billing | EU/US (EU-US Data Privacy Framework, SCCs) |
| Sign-in with Google (authentication) | EU/US (EU-US Data Privacy Framework, SCCs) | |
| OpenRouter | Routes a request from the assistant inside Nemi, or from an AI form, to the company running the language model. Receives the message, the conversation, and the results of the actions the assistant took, or a form's questions and the answers given in it. Only on plans that include Nemi AI, and only when it is used. Every request goes through its EU gateway: decrypted in the EU, passed only to hosts in the EU, and not logged. Every request requires zero data retention and forbids training. | EU gateway; OpenRouter is a US company (Standard Contractual Clauses) |
| Google (Vertex AI) | Runs the language model itself and receives the same request through OpenRouter. The first of two hosts: the request names Vertex AI in the EU, then Azure in the EU, and forbids the router from using any other company. Every request requires zero data retention and forbids training. | EU (Vertex AI EU region); US company (EU-US Data Privacy Framework, SCCs) |
| Microsoft (Azure) | The backup host: runs a second language model and receives a request through OpenRouter only when Google cannot take it. The request pins Azure's EU data zone and forbids the router from using any other company. Every request requires zero data retention: it may only be served by an endpoint on OpenRouter's zero data retention list, so the host keeps nothing of it once it has answered, and training on it is not permitted. | EU (Azure EU data zone) |
| Amazon Web Services (Bedrock AgentCore, S3) | Code sandbox for the assistant inside Nemi: a virtual machine per conversation that runs the program the assistant wrote, with the files loaded into it on the account holder's instruction. Files over 40 MB pass through a private bucket that deletes them within a day. No credentials inside the sandbox, and no internet access unless the account holder switched it on for their own account, in which case the program there can reach websites. Only on the Max and Business plans, and only when it is used. | EU (Frankfurt); US company (EU-US Data Privacy Framework, SCCs) |
| Linkup | Web search for the assistant inside Nemi, and for Nemi AI inside an app an authorized user connected when that app turns web search on, only when the model decides to search. Receives the search words the model wrote, from our servers, and nothing else of the conversation. Returns matching web pages. | France (EU company); processing not committed to the EU |
| Soniox | Turns speech into text. While a meeting host has live captions switched on, it receives the mixed microphone audio of everybody in that meeting, sent from the host's browser rather than from our servers. While an account holder dictates, it receives that person's own microphone audio, sent from their browser rather than from our servers. Their EU region is used, so the audio and any transcript it holds stay in the European Union for both processing and storage. Only on plans that include captions or voice minutes, and only while captions or dictation are running. | EU region (US company) |
| Apple (Apple Push Notification service) | Delivers notifications to the Nemi iPhone apps where the user allows them. Receives the title and text of each notification, which can name a file, a document or a person, and the device token. | EU/US (EU-US Data Privacy Framework, SCCs) |
| GitHub | Stores and delivers the Nemi Link installer and its updates. Receives the IP address of whoever downloads it, and no Customer Data. | US (EU-US Data Privacy Framework, SCCs) |
| ISRG (Let's Encrypt) | TLS certificates for a custom domain you connect. Receives the hostname only, and no personal data. | US (certificate authority) |
Wasabi, where your files are stored, is ISO 27001 certified and its data centers are SOC 2 audited, and it encrypts every object at rest with AES-256. Those are their certifications, not ours: as Section 4 says, we hold none of them, and the exclusion of Article 9 and sector-regulated data applies regardless of what our providers are certified for.
Application servers, file conversion, compression, malware scanning, and database backups run on infrastructure we operate ourselves in the Netherlands. Those functions involve no additional sub-processor, and backups never leave that infrastructure.
Third-party AI assistants that you connect through our MCP integration are not our sub-processors. They act on your instructions under their own provider's terms, only after you explicitly authorize the connection, and you can revoke it at any time in your account settings. The assistant inside Nemi is the opposite case and is why OpenRouter and Microsoft appear above: there we choose the provider, so they are our sub-processors and we remain liable to you for them.
Mail accounts that your authorized users link to Nemi Mail, at Google, Microsoft or any IMAP provider, are not our sub-processors either. The user holds that account under their own agreement with its provider and instructs us to connect to it; we read and change the mail in it and send through it on that instruction, and the provider processes it as it did before the user linked it.
Apps that offer Sign in with Nemi are not our sub-processors either. When one of your authorized users signs in to such an app and allows it, the app receives the Customer Data that user approved on the consent screen, limited to that user's own role in each workspace and never including vault folders, contacts or account settings, as described in Section 6.3a of our Privacy Policy. We disclose it on that user's instruction to a developer they chose, who processes it as an independent controller under their own terms. The developer may be outside the European Economic Area; because the transfer is made on the user's instruction to a recipient they chose, it is not one of the transfers Section 12 covers. The user can withdraw that access at any time in Settings, Connected apps.