Privacy Policy

This Privacy Policy explains how Nimble Station collects, uses, discloses, keeps, and protects personal information through the Services. It applies to users, people considering the Services, people in a transaction, Storage Plan holders, support contacts, website visitors, and people recorded near participating lockers where Nimble Station controls the processing.

This Policy is part of the Terms. A current copy is in the app, and you can get one by emailing privacy@nimblestation.com, without completing a paid transaction. We will also post a standalone copy on our website when that page is live. Until then, email is the public path. App Store privacy labels and Google Play Data Safety disclosures should describe the same current practices. If a summary differs from this Policy, this Policy controls, and we will correct the summary.

We collect only information reasonably needed for the purposes below:

• Account and identifiers: name, username, email, phone, mailing address, age confirmation or date of birth, profile photo, settings, and, for a permitted minor, the account-holding adult’s contact information and consent record.
• Listings and transactions: listings, agreed prices, drop-off and pickup records, messages, reviews, claims, returns, and dispute evidence.
• Payments to Nimble Station: billing address, processor token, fees, refunds, and chargeback records. Full card numbers are handled by our payment processor, currently Stripe, and are not stored by us.
• Items and lockers: descriptions, photographs or video you provide, condition notes, locker identifiers, access times, door logs, and sensor and error events.
• Device and network: IP address, approximate region derived from IP, device identifiers, operating system, app version, and crash, usage, and security logs.
• Communications: support requests, surveys, reports, and call recordings where that is lawful and after any required notice.
• Premises security: camera images from participating locations where cameras are used and appropriate notice is posted.
• Inferences: fraud, risk, account-security, and reliability signals drawn from the categories above.
• Seller verification required by law: for a seller covered by the INFORM Consumers Act or a similar law, the identification, tax, bank or payee, and contact information the law requires. We tell the seller before we collect it, and we limit use to compliance, safety, and fraud prevention.

You may update your name, handle, phone number, and profile picture at any time from Settings > Edit Profile.

Nimble Station does not use facial recognition or other biometric measurements, and does not make people machine-scannable. Camera images may not be used to create face templates, biometric identifiers, or biometric matches. We will not begin any biometric collection or use unless the company first changes this decision in writing and updates this Policy before that use begins.

We collect information from you; your device and browser; connected lockers and participating locations; other users in a transaction; payment, communications, security, analytics, and support providers; public sources; and authorities or business partners, as the law permits.

We use personal information to create and manage accounts; verify that users are at least 18; provide listings, transfers, lockers, storage, returns, and support; charge and refund our fees; authenticate users; prevent fraud, theft, counterfeit items, abuse, and unsafe access; send service, security, transaction, default, legal, and optional marketing messages; operate, analyze, debug, and improve the Services; enforce agreements; resolve disputes; protect people, property, and rights; meet tax, sanctions, recordkeeping, legal-process, and other legal duties; and establish or defend legal claims.

We may use aggregated or de-identified information for lawful purposes. We do not try to re-identify it, except to test de-identification safeguards or as the law allows.

We may disclose information to:

• service providers, including our payment processor (currently Stripe) and hosting, fraud-prevention, communications, analytics, support, and security vendors, under contract limits;
• another person in the transaction, when that is reasonably needed to complete, document, return, or resolve the transaction;
• Location Partners, for site access, operations, security, and incident response;
• authorities, in response to valid legal process, or when reasonably necessary to report suspected crime, address an emergency, or protect rights and safety;
• professional advisers, insurers, auditors, and financing sources, subject to appropriate duties;
• a buyer, successor, or other participant in a merger, financing, reorganization, or sale, subject to appropriate protection;
• rights holders, when reasonably necessary to investigate counterfeit or infringement reports and permitted by law;
• anyone you direct us to, and the public when you choose to publish a listing or a review.

Door logs, access times, and camera images may be processed by service providers in these categories: locker and access-control operations, application hosting, and security monitoring. Current examples include Smiota for locker operations and Flywheel for application services. We may change providers within a category without changing this Policy.

