Privacy Policy

This Privacy Policy explains how GuusLab, trading as Nemi ("we", "us", "our"), collects, uses, stores, and protects your personal data when you use our file sharing platform at nemilab.com (the "Service").

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection legislation. We process your personal data lawfully, fairly, and transparently.

The data controller responsible for your personal data is:

If you have questions about data processing or wish to exercise your rights, please contact us using the details above.

We collect and process the following categories of personal data:

3.1 Account Data

• Name and email address (provided via Google OAuth).
• Profile picture (from your Google account).
• Account creation date and authentication tokens.

3.2 Billing Data

• Subscription status and plan type.
• Payment information is processed directly by Stripe and is never stored on our servers. We only store your Stripe customer ID and subscription ID.

3.3 Usage Data

• Files you upload (stored in encrypted form).
• File metadata: name, size, type, upload date, expiry date.
• Download analytics: number of downloads, download timestamps.
• Workspace information.

3.4 Technical Data

• IP address (for security and abuse prevention).
• Browser type and version.
• Device information.
• Cookies and similar technologies (see Section 8).

3.5 Communication Data

• Email address for transactional and marketing emails.
• Email interaction data (opens, clicks) for improving our communications.
• Your email preferences and unsubscribe choices.

Under the GDPR, we process your personal data on the following legal bases:

Where we rely on legitimate interest, we have conducted a balancing test to ensure your rights and freedoms are not overridden. You can request details of these assessments by contacting us.

We use your personal data to:

• Provide, maintain, and improve the Service.
• Process your file uploads, conversions, and compressions.
• Manage your account and subscriptions.
• Process payments through Stripe.
• Send transactional emails (account confirmations, download notifications, billing receipts).
• Send marketing communications about new features and offers (with easy opt-out).
• Monitor for abuse, fraud, and security threats.
• Enforce our Terms of Service.
• Comply with legal obligations.

We share your personal data only with the following categories of third parties, and only to the extent necessary:

6.1 Service Providers (Data Processors)

6.2 International Transfers

Where personal data is transferred outside the European Economic Area (EEA), we ensure adequate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on an adequacy decision.

6.3 Legal Disclosure

We may disclose your data if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Nemi, our users, or the public.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Account data: Retained for the duration of your account. Deleted within 30 days after account deletion.
• Files (free plan): Automatically deleted 30 days after upload.
• Files (paid plans): Retained while your subscription is active. Deleted within 30 days after subscription cancellation and plan downgrade.
• Billing data: Retained for as long as required by tax and accounting regulations (typically 7 years).
• Server logs: Retained for up to 90 days for security and debugging purposes.

We use the following cookies and similar technologies:

We do not use third-party tracking cookies or advertising cookies. Our cookies are limited to those strictly necessary for the functioning of the Service and functional cookies that improve your experience.

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): You can request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): You can request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17): You can request deletion of your personal data ("right to be forgotten").
• Right to restrict processing (Art. 18): You can request that we limit how we process your data.
• Right to data portability (Art. 20): You can request your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): You can object to processing based on legitimate interest, including marketing.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at privacy@nemilab.com. We will respond within 30 days as required by law. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

We send the following types of emails:

• Transactional emails: Account confirmations, download notifications, billing receipts, and security alerts. These are necessary for the Service and cannot be opted out of.
• Marketing emails: Product updates, new features, and promotional offers. You can unsubscribe at any time using the link in every email or through your email preferences.

All marketing emails comply with GDPR requirements and include a clear unsubscribe mechanism. We honor all unsubscribe requests promptly.

We implement appropriate technical and organizational measures to protect your personal data, including:

• Client-side encryption of uploaded files before they leave your device.
• Encrypted data transmission using TLS/HTTPS.
• Secure storage infrastructure with access controls.
• Regular security reviews and updates.
• Limited employee access to personal data on a need-to-know basis.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay, as required by GDPR Articles 33 and 34.

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that data promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. If we make material changes, we will notify you by email or by posting a prominent notice on the Service. The "Last updated" date at the top of this page indicates when this policy was last revised.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.