Privacy Policy

Last updated October 2026

1. Scope

This policy covers nymeria.io and the Nymeria API. It applies to two distinct groups of people, and the distinction matters:

Customers — businesses that call our API to enrich records they already hold. Our relationship with you is governed by this policy plus the Terms of Service and, where applicable, a Data Processing Addendum.
Data subjects — the people whose professional profiles exist in our database, gathered from public and licensed sources. Most of this policy addresses them.

2. Information we collect

About data subjects:

Professional data: name, job title, employer, work email, professional skills, and public social profile URLs.
Contact data: business and personal email addresses and phone numbers, obtained from public sources and licensed data suppliers, and verified where possible.
Inference data: confidence scores and match metadata produced during enrichment.

About customers:

Account data: name, work email, company, billing details (processed by our payment provider; we never see full card numbers).
Usage data: API call logs, request parameters, and error diagnostics retained for security and billing purposes.

3. How we use it

To operate and improve the enrichment service, including match quality tuning.
To bill accurately, enforce rate limits, and detect abuse.
To communicate about your account or incidents that affect your integration.
To comply with legal obligations, including opt-out and deletion requests under the CCPA/CPRA.

We do not sell customer account data. We do, however, supply data to customers. That is our business, and data subjects can opt out via our Do Not Sell page.

Data we don't knowingly process: we do not collect or return special-category data — health, biometric, precise geolocation, genetic, or similarly sensitive classifications — as part of enrichment. If we ever identify such data in a source feed, we drop it at ingestion.

Record data is disclosed to customers as the product itself. Beyond that, we share data only with:

Service providers — hosting, payment processing, and email delivery, bound by contract to process only on our instructions.
Legal authorities — where compelled by law, warrant, or court order, and only to the extent required.

We do not transfer data to third parties for their own marketing purposes.

5. Retention

Customer account and usage data is retained while the account is open and for two years after closure for audit and legal purposes. Data subject records are retained until superseded by fresher data, or deleted upon a verified request or opt-out suppression.

6. Security

Traffic is encrypted in transit (TLS) and at rest. Access to production data is limited to personnel who need it, logged, and reviewed.

7. Data rights

All data subjects have the right to:

Know what personal information we hold about them.
Delete their personal information, subject to legal exceptions.
Opt out of the sale or sharing of their personal information — do that here.
Correct inaccurate personal information we hold.
Non-discrimination for exercising any of these rights.

Submit requests via our Do Not Sell page or privacy@nymeria.io. We respond within 30 days of receipt, extendable once by 30 days for complex requests as the law allows.

8. Children

Our data describes working professionals, and our service is not directed at children. We do not knowingly collect data on anyone under 16. If we learn a record belongs to a minor, we delete it.

9. Changes to this policy

We will post changes here and update the "last updated" date. Material changes affecting data subject rights will be announced on this page at least 30 days before taking effect.

10. Contact

Nymeria, LLC — privacy@nymeria.io. General inquiries: contact page.