Privacy Policy
This Privacy Policy explains what personal information Nemapp collects, why, who receives it, and the choices you have. It covers the Nemapp website, the Nemapp iPhone app and the Nemapp web dashboard. Part A is our federal financial privacy notice. Part B gives the details.
Who we are. Nemapp is operated by NEMAPP LLC, a Florida limited liability company ("Nemapp", "we", "us"). Nemapp is a financial technology company, not a bank. Nemapp is in private testing: it is not open to the public and the money shown in the app is simulated.
Part A: Financial privacy notice
Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share and protect your personal information.
What? The personal information we collect and share depends on the product or service you have with us. It can include your Social Security number and date of birth, account balances and transaction history, identity document images and a photo of you, and device and security information.
How? All financial companies need to share customers' personal information to run their everyday business. The table lists the reasons financial companies can share personal information, whether Nemapp shares for that reason, and whether you can limit it.
| Reasons we can share your personal information | Does Nemapp share? | Can you limit this sharing? |
|---|---|---|
| For our everyday business purposes, such as to process your transactions, maintain your account, respond to court orders and legal investigations, or report to credit bureaus | Yes | No |
| For our marketing purposes, to offer our products and services to you | No | We don't share |
| For joint marketing with other financial companies | No | We don't share |
| For our affiliates' everyday business purposes: information about your transactions and experiences | No | We don't share |
| For our affiliates' everyday business purposes: information about your creditworthiness | No | We don't share |
| For our affiliates to market to you | No | We don't share |
| For nonaffiliates to market to you | No | We don't share |
How does Nemapp protect my personal information? We use security measures that comply with federal law, including encryption of sensitive information, passkey and multi-factor sign-in, trusted devices, and limited, logged access by our staff.
How does Nemapp collect my personal information? When you apply for an account, give us your contact details, link another bank account, make transfers, or verify your identity. We also receive information from others, such as identity-verification providers and the bank that holds accounts.
Why can't I limit all sharing? Federal law gives you the right to limit only sharing for affiliates' everyday business purposes (information about your creditworthiness), affiliates using your information to market to you, and sharing with nonaffiliates to market to you. State laws may give you more rights.
Definitions. Affiliates are companies related by common ownership or control; Nemapp does not share with its affiliates. Nonaffiliates are companies not related by common ownership or control, such as the bank that holds accounts and our service providers. Joint marketing is a formal agreement between nonaffiliated financial companies to market financial products together; Nemapp does not do this.
Questions? Contact us through support in the Nemapp app.
Part B: Details
1. This website
The Nemapp website sets no cookies and loads no analytics, advertising or tracking scripts, and no third-party fonts or scripts. Our hosting provider receives standard request information (IP address, browser type and the page requested) to deliver the site and protect it from abuse.
2. What we collect when you apply for or use Nemapp
| Category | What | Why |
|---|---|---|
| Identity | Full legal name, date of birth, home address, citizenship, country of birth, tax residence | Federal law requires identity verification to open an account |
| Government ID number | Social Security number, or a foreign tax ID where relevant | Identity verification by the bank. It is encrypted, sent to the bank, and once your application is approved we keep only the last 4 digits |
| ID document and photo | Photos of an ID document and a photo of your face | Identity verification. During private testing these images are discarded when received and only a pass/fail status is kept |
| Due diligence | Occupation, employer, purpose of the account, source of funds | Anti-money-laundering rules |
| Contact | Email address and phone number | Sign-in, security codes and notices. Security codes are stored only in a protected (hashed) form and expire after 10 minutes |
| Account activity | Balances, transfers, merchants, categories, statements, payees | To provide the account |
| Linked bank accounts | Routing number and account number | To move money to and from your other bank. The full numbers go to the bank; we keep the last 4 digits |
| Business information | Business legal name, address and contact details; EIN (sent once to the bank, last 4 digits kept); team members' names, emails, titles, roles and pay rates; business contacts, invoices, bills and expense receipts | Business accounts, team permissions, payroll and invoicing |
| Devices and security | Device public key, device name and model, app version, Apple App Attest key identifier, passkey public keys, push notification token | Trusted devices, sign-in and notifications |
| Sign-in and security records | IP address and browser or device type for sessions, consents, and security and audit records | Security, fraud prevention and legal records |
| Support | Messages you send to support, and any transaction you point us to | To help you and to handle errors and disputes |
What we don't collect. Face ID and Touch ID stay on your device: Nemapp receives only a yes or no result and never your face or fingerprint data. We do not use advertising identifiers or app tracking, and the app contains no third-party analytics or crash-reporting tools.