We may preserve records while we wait for legal process. Where the law allows it, and where notice would not impede an investigation or create risk, we will try to notify an affected user.

Our website and app may use cookies, local storage, and software development kits for essential operation, security, preferences, and first-party measurement. Browser settings may control cookies. Device settings control camera, photos, notifications, and any optional permission. Denying an optional permission may limit the feature that needs it. It does not block unrelated features where a practical alternative exists.

You may unsubscribe from marketing email, or reply STOP to marketing texts. Operational or legally required messages may continue while you have an account or an open obligation.

We do not sell personal information for money. We do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising as state privacy laws define those terms. Because we do not do those things, an opt-out is not needed now.

If those practices change, we will update this Policy before they begin, provide the required notice and opt-out controls, and honor recognized universal opt-out mechanisms, such as Global Privacy Control, where they apply.

We keep information only as long as reasonably necessary for the purposes described. We consider how long the account or transaction lasts; whether property, a Storage Plan, a claim, a dispute, or an investigation is still open; fraud and security needs; tax, accounting, payment-network, lien, and recordkeeping duties; applicable limitation periods; and legal holds.

When information is no longer needed, we delete it or de-identify it. We may keep aggregated information that cannot reasonably identify a person. Backups may remain for a limited time until they are overwritten on the normal schedule.

You may update your name, handle, phone number, and profile picture at any time from Settings > Edit Profile. To delete an account, go to Settings > Delete My Account. You may also use any deletion path published on our website, or contact privacy@nimblestation.com. We delete associated content and personal information unless we reasonably need to keep it for an open matter, security or fraud prevention, legal compliance, or to establish or defend a claim. We explain material retention that applies to a request, and we ask service providers to delete covered information where appropriate.

Depending on where you live, and whether the law applies, you may have the right to confirm whether we process your information; access it; correct inaccuracies; delete it; get a portable copy; opt out of targeted advertising, sale, or certain profiling; limit certain uses of sensitive data; and appeal a denied request. You will not be treated differently for exercising a right.

Send a request or an appeal to privacy@nimblestation.com. We verify requests in proportion to the request, and we respond within the time the law allows. An authorized agent may act where the law permits, subject to verification. If an appeal is denied, we provide any further complaint method the applicable law requires.

California residents may also contact the Complaint Assistance Unit of the Division of Consumer Services, California Department of Consumer Affairs, 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or (800) 952-5210.

Once per calendar year, California residents may request information about personal information we disclosed to other businesses for their own direct marketing in the preceding calendar year (Civil Code § 1798.83, “Shine the Light”). We do not currently disclose personal information to other businesses for their own direct marketing. Email privacy@nimblestation.com to make that request.

The Services are not directed to children under 13, and we do not knowingly collect their personal information. Contact privacy@nimblestation.com if you believe a child under 13 gave us information.

For a person aged 13 through 17 using an account held by a parent or guardian, we process the adult’s contact information and consent record, and information created through the permitted user’s activity. The adult may review, correct, or request deletion of that information, or withdraw consent. Withdrawal closes the account after the wind-down described in Part I.

We use administrative, technical, and physical safeguards appropriate to the information, including access controls, authentication, encryption in transit, logging, and vendor management. No system is perfectly secure. Protect your credentials, and report a suspected compromise promptly. If an incident occurs, we investigate and give any notice the law requires.

Automated rules or models may flag fraud, account takeover, prohibited items, or unsafe activity, and may lead to verification, review, or a temporary restriction. We do not make a decision that produces a legal or similarly significant effect solely by automated means without a path to human review where that is required. Contact support to contest a decision.

The Services are intended for the United States. Information may be processed in U.S. states where we and our providers operate. If future international processing requires an additional notice or a transfer safeguard, we will provide it before that processing begins.

We may update this Policy for the future. We post the effective date and give reasonable advance notice of a material change, with consent where the law requires it.

Privacy contact: Nimble Station, LLC, Attn: Privacy, 1329 Alum Spring Road, Suite 102, Fredericksburg, Virginia 22401. privacy@nimblestation.com.