1. Information We Collect

We collect the following categories of information:

• Account Information: Your name, chosen 9-digit nmbr, password (hashed), and profile picture.
• Communication Content: Chat messages, email messages, call transcripts, and social feed posts you create.
• Call Data: Call history, duration, and audio transcriptions generated during voice and video calls. Call transcripts are encrypted at rest using the same AES-256-GCM encryption as chats and emails.
• AI-Generated Data: Insights, facts, tasks, reminders, events, and suggestions extracted by AI from your communications.
• Media Content: Photos, videos, and AI-generated stickers you create or share.
• Device & Session Information: Device type, browser, login timestamps, and session data for security monitoring.
• Usage Data: Feature usage patterns to improve the service.

2. How We Use Your Information

We use your information for the following purposes:

• Providing and maintaining the nmbr communication service (calls, chats, emails, feeds).
• AI analysis of your communications to extract insights, facts, tasks, reminders, and events about your contacts.
• Real-time call transcription and AI-powered suggestions during calls, chats, and emails.
• Powering the Ask nmbr AI assistant to answer questions about your contacts and conversations.
• Generating smart reply suggestions and contextual coaching tips.
• Delivering push notifications for incoming calls, messages, and activity.
• Security monitoring including login alerts, device trust verification, and suspicious activity detection.
• Improving the service and developing new features.

3. AI Processing & Third-Party Services

nmbr uses third-party AI services (currently OpenAI) to process your communications for analysis, transcription, and suggestions. When your data is sent to these services:

• Data is transmitted securely and used solely to generate responses for your account.
• Your data is not used to train AI models by nmbr or its third-party providers.
• AI-generated insights are stored privately in your account and are not shared with other users.
• Call audio segments are transcribed and then discarded; only the text transcripts are retained.
• AI processing occurs in-memory only — your encrypted content is decrypted for the duration of the analysis and is never written to disk in unencrypted form. After processing, results are encrypted before storage.

nmbr uses LiveKit Cloud infrastructure for real-time audio and video call connectivity. Call media is routed through LiveKit's servers to ensure reliable connections. LiveKit processes media streams in transit but does not store or retain your call audio or video content.

4. Data Security & Encryption

We implement robust security measures to protect your data:

• Encryption at Rest: Chat messages, email content, and call transcripts are encrypted using AES-256-GCM before being stored in our database.
• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS/HTTPS.
• Password Security: Passwords are hashed using bcrypt and never stored in plain text.
• Two-Factor Authentication: Optional 2FA adds an additional layer of protection.
• Device Trust & Login Monitoring: We track login sessions and alert you to unrecognized devices or suspicious activity.
• reCAPTCHA Protection: Bot protection is used during registration and login to prevent automated attacks.

nmbr employees do not have access to your encryption keys and cannot read your messages, emails, call transcripts, or other encrypted content. Access to encryption infrastructure is restricted to automated systems only.

Please note: nmbr uses server-side encryption, not client-to-client end-to-end encryption. This means your data is encrypted on our servers, but it is decrypted in-memory for AI processing. Decryption occurs only momentarily during analysis and content is never stored unencrypted on disk. No method of electronic transmission or storage is 100% secure.

5. Social Feed & Content Visibility

Content you post to your social feed (photos, videos, text posts) is visible to your contacts. Feed posts are analyzed by AI to extract insights, which are stored privately in your account. You can delete your feed posts at any time.

6. Push Notifications

If you enable push notifications, we store a push subscription token associated with your device. This token is used solely to deliver notifications for incoming calls, messages, emails, and other activity. You can revoke notification permissions at any time through your browser or device settings.

7. Profile Pictures & Media Storage

Profile pictures are resized, compressed, and stored in cloud object storage. Feed media (photos and videos) are also stored in cloud object storage. These files are associated with your account and are removed when you delete the corresponding content or your account.

8. Information Sharing

We do not sell your personal information. We only share your information in the following circumstances:

• With third-party AI services for communication analysis and transcription (as described in Section 3).
• With third-party infrastructure providers for call connectivity.
• To comply with legal obligations or respond to lawful requests.
• To protect our rights, safety, and the safety of our users.

9. Your Rights

You have the right to access, update, or delete your personal information at any time through your account settings. You can manage active sessions, change your password, enable or disable 2FA, and control your privacy settings (who can send you contact requests). You may also request a copy of your data or ask us to restrict processing.

10. Data Retention

We retain your data for as long as your account is active. When you delete your account, it enters a 30-day recovery window during which support can restore it on request — your data is preserved and your nmbr is held during this period. After 30 days, we permanently remove your personal information, communications, AI-generated insights, and media from our systems. Your nmbr may then become available for other users after a cooling-off period. When a nmbr is reassigned, all previous account data is permanently and irreversibly deleted — the new holder has no access to any prior user's data, contacts, or conversation history. Some data may be retained in encrypted backups for a limited period before being purged.

11. Children's Privacy

nmbr is not intended for users under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete such information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of nmbr after changes are posted constitutes your acceptance of the updated policy. We will notify you of significant changes through the app or via your nmbr email.

13. Contact

For privacy-related questions or concerns, please contact us at support@nmbr.ai or reach us directly through nmbr Support (900-900-900).