Privacy Policy

Last updated: 30 July 2026

This Privacy Policy explains how personal data is processed when you use the Nabu website (nabu.im), create an account, and purchase or manage a Pro subscription. It should be read together with our Terms of Service & Public Offer.

1. Who is responsible for your data

Nabu is developed, owned and sold by Gavriil Grigoriev (the “Seller”), who acts as the controller of the limited personal data described below. For any privacy question or request, contact hello@nabu.im.

2. Local-first by design

Nabu runs on your computer. Your files, conversations, memory, and the work the assistant does stay on your device and are not uploaded to us. We never receive the content of your documents or chats. This policy covers only the account and payment data needed to operate the service, plus basic website data.

3. What we collect

Account data — your email address, used to create and identify your account.
Subscription & payment records — your plan, status, and payment entries (amount, currency, date, and the provider’s transaction/contract identifier), received from the payment provider. We do not receive or store your card or bank details.
Sign-in data — one-time email codes and session tokens that keep you signed in.
Website & technical data — essential browser storage (localStorage) to keep your session, and standard server logs (such as IP address and timestamps) needed to run and secure the site.

4. What we do not collect

Your files, prompts, or conversation content.
Your card or payment-instrument details (handled entirely by the payment provider).
Advertising or cross-site tracking data — we use no advertising or third-party tracking cookies.

5. AI providers you choose

Nabu is model-agnostic. When you configure a cloud AI provider, the content you send is transmitted to that provider under your control and its own privacy terms; we are not a party to that exchange and do not receive it. When you use a local model, nothing leaves your device.

6. Why we process your data

To create and operate your account and provide the Software.
To process payments and verify your Pro entitlement.
To send transactional email (sign-in codes, receipts, and essential service notices).
To secure the service and prevent abuse, and to comply with legal obligations.

We rely on the performance of our contract with you (the Terms), our legitimate interest in operating and securing the service, and your consent where the law requires it.

7. Service providers we use

We share the minimum data necessary with providers who process it only to provide their service to us:

Lava (lava.top) — payment processing.
Resend — delivery of transactional email.
Microsoft Azure — cloud hosting of the account backend and website.

Managed inference (Pro+ and Max only). If you subscribe to Pro+ or Max and choose the "Nabu managed" provider, the prompts and file excerpts your agent sends are relayed by our backend to TonWave (an OpenAI-compatible model aggregator), which forwards them to the model provider that serves your chosen model. We send your account identifier for metering, never your name or payment details. TonWave operates under a zero-retention arrangement for our traffic. This path applies only to the managed provider: on Free and Pro — where you use your own API key or a local model — your requests never touch our servers.

These providers may process data in countries outside your own; where that happens we rely on the safeguards they provide. We do not sell your personal data.

8. How long we keep it

We keep account data for as long as your account is active. Payment records are retained as long as required for accounting and legal purposes. You can ask us to delete your account data at any time (see section 9); we will do so except where we must keep certain records by law.

9. Your rights

You may request access to, correction of, or deletion of your personal data, and you may object to or withdraw consent for processing where applicable. To exercise any right, email hello@nabu.im; we will respond within a reasonable time. You also have the right to complain to your local data-protection authority.

10. Children

Nabu is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

11. Changes

We may update this Policy; the “Last updated” date reflects the current version. Material changes will be reflected here, and continued use after changes constitutes acceptance.

12. Controller & contact details

Controller and seller: Gavriil Grigoriev

Contact: hello@nabu.im