Privacy

This Privacy Policy explains how Nabu ("Nabu," "we," "us," and "our") collects, uses, discloses, and protects information when you visit nabu.page or use the Nabu application at app.nabu.page.

Nabu is in private alpha. Some product details will change, but this policy is meant to describe the commitments that matter most: your creative work is yours, and we do not use it to train models.

We do not train models on your screenplay or creative content. This includes scenes, treatments, outlines, synopses, notes, conversations with Nisaba, accepted AI-drafted text once it is part of your script, and embeddings or other text-derived representations.

We do not use that creative content for model training, fine-tuning, shared training datasets, advertising, or resale. We do not permit our model providers to use your creative content for training when they process it for Nabu.

Nabu may collect structure and choice signals if you leave them enabled: counts, ratios, positions, feature events, export milestones, and decisions such as accepting, rejecting, or reworking a suggestion. These signals are numbers and decisions, not prose. You can turn them off in Settings.

We collect information needed to provide, secure, bill for, and improve Nabu:

• Account information: email address, display name, avatar, sign-in method, workspace membership, and authentication/session information.
• Creative content: projects, scenes, characters, treatments, outlines, notes, conversations, imports, exports, and other material you choose to put in Nabu.
• AI request context: the project excerpts, instructions, and conversation context needed to answer your request or run the feature you selected.
• Usage, security, and diagnostics: feature interactions, AI credit usage, timestamps, logs, device/browser information, error reports, and fraud or abuse-prevention signals.
• Structure and choice signals: the optional metadata described in Section 2.
• Billing information: Stripe customer, subscription, invoice, and payment-event identifiers. Stripe handles card numbers, CVVs, and full payment credentials.
• Communications: messages you send to us and transactional emails we send to you.

We use information for the following purposes:

• to provide, maintain, personalize, and improve Nabu;
• to save, organize, analyze, edit, import, and export your projects at your direction;
• to send AI requests to model providers when you use AI features;
• to process payments, manage subscriptions, and enforce credit limits;
• to detect abuse, debug failures, secure the service, and prevent fraud;
• to send service, account, billing, security, and support communications;
• to comply with law, enforce our terms, and protect rights, safety, and property;
• to improve Nabu using aggregate usage data and optional structure and choice signals, not screenplay prose.

When you use AI features, Nabu may send creative content and instructions to third-party AI providers so they can generate, classify, summarize, revise, or otherwise respond to your request. We send the content reasonably needed for the feature, not your entire project by default.

We currently use or support providers such as Anthropic, OpenAI, Google Gemini paid API, Mistral commercial services, and OpenRouter for routing and resilience. We route creative content only to provider/API paths whose published terms or configured controls prohibit training on customer prompts and outputs. Known training-by-default providers are blocked from user-content routing unless a verified no-training configuration exists.

Provider terms may still allow limited processing or temporary retention for safety, security, abuse prevention, debugging, legal compliance, or service operation. That is different from model training. If a provider materially changes its terms, we review the provider before continuing to route creative content there.

Provider references: Anthropic, OpenAI, Google Gemini API, Mistral, OpenRouter.

We use third-party services to operate Nabu, including AI providers, OpenRouter, Stripe for payments, Google and Apple for sign-in, Railway for hosting, Cloudflare for DNS/CDN/security, Resend for transactional email, and privacy-filtered analytics and error-monitoring tools such as PostHog and Sentry.

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We may disclose information to service providers, affiliates, professional advisers, authorities when legally required, or parties involved in a merger, financing, acquisition, or similar business transaction, subject to appropriate safeguards.

You can export your screenplay from Nabu in supported formats such as Fountain, Final Draft (FDX), and PDF. You can also turn off structure and choice signal collection in Settings.

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the use of your personal information; to object to certain processing; to withdraw consent where processing is based on consent; and to appeal or complain to a privacy regulator.

You may request account deletion or deletion of associated personal information by contacting us. We will process deletion requests within a reasonable period and as required by applicable law, subject to exceptions for billing records, security, fraud prevention, legal compliance, dispute resolution, backups, and content that must remain available to other collaborators or workspace members.

If privacy law requires a legal basis for processing, we rely on the following bases as applicable: performance of a contract to provide Nabu, legitimate interests in operating and securing the service, consent for optional settings or communications where required, and legal obligations such as tax, accounting, sanctions, and law-enforcement compliance.

We use technical and organizational safeguards intended to protect personal information, including encryption in transit, encryption for sensitive records where appropriate, access controls, logging, rate limiting, and operational review. No online service can guarantee absolute security.

Nabu and our service providers may process information in the United States and other countries. When required, we rely on appropriate transfer mechanisms or safeguards for international processing.

Nabu is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to Nabu, contact us and we will take appropriate action.

We may update this policy as Nabu changes. If we make material changes, we will provide notice through the service, by email, or by another reasonable method. We will not use your creative content for model training by quietly changing this policy.

Privacy questions and requests: [email protected].