About this page. Nummbas is operated by Implemit Pty Ltd ("we", "us"). This page summarizes how we protect your data today. If a translation differs, the English version controls.
Key points
- Encryption. Your data is encrypted in transit to our servers and at rest in our database.
- Who can see your data. You, your team, authorized Nummbas staff, our providers, and anyone you share a link with.
- Where your data is. Our servers and database are in Singapore, hosted by Render. Some providers handle data in other countries.
- AI. We do not use your data to train AI models. Our AI features use models from Anthropic and Google.
- Your data stays yours. We do not sell it. If you close your account, we delete it after 90 days, with the exceptions in section 6.
- Security reports. Email cyberteam@nummbas.com.
Encryption
What is encrypted. Your data is encrypted in transit between your browser or the mobile apps and our servers, and between our application and its database. Our database and its backups are encrypted at rest, and we separately encrypt the access tokens for the services you connect. We store passwords only in a scrambled form that cannot be reversed.
Signing in and connecting services
Signing in. Two-factor authentication, a code sent by email or from an authenticator app, is turned on when you sign up or accept an invitation. You cannot turn it off yourself, but our staff can if you are locked out. If you open Nummbas from your BigCommerce control panel, BigCommerce's sign-in is used instead.
Connecting a service. You connect a store or other service through the provider's own sign-in and approval page, or with an API key or access token that you create there. Banks connect through Plaid, which handles the bank sign-in. We use your connections mainly to read data.
Disconnecting. You can disconnect a service at any time. We then delete the data we synced from it straight away, with four exceptions. Shipping label records are deleted about 30 days later. Stock records you created in Inventory, such as deliveries, counts and purchase orders, stay, because they are your business's own records. If you use Nummbas Books, our bookkeeping feature, it keeps the records it has already captured. Answers, daily briefs and insights already written from the data are not removed.
Who can see your data
| Who | What they can see |
|---|---|
| You and your team | Your account, according to each person's role: owner, admin, member or accountant. |
| Authorized Nummbas staff | Account details in our support tools. Staff can also make changes there, such as ending sessions or closing an account, and these are logged. Staff with our highest admin role can open your account to troubleshoot. Each access is logged, lasts up to 15 minutes and lets staff make most of the changes the owner can. Staff who run our systems can reach the database and logs. |
| Our providers | The data each needs to do its job. Our Privacy Policy lists them. |
| People you share with | The dashboard sections in a share link you create. Anyone with the link, and its password if you set one, can open it until it expires, you revoke it or the account is closed. |
Keeping businesses separate. Checks in our application and database limit each signed-in user to their own business's records. We do not share your business data with other customers. If you turn on benchmark sharing, only comparisons that combine at least 20 businesses include your figures.
Hosting and backups
Backups and monitoring. Render backs up our database and keeps backups for 7 days. We monitor Nummbas for errors and performance.
AI data handling
What we send. Nummbas-FO and our other AI features use models from Anthropic and Google. To answer, we send the provider your question, the conversation so far, any file you attach and the business data needed, which can include names.
Data ownership and deletion
Closing your account. Cancelling your plan does not close your account. When the account owner closes it, sign-in access ends straight away for you and your team, and your share links stop working. You can ask us to restore the account for 90 days. After that we delete it, with the exceptions below.
Reporting a security issue
If something goes wrong. We tell you without undue delay if a breach affects your data.