Privacy Policy

This Privacy Policy explains what personal information NimbleArk processes when you use the service, why it is processed, where it may go, how long it may be kept and the choices available to you. NimbleArk is designed around data minimisation: the assessment does not need to know who a person is in order to judge whether communication does its job.

NimbleArk is operated by:

NimbleArk is operated by ECHO ONE ZERO LTD, a company registered in England and Wales under company number 17469799.

Email: thenimbleark@gmail.com

ECHO ONE ZERO LTD is the data controller for the personal information described in this policy where it determines why and how that information is processed.

NimbleArk does not need names, contact details or other identifying information about the people mentioned in a communication in order to assess it. You should remove or replace personal information before submitting assessment content wherever it is not necessary.

You should not submit special category information, criminal-offence information, passwords, financial credentials or other highly sensitive information unless it is genuinely necessary and you are lawfully entitled to provide it. The identity of the person being discussed does not improve the assessment.

A person can be identifiable without being named. A combination of details may still identify someone, so anonymisation should consider the communication as a whole.

Depending on how you use NimbleArk, the following information may be processed:

• Account information: email address, user or account identifier, access level, account preferences and profile settings.
• Authentication and security information: information needed to verify and secure access to your account, including email verification, sign-in method and two-step verification status. Authentication infrastructure handles passwords and authenticator credentials; NimbleArk does not store your plaintext password.
• Assessment information: the communication you enter or paste, text extracted from an uploaded document, context, supporting material, communication direction, declared intent in Sending mode, declared concern in Received mode, intended outcome where applicable, and other information you choose to provide for the assessment.
• Assessment results: the Yes/No judgement, numerical assessment score, scoring breakdown used by the assessment engine, explanation, revision information and mode-specific findings. Depending on the assessment mode, those findings may include Communication Summary, Main Problem, Questions Unanswered, Main Issues to Consider, What You Are Being Asked to Do, What needs checking or clarifying and Next steps.
• Saved service information: assessment titles, dates, pinned status, revision links, cloud-sync and retention settings and related application preferences.
• Legal acceptance records: the version of applicable terms or notices accepted, the time of acceptance and the method used to record it.
• Support information: information you provide when you contact NimbleArk for help or make a privacy request.
• Technical and security information: infrastructure providers may process information such as IP address, browser or device information, timestamps, session identifiers, error information and operational logs needed to host, secure and maintain the service.

When you upload a supported document for assessment, NimbleArk extracts the document text in your browser. The original uploaded file is not stored in NimbleArk's server-side assessment history.

The extracted text is different from the original file. It becomes part of the assessment input and is transmitted for AI-assisted processing. If you are signed in and your storage settings permit the assessment to be saved, the extracted text may also form part of the saved assessment record.

You should therefore anonymise the content before assessment where identifying information is unnecessary.

When you run an assessment, NimbleArk sends the assessment content and relevant context through the Lovable AI Gateway to the AI model used by NimbleArk. The current model is supplied by OpenAI through that gateway.

The assessment request contains the communication and assessment context needed to apply the NimbleArk framework. NimbleArk does not include your account email address, password or account role in the model request merely because you are signed in.

The AI output is returned to NimbleArk, validated against the application's required response structure and presented according to the selected assessment mode. In Sending mode, the Yes/No judgement is the primary user-facing result and the numerical score is displayed as secondary context. In Received mode, the assessment is presented through its mode-specific findings and the internal Yes/No judgement and numerical score are not displayed.

NimbleArk does not use assessment content to train its own AI model and has not enabled assessment content for model-training purposes within NimbleArk.

OpenAI states that inputs and outputs submitted through its business and API services are not used to train or improve OpenAI models by default unless the relevant customer explicitly opts in. OpenAI also states that API inputs and outputs may be retained for up to 30 days for service delivery and abuse monitoring, subject to the endpoint and data-control configuration in use.

Lovable may process platform, service and log data under its own applicable terms and privacy materials. Lovable's public privacy materials also describe the use of de-identified or aggregated usage information for service operation and improvement. NimbleArk does not control processing that a provider carries out independently under its own legal responsibilities.

Guest use

Guest assessments are not added to a NimbleArk server-side assessment history. Necessary browser storage may still be used for session operation, unfinished assessments and guest usage controls. Assessment content must still be transmitted for the assessment to run, so temporary provider-side processing or logs may still occur even when the assessment is not saved by NimbleArk.

Registered accounts

For signed-in users, an assessment is saved where Cloud Sync is enabled and the retention setting is not Never. A saved assessment may contain the submitted communication, context, result, score, timestamps, revision information and related metadata.

NimbleArk currently offers assessment-retention settings of 24 hours, 1 week, 1 month, 1 year, Forever and Never.

• If an expiry period is selected, the active assessment record is removed when the retention period expires.
• Forever means the assessment remains until you delete it, delete your account or it is otherwise lawfully removed.
• Never means NimbleArk does not save the assessment into your server-side assessment history. It does not prevent the temporary processing needed to run the assessment.
• Account information is normally kept while the account remains active and for any further period reasonably required for security, legal claims, compliance or account closure.
• Legal acceptance, support and security records may be retained for as long as reasonably necessary for the purpose for which they were created or to meet legal obligations.

