This Privacy Policy explains how Nibl (ABN [ABN to be added]) ("Nibl", "we", "us") collects, uses, holds and discloses personal information when you use link.nibl.me and our related services (the "Service"), whether you have an account or are visiting someone's Nibl page.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and - where they apply to you - other privacy laws such as the EU and UK General Data Protection Regulation ("GDPR") and US state privacy laws including the California Consumer Privacy Act ("CCPA").
1. Two roles: our data and page owners' data
- For account holders and our own website, we decide how your information is used - we are the "controller" (or equivalent).
- For visitors to a Nibl page, the page owner decides what to collect and who sees what. For that information, the page owner is responsible as controller and we process it on their behalf. Contact the page owner (through the page's Privacy link) about how they use it. We still protect it as described here.
2. What we collect
Account information: name, email address, a one-way hashed copy of your password, two-step sign-in settings, page name and address, plan and billing status, and your settings.
Your content: links, text, images, files, logos and anything else you add, including information about other people that you choose to add (for example, people you invite).
Sign-up and sign-in information: IP address, approximate location derived from it (country, region, city), browser, operating system, device type, language, date and time, how you arrived (for example the referring site, campaign tags, or the Nibl page that sent you), and whether a sign-in succeeded.
Visitor information on Nibl pages: a random device identifier stored in a cookie, pages and items opened, links clicked, referring site or source link, approximate location, browser and device type, language, and timestamps. If you enter an access code, accept an invite, verify an email address, send feedback or request access, we also record that, and the page owner may see your name or email.
Communications: messages you send us or page owners through the Service, and emails we send you (including whether they were delivered).
Payment information: if you buy a paid plan, our payment processor collects your card details. We receive only limited information such as the last four digits, expiry, and payment status.
Safety and abuse information: records of blocked content, rate-limit triggers, reports, verification evidence (for example work email domains or DNS records), and moderation decisions.
We do not knowingly collect sensitive information (such as health, religious or political information). Please do not add it to your page unless you have the right to.
3. How we collect it
Directly from you; automatically when you use the Service (through cookies, server logs and similar technologies - see our Cookie Policy); from page owners (for example when they invite you); and from service providers (for example IP location lookups and payment processors).
4. Why we use it
We use personal information to:
- provide, operate, maintain and secure the Service, including your page and its access rules;
- create and manage accounts, and verify identity, brand ownership and authority;
- show page owners analytics about their pages;
- prevent, detect and respond to fraud, abuse, spam, impersonation, security incidents and breaches of our Terms;
- send service messages (sign-in links, security alerts, invites, receipts) and, with your consent where required, product news;
- understand how the Service is used and improve it;
- comply with law, respond to lawful requests, and establish, exercise or defend legal claims; and
- for any other purpose you consent to, or that is related to the above and that you would reasonably expect.
Legal bases (GDPR): performance of our contract with you; our legitimate interests in running a safe, reliable and improving service (balanced against your rights); compliance with legal obligations; and consent (for non-essential cookies and marketing), which you may withdraw at any time.
5. Who we share it with
We do not sell personal information and we do not share it for cross-context behavioural advertising.
We disclose personal information only:
- to page owners, about visits to their pages, as described above;
- to service providers who help us run the Service - including hosting (Hostinger), email delivery, IP-to-location lookup (ipwho.is), payment processing, and error monitoring - who may only use it to provide services to us;
- to professional advisers, insurers and auditors;
- to law enforcement, regulators, courts or other parties where we believe it is required or permitted by law, or necessary to protect the rights, property or safety of Nibl, our users or the public;
- in a business transaction, such as a merger, acquisition, financing or sale of assets, subject to confidentiality; and
- with your consent or at your direction.
6. Overseas disclosure
Some of our service providers store or process information outside Australia, including in the United States, the European Union and other countries where their servers are located. Where required, we take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles, and for transfers from the EU/UK we rely on appropriate safeguards such as standard contractual clauses.
7. How long we keep it
We keep personal information for as long as your account is active or as needed to provide the Service, and afterwards for as long as reasonably necessary for the purposes above - including security, dispute resolution, legal and tax obligations, and backups. Visitor analytics are kept for the period set by the page owner's plan. When information is no longer needed we delete or de-identify it.
8. Security
We use reasonable technical and organisational measures to protect personal information, including encrypted connections, hashed passwords, optional two-step sign-in, access controls and audit logs. No system is perfectly secure. If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and other regulators where required.
9. Your rights and choices
You can, at any time:
- access and download your account information from Settings, or ask us for a copy;
- correct information that is inaccurate, out of date or incomplete;
- delete your account from Settings, or ask us to delete information;
- as a visitor, download or delete what a page has recorded about you from that page's Privacy link;
- withdraw consent to non-essential cookies through the cookie notice, and to marketing by using the unsubscribe link;
- if GDPR applies, object to or restrict certain processing, request portability, and complain to your local data protection authority;
- if a US state law applies, request to know, delete or correct personal information and opt out of sale or sharing (we do not sell or share). We will not discriminate against you for exercising these rights.
We may need to verify your identity before acting on a request, and some information may be kept where the law allows or requires (for example, to prevent fraud or comply with legal obligations). We aim to respond within 30 days.
10. Children
The Service is not directed to children under 16 and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
11. Anonymity
You may visit public Nibl pages without telling us who you are. You need to give us your name and email address to create an account, and some pages require you to verify an email address to see certain content.
12. Changes to this policy
We may update this Privacy Policy at any time. The date at the top shows when it was last updated. If we make a significant change we will tell account holders by email or a notice in the Service.
13. Contact and complaints
Contact our privacy officer at hello@link.nibl.me or Sydney NSW, Australia. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au), or to your local data protection authority if you are in the EU or UK.