📋 Client-Scoped Data Inventory and Flows

1. Purpose

This document describes how Nemu Inc. inventories client-scoped data, tracks data flows, and aligns with applicable privacy regulations.

Nemu Inc. maintains an internal understanding of:

Types of personal and customer data processed (e.g., contact information, account metadata).
Systems where data is stored:
- Supabase (databases and storage).
- Application logs where applicable.
- Google Workspace for support and operations.

High-level data flows include:

Nemu Inc. considers privacy obligations such as:

Privacy requirements are integrated into:
- Data classification and handling guidelines.
- Access control and incident response policies.
Data minimization and purpose limitation principles guide new feature design.

Maintaining Accurate, Complete, Timely, and Relevant Client Scoped Data:
Yes. Nemu Inc. maintains documented policies and processes to ensure client scoped data remains accurate, complete, timely, and relevant. Data is validated at collection, subject to integrity checks, and reviewed as part of operational workflows. Corrections and updates are processed promptly with full audit traceability.
Opt-Out of Targeted Advertising or Sale of Personal Information:
Yes. Individuals may opt out of any processing related to targeted advertising or the sale of personal information. Nemu does not sell personal data or engage in targeted advertising, but we maintain an opt-out mechanism via our Privacy Policy and support channels (support@mynemu.com), with requests logged, verified, and fulfilled in accordance with CPRA/CCPA requirements.
Limiting Secondary Use of Client Scoped Data:
Yes. Nemu Inc. has policies and processes that restrict any secondary use of client scoped data unless explicitly authorized by contract or required by applicable law. Data is used solely for its primary, intended business purpose unless further use is formally approved.
Support for Data Subject Access Requests (DSARs):
Yes. Nemu Inc. maintains documented procedures to assist clients in responding to DSARs when contractually required. This includes identity verification, intake, assessment, fulfillment, documentation, and escalation of complex or regulatory matters.