Deletion from active NimbleArk storage does not necessarily mean immediate removal from every infrastructure backup or security log. Copies may remain temporarily according to the applicable provider's backup, security and legal-retention arrangements.

NimbleArk relies on different lawful bases depending on the information and purpose. The main bases are:

• contract, where processing is necessary to create and operate your account, run the assessment you request, provide saved history or other service functions you choose;
• legitimate interests, where processing is reasonably necessary to secure, maintain and improve the service, prevent misuse, provide support, protect legal rights or process incidental personal information within assessment content, balanced against the rights of the people concerned;
• legal obligation, where information must be processed or retained to comply with applicable law; and
• consent, where the law requires a separate choice, for example if optional analytics or marketing technologies are introduced in future.

Assessment content is necessary to run an assessment, but identifying information is not. Where another person's personal information appears in content you submit, you are responsible for ensuring that you are entitled to provide it.

NimbleArk relies on third-party services to operate the application. Current provider categories include:

• Lovable: application infrastructure, Lovable Cloud, authentication-related infrastructure and AI Gateway functionality.
• Supabase infrastructure used through Lovable Cloud: database and authentication technology supporting the application.
• OpenAI: AI model processing through Lovable's AI Gateway.
• Google: where you choose Google as your sign-in method.

Providers may also use their own subprocessors. Lovable publishes current subprocessor information through its Trust Centre and legal documentation. Provider lists and infrastructure may change over time, and this policy will be updated where a change materially affects how NimbleArk processes personal information.

Provider information: Lovable Privacy Policy Lovable subprocessors OpenAI enterprise privacy Google Privacy Policy

NimbleArk's primary application database is currently configured in the AWS eu-west-1 region in Ireland through Lovable Cloud. That does not mean every part of the service is processed only in Ireland.

AI inference, security logs, support systems, backups or other provider processing may occur in the United Kingdom, European Economic Area, United States or other countries in which relevant providers or subprocessors operate. Lovable's current terms state that, unless expressly agreed otherwise, it does not guarantee that data sent through the Platform or AI Gateway will be processed or stored in a particular country or region.

Where UK personal data is transferred internationally, the relevant provider and contractual arrangements are expected to use applicable transfer mechanisms or safeguards where required by law. The exact provider and contractual position may depend on the NimbleArk subscription and service configuration in force at the time.

NimbleArk uses access controls, encrypted network connections, authentication controls and database permissions designed to restrict access to user data. Owner and administrator accounts may be required to use two-step verification.

Authentication credentials are handled through authentication infrastructure rather than being stored by NimbleArk as plaintext passwords. Access to saved application data is restricted through application and database controls.

No online service can guarantee absolute security. NimbleArk is responsible for configuring and using its chosen services appropriately, while infrastructure providers are responsible for the security of the systems they operate within their respective services.

NimbleArk currently uses browser storage that is necessary for functions such as authentication, session security, preferences, unfinished assessments and guest usage controls. No analytics, advertising, behavioural-tracking or marketing technology is currently active.

More information is available in the NimbleArk Cookie Policy.

Depending on the circumstances and the lawful basis involved, UK data protection law may give you rights to access personal information, correct inaccurate information, request deletion, restrict processing, object to processing, receive certain information in a portable format and withdraw consent where processing is based on consent. These rights are not absolute.

To make a privacy request, email: thenimbleark@gmail.com

Where the feature is available, you can delete individual saved assessments through NimbleArk. Deleting an assessment removes it from active application storage, subject to temporary provider backups, security logs or legally required retention.

Deleting one assessment does not automatically delete separately stored account information, legal acceptance records, support correspondence or other records that have a different purpose or retention period.

To request deletion of your account and associated account data, contact thenimbleark@gmail.com. Some limited information may still be retained where reasonably necessary for legal obligations, security, fraud prevention or legal claims.

NimbleArk uses automated and AI-assisted processing to produce communication assessments. The assessment is advisory information provided to the user. NimbleArk does not use the assessment to make a decision about you that produces legal or similarly significant effects. You decide what to do with the findings.

Communication submitted to NimbleArk may contain information about someone other than the user. Because identity is not required for the assessment, you should anonymise or remove that information before submission wherever possible.

You are responsible for ensuring that you have an appropriate basis to submit information about another person. Do not assume that removing a name is enough if the surrounding details still identify them.

Submitting unnecessary personal or sensitive information, or information that you do not have the right or lawful authority to provide, may also constitute a breach of the NimbleArk Terms of Use and may result in action under those Terms.

If you have a concern about how NimbleArk handles personal information, contact thenimbleark@gmail.com.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

Information Commissioner's Office

NimbleArk may update this Privacy Policy when the service, providers, data flows or legal requirements change. The current version and revision date will be made available through NimbleArk. Where a material change affects how existing personal information is used, users will be informed where required.