Privacy Policy
NimblScale Strategy Builder
1. Who we are
NimblScale Strategy Builder ("NSB", "the Service") is operated by NimblShift Consulting Inc. ("we", "us"), a corporation registered in Alberta, Canada.
Questions about this policy, or requests relating to your information, go to harold@nimblshift.com.
Contact: Harold Simons
1727 27th Street SW, Calgary, AB T3C 1L6
NSB is a business tool. The information you enter is about your company, but some of it — your name, your email address, and anything identifying you or your staff — is personal information, and this policy covers it.
2. What we collect
Account information. Your email address, and authentication data held by our identity provider. You create this when you sign up.
Business information you enter. Everything you type into the diagnostics and the five strategy steps: revenue and margin figures, market and competitor descriptions, sales pipeline data, capability assessments, initiatives, owners, target dates, and free-text descriptions of your business. This is the substance of the Service and it is stored against your account.
Uploaded documents. See section 4 — this works differently from the rest and deserves its own reading.
Analysis we generate. The diagnostic outputs and reports the Service produces from your inputs, stored against your account so you can return to them.
Payment information. If you subscribe, card entry happens on Stripe's own checkout pages. We never see or store card numbers, expiry dates, or billing addresses. We store only a Stripe customer identifier, a subscription identifier, your subscription status, and the price plan.
Technical information. Standard server and platform logs generated by our hosting providers in the course of serving requests.
We do not run Google Analytics, Meta pixels, or any other third-party tracking or advertising script. There are none in the Service.
3. Why we use it
To provide the Service: to run the diagnostics, generate your reports, keep your work between sessions, authenticate you, and administer your subscription. To send you transactional email — confirmation, password reset, and service notices. To keep the Service secure and working, and to meet our legal obligations.
We do not sell your information. We do not share it for advertising. We do not use your business content to market to you beyond the Service itself.
4. Uploaded documents — read this section
When you upload a financial or business document so the Service can pre-fill a form, three things happen, and we want to be precise about each.
The document is sent to our AI provider. The complete file — not an extract, not a summary — is transmitted to Anthropic for processing, so the values can be read out of it. Under our commercial agreement with Anthropic, your content is never used to train their models, and inputs and outputs are automatically deleted from their systems within 30 days. Content flagged by their automated safety systems may be retained for up to two years.
We do not keep the file. The document itself is held only for the length of the extraction request. We do not store the file, and we do not store its full text.
We do keep what was extracted, and we keep it even if you say no. For each field, we retain the value the system suggested, the value you confirmed or edited, the name of the source document, and a short verbatim excerpt of up to 500 characters showing where the value came from. This includes fields you decline. If the system suggests a figure and you reject it, the suggested figure and the excerpt remain on the extraction record. They are not used in your analysis, but they are retained.
We say this plainly because the alternative — implying that declining a field erases it — would be untrue.
5. Where your information goes
We use service providers to operate NSB. Each receives only what it needs.
| Provider | What it handles | Location |
|---|---|---|
| Anthropic | AI processing: your entered business content, extracted figures, diagnostic outputs, and uploaded documents | United States |
| Supabase | Database and authentication: your account and all stored business content | United States |
| Vercel | Application hosting and request processing | United States |
| Stripe | Payment processing and card handling | Global |
| Resend | Delivery of transactional email | United States |
One thing that does not leave: when a later report draws on an earlier one, only a short fingerprint of the earlier report is passed along, never its contents.
Cross-border processing. Some of these providers process data outside Canada. Information held outside Canada may be accessible to foreign courts and law enforcement under the laws of that country.
6. How long we keep it
We keep your account and the business content you enter for as long as your account exists.
There is currently no automatic deletion. Nothing in the Service expires, is purged on a schedule, or is removed after a period of inactivity. Content you have entered remains until you delete it or ask us to.
7. Your choices and your rights
You can delete, yourself: any strategy you have created, and any diagnostic you have run.
You must contact us to remove: your account, and any extraction records from document uploads. There is no self-service control for either. Write to harold@nimblshift.com and we will action it manually.
Access and correction. Under PIPEDA and Alberta's PIPA you may ask what personal information we hold about you, ask us to correct it, and challenge our handling of it. Write to harold@nimblshift.com. We will respond within 30 days.
Complaints. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner of Alberta.
8. Security
Your content is tied to your account. Every request to read or write data is verified against your login before anything happens, and the user identity is taken from the verified session, never from the request itself. Database-level access rules are enabled on every table.
Payment card data never reaches our systems.
No system is perfectly secure, and we do not claim otherwise. If a breach affects your information and creates a real risk of significant harm, we will notify you and the relevant Commissioner as the law requires.
9. Cookies and browser storage
The Service stores a small amount of data in your browser to keep you signed in and to hold form drafts between pages. We do not set any advertising, analytics, or tracking cookies, and we do not use any third-party tracker.
The demo booking link on our site takes you to Calendly, a third party. Once you follow it, their privacy policy applies, not ours.
10. Children
NSB is a business tool intended for company owners and leaders. It is not directed to anyone under 18, and we do not knowingly collect information from them.
11. Changes
We may update this policy. If a change materially affects how we handle your information, we will tell you by email or in the Service before it takes effect. The date at the top shows when this version was published.
12. Contact
NimblShift Consulting Inc.
1727 27th Street SW
Calgary, AB T3C 1L6
harold@nimblshift.com