Privacy Policy
Last updated: 11 October 2026.
What we do with personal data when you visit nimbleplugins.com, buy a licence or ask for support. We sell worldwide; where a right depends on where you live, we say so.
The short version
We collect what we need to sell you a licence, keep it working and keep our books straight. We do not sell your data, we do not share it for advertising, and we do not profile you. Our plugins send no telemetry.
Who is responsible
NBS Rådgivning ApS, Strandhaven 134, 2665 Vallensbæk Strand, Denmark. CVR 46691849. We are the data controller. Reach us through our support page.
Because we are based in Denmark, your data is handled under European rules — which are stricter than most — wherever you happen to live.
What we collect, and why
When you buy
Name, email, billing address, country, and a VAT number if you give one. We need these to take the order, issue the licence, work out the right tax and produce an invoice.
We never see your card number. Payment goes to Stripe, who receive the card details directly. We learn only whether it worked and the last four digits.
When you have an account
Email, password (stored only as a hash, never readable), order history, licences and subscriptions.
When a licence checks for updates
A site with a Pro licence asks our server for updates. That request records the product, the version installed, the answer we gave, which licence it belongs to and the address of the site asking. We use it for exactly one thing: answering “why is my site not updating?” when you ask.
When you contact support
Whatever you write to us, and your email address.
When you just visit
Standard server access logs, including IP addresses, for security and troubleshooting. Cookies that the shop needs to work — your cart, your login. No advertising cookies.
What our plugins do not collect
They are self-hosted. No telemetry, no analytics, no tracking. Your customers, invoices, jobs and logs stay on your own server. We cannot see them and cannot retrieve them. If you want us to look at something during support, you have to show us.
Who else sees it
- Stripe — payment processing.
- Our hosting provider — they run the servers this site is on.
- Our email provider — to deliver order confirmations and support replies.
- Our accountant and the Danish tax authorities — for invoices, because the law requires it.
That is the whole list. No data brokers, no ad networks, no analytics resellers.
How long we keep it
- Invoices and order records: five years from the end of the financial year — Danish bookkeeping law, not our choice.
- Account and licence data: while you have an account.
- Update-check records: normally no more than twelve months.
- Support conversations: up to three years, so we can see what we told you last time.
- Server logs: weeks, not years.
Your rights, wherever you are
You can ask us for a copy of your data, to correct it, to delete it, or to send it somewhere else. Write through support and we answer within a month. We apply this to every customer, not only the ones whose law demands it.
Deletion has one limit we cannot move: invoices must be kept for five years. We delete everything else and tell you what had to stay.
In California you have the right to know what we collect, to have it deleted, and not to be discriminated against for asking. We do not sell or share personal information as those words are defined in the CCPA, so there is no opt-out to offer — there is nothing to opt out of.
In the EU, EEA and UK you also have the right to object to processing and to restrict it, and the right to complain to a supervisory authority. Ours is Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark — datatilsynet.dk.
Where your data lives
Our servers are in the EU. Some providers — Stripe among them — process data in the United States. Those transfers rest on the European Commission’s standard contractual clauses or an adequacy decision. In practice: your order data leaves Europe only to the extent payment processing requires it.
Children
Our products are for people running websites, and we do not knowingly collect data from anyone under 16. If you think a child has given us data, tell us and we will remove it.
Changes
If we change this in a way that matters, we say so here and update the date at the top.