Vimbre Privacy Policy

1. Who we are

Vimbre is a service operated by Genade Global Services Ltd, a company registered in England and Wales with company number 15149519, whose registered office is at Office 10568 High Street North, London, England, E6 2JA ("we", "us", "our").

We are registered with the Information Commissioner's Office (ICO) under registration number ZB665494.

You can contact us about this policy at support@vimbre.com or by post at the address above. Our data protection contact is the Data Protection Lead at Genade Global Services Ltd, reachable at the same email address.

2. What this policy covers

This policy explains how we collect, use, share and protect personal information when you visit our website, create an account, or use Vimbre (the "Service"). It applies to visitors, account holders and people whose details appear in content that customers add to Vimbre.

We act in two different roles:

• As a controller. For information about you as a visitor, account holder, or customer contact (for example your name, email address, billing details and how you use the Service), we decide how and why the information is used.
• As a processor. For the notes, emails, chat messages, documents and other content that a customer or its team members add to Vimbre ("Customer Content"), the customer's organisation decides how and why it is used, and we process it on its behalf under our Terms and Conditions and our data processing terms. If you are a member of an organisation that uses Vimbre, your employer or organisation is the controller of Customer Content and you should read its privacy notice as well.

3. Information we collect

Information you give us

• Account details: name, work email address, password (stored in protected form), job title and organisation name.
• Profile and workspace details: team names, roles, handover recipients and settings you choose.
• Customer Content: text, notes, emails, chat messages and files you paste, type or upload, and the actions, decisions, tasks and handovers created from them.
• Messages you send us: support requests, feedback and survey replies.
• Billing details: billing name, address, VAT number and subscription choices. Card details are collected and held by our payment provider, not by us.

Information we collect automatically

• Usage and activity data: pages and features used, actions taken, timestamps, and event records that show how the Service is used and help us keep it secure.
• Device and connection data: IP address, browser type, device type, operating system, language and approximate location based on IP address.
• Cookies and similar technologies, described in section 11.

Information from others

• From your organisation: an administrator may invite you, create your account or add you to a team.
• From other users: a colleague may mention you in a note, task or handover.
• From service providers: for example payment confirmation from our payment provider.

We do not knowingly ask you to give us special category data (such as health, religion or trade union membership) or criminal offence data. Please do not add this kind of information to Vimbre unless your organisation has a lawful reason to do so and has told us in advance.

4. How we use information and our legal bases

Under UK data protection law we must have a lawful basis for each use of your personal information. We rely on the following.

• To provide the Service (contract). Creating and managing accounts, storing Customer Content, producing drafts and handovers, sending service messages, and providing support. Lawful basis: performance of a contract with you or your organisation. Where we act as a processor, we follow the customer's instructions.
• To take payment and keep financial records (contract and legal obligation).
• To keep the Service secure and prevent misuse (legitimate interests, and legal obligation where it applies). Monitoring for fraud, abuse, spam and security incidents.
• To improve and develop the Service (legitimate interests). Understanding which features are used so that we can fix problems and make Vimbre better. We use aggregated or de identified information wherever we can.
• To communicate with you (contract and legitimate interests). Service notices, security alerts, changes to our terms and replies to your questions.
• To send marketing (consent, or legitimate interests for business contacts where the law allows). You can opt out at any time.
• To comply with the law and respond to lawful requests (legal obligation).

We do not sell personal information. We do not use Customer Content for advertising.

5. Artificial intelligence features

Vimbre uses artificial intelligence to draft actions, decisions, summaries and handovers from content you provide. This is how it works in practice:

• Drafts only. AI output is a suggestion. Nothing created by AI is saved to your workspace until a person has checked it and chosen to keep it.
• On request. AI processing runs when you or a team member asks for it, and it counts against your organisation's plan allowance.
• Service providers. To produce drafts, the relevant text is sent securely to our AI service providers listed in section 6. They process it only to return the result to us. Under the commercial terms we have agreed with our AI provider, Customer Content sent to it is not used to train its models. We do not use Customer Content to train any models of our own.
• Accuracy. AI can make mistakes. You are responsible for checking drafts before relying on them or handing them over.
• No solely automated decisions. We do not make decisions about individuals that have legal or similarly significant effects using automated processing alone.
• Privacy controls. Items marked private are not included in handovers or shared views.

