Privacy Policy

Last Updated: September 1, 2026

Third Space Ventures LLC ("us", "we", or "our") operates the NBMetrics app (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal information when you use our Service.

Where the General Data Protection Regulation (GDPR) or the UK GDPR applies to the personal data we handle, we comply with it, and section 10 sets out the rights it gives you. We are committed to protecting your privacy and will use your information only in accordance with this Privacy Policy.

By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information Collection and Use

1.1. While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to, your name, email address, and the billing address you provide to Stripe at checkout ("Personal Information").

1.2. We also collect sensitive financial and personal data from the Nationbuilder platform to provide the Service. This information is stored in our database, hosted by Supabase in Canada (ca-central-1), and is used to generate the reports and data visualizations that NBMetrics builds itself.

1.3. We use your Personal Information for providing and improving the Service, for billing and subscription management, and for contacting you about updates, security issues, or other service-related matters.

1.4. The legal basis for processing your Personal Information includes: Your explicit consent. The necessity of processing for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract. Compliance with our legal obligations. The necessity of processing for the purpose of the legitimate interests pursued by us or by a third party.

2. Log Data

2.1. We collect information that your browser sends whenever you visit our Service ("Log Data"). This Log Data may include information such as your computer's Internet Protocol ("IP") address, browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, and other statistics.

3. Cookies

3.1. Cookies are files with a small amount of data, which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your computer's hard drive.

3.2. We use cookies only where they are necessary to operate the Service: to keep you signed in and to protect the connection process. We do not use advertising or analytics cookies. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

4. Service Providers

4.1. We may employ third-party companies and individuals to facilitate our Service, to provide the Service on our behalf, to perform Service-related services.

4.2. These third parties have access to your Personal Information only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose. Stripe is the exception, and only in part: as our payment processor it acts on our behalf, but it also acts as an independent controller of the payment data you give it -- your card details, billing address and transaction history -- which it processes for its own legal, fraud-prevention and regulatory purposes under its own privacy policy at https://stripe.com/privacy. We never see your card details.

4.3. The third parties we use are Supabase (database and authentication, hosted in Canada), Stripe (payments), Resend (transactional email), Vercel (hosting) and Fastmail (our support inbox). Separately, NBMetrics reads donation data from your own NationBuilder nation under the authorization you grant when you connect it; NationBuilder is your system of record, not a party acting on our behalf.

5. Whose Data Is Whose

5.1. Two different kinds of personal information pass through NBMetrics, and we hold them in two different capacities. For your own account information -- your name, your email address, your billing details and how you use the Service -- we are the controller and this policy describes what we do with it.

5.2. For the donation records read from your NationBuilder nation, which include your donors' names, email addresses, postal addresses and giving history, you are the controller and we are your processor. That data is yours. We process it solely to produce your reports, on your instructions, for as long as you are a customer. We do not sell it, share it, use it to train models, or use it for any purpose of our own. Our administrators can open a recorded, time-limited session to view a customer's reports where support requires it; those sessions are logged and display a banner throughout.

5.3. If you are a donor to an organization that uses NBMetrics and you want your data corrected or erased, please contact that organization directly. They control it, we do not, and changes made in their nation reach us on the next sync. If you contact us instead, we will pass your request to them.

5.4. Customers who need a formal data processing agreement, including the European Commission's Standard Contractual Clauses, can request one at hello@nbmetrics.com.

6. Security

6.1. The security of your Personal Information is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.

7. Data Breach

7.1. In the event of a data breach, we will inform the appropriate supervisory authority within 72 hours, take all reasonable steps to mitigate the impact, and notify affected users without undue delay as required by law.

8. International Transfer

8.1. Your information, including Personal Information, may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction.

8.2. If you are located outside Canada and choose to provide information to us, please note that we transfer the information, including Personal Information, to Canada, where your donation data is stored, and to the United States, where we are established and where our hosting, payment and email providers process it.

8.3. For personal data protected by the GDPR or UK GDPR, these transfers rely on the following safeguards. Transfers to Canada are covered by the European Commission's adequacy decision for Canadian commercial organizations. Transfers to the United States and to any other country without an adequacy decision are made under the European Commission's Standard Contractual Clauses (and, for UK data, the UK International Data Transfer Addendum), which are incorporated into our data processing agreements with each provider named in section 4.3, together with the supplementary technical measures described in section 6. A copy of the clauses relied on for a particular transfer is available on request at hello@nbmetrics.com.

8.4. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

9. Changes to This Privacy Policy

9.1. We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

9.2. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

9.3. Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated Privacy Policy. If you do not agree with any changes, you must stop using the Service.

10. Your Rights

10.1. You have the right to access, correct, update, or delete your Personal Information. You can do this by contacting us at hello@nbmetrics.com. We may require you to verify your identity before processing any requests related to your Personal Information.

10.2. If you are a resident of the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR), including the right to restrict or object to the processing of your Personal Information, the right to data portability, the right to erasure (right to be forgotten), the right to rectification if their data is incorrect, and the right not to be subject to automated decision-making, including profiling. To exercise these rights, please contact us at hello@nbmetrics.com.

11. Data Retention

11.1. We do not keep the data of accounts that are no longer active. While your subscription is active we retain your account information and your imported donation data for as long as you remain a customer, because that data is the Service.

11.2. When a subscription ends we delete everything we hold for the account: the donation records imported from your nation, the report data derived from them, your account record and your login. Deletion happens 7 days after a cancellation takes effect, or 30 days after access is suspended for non-payment -- the longer window exists so that an expired or declined card can be replaced without losing anything. A disputed charge is held longer still -- 120 days from the date of the dispute -- because the card issuer, not us, decides the outcome, and deleting the account before that decision would leave nothing to restore if the dispute is resolved in your favour. We email you the date in advance, it is shown in your account, and restoring the subscription before that date keeps everything. Deletion is permanent and we hold no copy afterwards.

11.3. Two narrow exceptions survive that deletion. Our record of payment events is stripped of personal information but keeps the payment identifiers, because we are required to keep records of the transactions we have billed and because those identifiers are what stop a duplicate charge. Stripe separately retains payment and invoice records under its own obligations as described in section 4.2. Operational logs that may incidentally contain an IP address or an email address expire on their providers' own schedules, within 30 days.

11.4. You do not have to wait for a cancellation. Email hello@nbmetrics.com and we will delete your data on request, subject to the same two exceptions above.

12. Third-Party Links

12.1. Our Service may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

12.2. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

13. Children's Privacy

13.1. Our Service is not intended for use by anyone under the age of 18 ("Children"). We do not knowingly collect personally identifiable information from children under 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Information, please contact us. If we discover that a child under 18 has provided us with Personal Information, we will take steps to delete such information from our systems.

14. Complaints

14.1. If you are unsatisfied with our response to your privacy concerns, you have the right to lodge a complaint with a supervisory authority in the country where you live or work, or where you believe a breach may have occurred.

15. Contact Us

If you have any questions about this Privacy Policy, please contact us at hello@nbmetrics.com, or write to Third Space Ventures LLC, 447 Broadway, FL 2 STE 3065, New York, NY 10013.