3. The web dashboard
- One sign-in cookie. It keeps you signed in, can't be read by scripts, is sent only over secure connections to the dashboard's own service, and is not used for tracking.
- Browser storage holds display preferences only, such as appearance, sidebar state, the last tab you opened and the business you selected.
- No analytics or tracking scripts.
- Address suggestions. When you type an address during sign-up, the text you type is sent to Photon (an address-lookup service run by Komoot), without cookies.
4. How we use personal information
To open, run and secure your account; to verify your identity; to prevent fraud and financial crime; to meet our legal obligations; to communicate with you; and to fix and improve Nemapp. We do not sell personal information, and we do not share it for advertising based on your activity across other companies' sites and apps.
5. Who receives personal information
| Recipient | What | Why |
|---|---|---|
| The bank that holds accounts (during private testing, the test environment of the bank we are building with) | Identity information including your Social Security number, contact details, business details including the EIN, linked-bank details and payment instructions | To open and operate accounts and move money |
| Cloudflare | All app and dashboard traffic | Running and protecting the service |
| DigitalOcean | The database that stores the information above | Hosting |
| Apple Push Notification service | Your device's push token and the content of notifications | Notifications |
| Apple MapKit (iPhone app) and Photon by Komoot (web dashboard) | The address text you type | Address suggestions |
| Email and text-message delivery providers, once enabled | Your email address or phone number and the message | Security codes and notices |
| Market-data providers | Currency or stock symbols only, no personal information | Reference data |
| Payment systems and other banks | What is needed to complete a payment you ask for | Completing your transactions |
| Government authorities, courts and law enforcement | What the law requires | Legal obligations |
| A buyer or successor of Nemapp | Account information | A merger, acquisition or sale of assets, under this policy |
Our service providers may use personal information only to provide services to us.
Business accounts. A business's Owner and Admins can see the activity of the team members in that business's account, and the business's audit trail records who did what.
6. How long we keep information
- Sign-in sessions end after 14 days without use.
- Records used to prevent duplicate payments are deleted after 48 hours, and rate-limit records after 1 day.
- Security codes expire after 10 minutes.
- Your Social Security number is reduced to its last 4 digits once your application is approved.
We have not yet adopted a final retention schedule. Before accounts are offered we will publish one. Federal law will require us to keep identity records for 5 years after an account closes, transaction records for at least 5 years, electronic transfer records for at least 2 years, and sanctions-related records for 10 years. Other information will be deleted or de-identified when it is no longer needed.
7. Security
Sensitive information is encrypted in transit and at rest. Sign-in uses passkeys or a password with a one-time code, new devices start untrusted, and moving money needs a step-up check. Staff access is limited, logged, and needs two people for sensitive actions. No system is perfectly secure. If a data breach affects you, we will tell you as the law requires.
8. Your choices and rights
- In the app you can sign out devices and remove passkeys and push notifications.
- You can ask to see, correct or delete your information, or to close your account, through in-app support. There is no self-service account closure yet. We will honor deletion requests except where the law requires us to keep the information.
- State privacy laws. Much of the information we hold is covered by the federal financial privacy law (the Gramm-Leach-Bliley Act), which many state privacy laws exempt. Where a state law does apply, for example to website visitor information or marketing information, we provide its rights: to know, access, correct, delete and port your information; to opt out of sale, targeted advertising and profiling (we do none of these); and to appeal a decision. California's private right of action for data breaches still applies to financial information.
- Photos of your face. Before identity verification uses real photos of customers, we will ask for your written consent and publish how long the photos and any facial measurements are kept and when they are destroyed, as laws in states such as Illinois, Texas and Washington require.
9. Children
Nemapp is only for adults: you must be 18 or older to open an account.
10. Outside the United States
Nemapp serves only people and businesses in the United States, and your information is stored and processed in the United States. Nemapp does not offer accounts to people in the European Union, the United Kingdom, Canada or elsewhere.
11. Changes
We will post changes to this policy here. If a change is material, we will tell you before it takes effect where the law requires.
12. Contact
Nemapp does not yet have a public privacy email address. Send privacy questions and requests through support in the Nemapp app.