Privacy statement

Last updated 10 October 2026

Nimbu Global Pty Ltd (ABN 68 642 716 452), trading as Nimbu Creative, Nimbu Connect and Nimbu Shield and referred to here as "we", "us" or "our", respects your privacy. This statement explains how we collect, use, share and protect personal information through our business system at proposals.nimbuops.dev, including our discovery form, proposals, quotes and pages for accepting services, and through our client hub, Nimbu Hub, at hub.nimbuops.dev.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

What we collect

Discovery form: your name, business name, email address and phone number; information about your business, your customers and your current website; what you want your new website to do; websites you like; your timing and budget; how you found us; and anything else you choose to tell us.
Discovery sessions: notes we make while discussing your project with you, such as your domain, hosting and email arrangements and the integrations you need.
Proposals, quotes and services you accept online: the options you choose, any comments you leave, and your acceptance details: your name (and for proposals, your position, company name, ABN and typed signature), the version of the terms you accepted, and the date and time of acceptance.
Technical information: your IP address, browser and device type, and the dates and times you open your proposal. We use this to protect the system and to keep a reliable record of acceptance.
Client hub sign-in: the email address you sign in with, when you sign in, and the IP address and browser used. Sign-in codes are stored only in a scrambled form and stop working after 10 minutes.
Requests and approvals in the client hub: what you send us through the hub, such as a request for a change to a service, a question about a service or a support request, with who sent it and when; and your approvals and comments on social media posts we prepare for you.
Payments: card and direct debit payments are taken by Stripe on its own secure pages, and we never receive or store your full card or bank account details. If you choose to save a card or bank account for ongoing services, Stripe keeps it, and we see only its type, the last four digits, its expiry date and what it pays for, so we can show it to you in the client hub and remind you before a card expires. If you pay by bank transfer, we receive the payment into our bank account with the details your bank sends with it, such as the account name and payment reference, and we use them only to match your payment to your invoice.

Please do not send us sensitive information, such as health information, through the discovery form or proposal comments. We do not need it to prepare a proposal.

How we use it

To respond to your enquiry and arrange a discovery session.
To prepare, send and follow up your proposal, including reminders before it expires.
To record your acceptance and send you a copy of the accepted proposal.
To take payments and issue invoices and receipts.
To charge ongoing services you have agreed to on their due dates, using the payment details you saved for them, and to tell you before any change to their price.
To look after the services we provide, such as your domains, hosting, email and IT support, including reminders before a domain you renew yourself expires.
To respond to requests you send us through the client hub.
To deliver your project and keep in touch with you while we work on it.
To let you sign in to the client hub and show you your projects, services, payment details, requests, reports, posts and invoices, and to keep the hub secure.
To keep business, accounting and tax records.
To protect our systems from misuse and fraud.

We contact you about your enquiry, your proposal and your project. We do not add you to marketing lists without your agreement, and we never sell personal information.

Who we share it with

We share personal information only as needed for the purposes above, with:

our team members who work on your enquiry or project;
service providers who run parts of the system for us: Cloudflare (hosting, security, database and file storage), SMTP2GO (email delivery), Stripe (payments), Xero (invoicing and accounting), Microsoft (Microsoft 365 and SharePoint, where we keep project records) and Anthropic (Claude, an AI assistant our team uses to help prepare proposals, content and reports; it works with the information our team gives it and does not contact you);
our professional advisers, such as our accountant or lawyers, where needed; and
government bodies, regulators or law enforcement where the law requires or allows it.

Information stored outside Australia

Some of our service providers store or process information outside Australia, including in the United States and other countries where they operate data centres. We choose established providers that commit to protecting the information they hold and take reasonable steps to make sure they handle it consistently with the Australian Privacy Principles.

How we protect it

The system uses encrypted connections. Only our team can reach the admin area, and signing in needs multi-factor authentication. Each proposal link is unique, hard to guess, expires on the proposal's validity date and can be cancelled by us at any time. Please do not forward your proposal link to people who should not see it.

How long we keep it

We keep accepted proposals, acceptance records, invoices and payment records for at least five years, as required for tax records, and longer while we have an ongoing working relationship with you. Enquiries and proposals that do not go ahead are kept only as long as reasonably needed and are then deleted or de-identified. Client hub sign-in records are kept for as long as you have access to the hub and for 12 months after. Requests you send through the client hub are kept while you are our client and for 12 months after, unless they form part of our business records.

Cookies

Our proposal pages do not use advertising or tracking cookies. Cloudflare may set cookies that are strictly necessary for security and bot protection, including on the discovery form.

When you sign in to the client hub we set one cookie that keeps you signed in. It is strictly necessary for the hub to work and is deleted when you sign out or after 30 days. Your choice of light or dark display is saved in your own browser and is not sent to us.

Accessing and correcting your information

You can ask to see the personal information we hold about you, or ask us to correct it, by contacting us using the details below. We will respond within a reasonable time, usually within 30 days. If we cannot give you access, we will explain why.

Questions and complaints

If you have a question or concern about how we have handled your personal information, please contact us first and we will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

Governing law

This statement is governed by the laws of Western Australia and the applicable laws of the Commonwealth of Australia.

Changes to this statement

We may update this statement from time to time. The current version is always on this page, with the date it was last updated.

Contact us

Nimbu Group (Nimbu Creative, Nimbu Connect and Nimbu Shield)
Email: create@nimbucreative.com
Phone: 08 6115 0345