6. Who we share information with

We share personal information only as needed and only with:

• Your organisation. Administrators and other team members can see content, handovers and activity according to the permissions set in your workspace.
• Service providers (processors) that help us run Vimbre, under written contracts that require them to protect your information:
• Cloud hosting and database providers: the infrastructure providers that host and store the Service on our behalf. Details are available on request.
• AI service providers: Anthropic, PBC (United States), which produces AI drafts from content sent to it.
• Payment processing: Stripe Payments Europe Ltd and its affiliates.
• Email delivery and messaging: Brevo (Sendinblue SAS, France). Customer support and website analytics tools: only providers that are bound by written data protection terms.
• Professional advisers such as lawyers, accountants and insurers, where necessary.
• Authorities, where we are legally required to disclose information or need to protect rights, safety or property.
• A buyer or investor, if our business or assets are sold, merged or financed. We will tell you and the new owner must honour this policy.

A current list of our sub processors is available on request at support@vimbre.com.

Third party links. Our website and the Service may link to third party websites or services. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.

7. International transfers

Some of our providers are located, or process information, outside the United Kingdom. When we transfer personal information out of the UK, we make sure it is protected by an appropriate safeguard, such as a UK adequacy regulation, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with additional measures where needed. Our AI service provider, Anthropic, is based in the United States, and we rely on an appropriate transfer safeguard for that processing. You can ask us for details of the safeguards used.

8. How long we keep information

• Account information: for as long as your account is active, and for a limited period afterwards to meet legal, tax and dispute resolution needs.
• Customer Content: for as long as the customer's account is active. When something is deleted in Vimbre it is first held in a recoverable state for 30 days and is then permanently deleted from live systems. After an account closes, we delete or return Customer Content within 30 days unless the law requires us to keep it. Backups are overwritten on a rolling cycle of up to 35 days.
• Billing records: for six years to meet tax and accounting requirements.
• Support messages: for two years after the matter is closed.
• Usage and security logs: for up to 12 months.

When we no longer need information, we delete or irreversibly de identify it.

9. Security

We use technical and organisational measures designed to protect personal information, including encryption in transit, access controls based on need, separation of customer workspaces, activity logging, and regular review of our systems and suppliers. No system is perfectly secure. If a personal data breach affects your rights and freedoms, we will notify you and the ICO as the law requires. You can help by keeping your password private and telling us quickly if you suspect misuse of your account.

10. Your rights

Under UK data protection law you have the right to:

• be informed about how your information is used;
• access a copy of your personal information;
• correct information that is wrong or incomplete;
• ask us to erase your information in certain situations;
• ask us to restrict how we use your information in certain situations;
• receive your information in a portable format and ask us to send it to another organisation, where this applies;
• object to uses based on legitimate interests and to direct marketing at any time;
• withdraw consent at any time, where we rely on consent, without affecting earlier use; and
• not be subject to decisions based solely on automated processing that significantly affect you.

To use any of these rights, email support@vimbre.com. We may need to confirm your identity. We will respond within one month, and we may extend this by up to two further months for complex requests, telling you why. There is usually no charge.

If your request relates to Customer Content, we may pass it to the controller (your organisation) because it decides how that content is used.

11. Cookies and similar technologies

We use cookies and similar technologies for three purposes:

• Strictly necessary: to sign you in, keep your session secure and remember essential settings. These do not need consent.
• Preferences: to remember choices such as display settings.
• Analytics: Google Analytics helps us understand website and Service usage. Microsoft Clarity provides heatmaps and session insights on our public website and blog, excluding the signed-in workspace and account pages. We only load these tools if you accept optional analytics through our cookie banner.

You can change your choices at any time using the cookie settings link in our footer or through your browser settings. You can ask us for a list of the cookies we use at support@vimbre.com.

12. Children

Vimbre is for business use and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

13. Marketing

We may email you about Vimbre if you have agreed to receive it, or, where the law allows, if you are a business contact and the message is relevant to you. Every marketing email includes an unsubscribe link. You will still receive service messages that we need to send, such as security alerts and billing notices. Our social media accounts are run by us. When you interact with them, the relevant platform's privacy policy also applies.

14. Changes to this policy

We may update this policy from time to time. If we make a material change, we will tell you by email or in the Service before it takes effect. The date at the top shows when it was last updated.

15. Complaints and contact

If you have a concern, please contact us first at support@vimbre.com and we will do our best to put it right. You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline: 0303 123 1113. Website: ico.org.uk.

Genade Global Services Ltd · Company number 15149519 · Registered in England and Wales · Registered office: Office 10568 High Street North, London, England, E6 2JA