Privacy
What Nebby collects
Short version: very little, and we never sell it.
When you ask to be told when the store opens
We store your email address, what you're interested in, and anything optional you add (name, company, phone, a note), so we can email you once when it opens and answer your question. We don't add you to a mailing list or share it. Email [email protected] to be removed.
When you scan a domain
We look up public DNS records and load the domain's public website, the same information any mail server or browser can see. We keep scan results so reports can be shared, repeat scans are fast, and we can see how a domain's security changes over time. Scan results describe the domain, not you. To limit abuse, each scan briefly keeps a one-way scrambled version of your IP address, never the address itself, and that is removed after 90 days. Running a scan never puts you on an email list.
When you join the waitlist
We store the email address, the optional domain and note you enter, and whether you said you're an IT provider. We use it only to tell you about Nebby Pro. We don't sell or share it. To be removed, email [email protected].
When you take the CMMC self-check
We store your answers and anything optional you enter (company, domain, email, and whether you'd like help), so we can follow up if you asked us to. We don't share it.
When you ask for a Fix Kit
We store your email address and the domain, and use them only to send you the Fix Kit and anything you ask about it.
When you buy something or sign in
Payments are handled by Lemon Squeezy, our reseller and merchant of record. They collect your card and billing details and handle tax and receipts; we never see or store your card number. Lemon Squeezy tells us your email address, what you bought, and (for a Fix Kit) the domain it's for, so we can open your account. Your account holds your email address, what you've bought, your plan status and renewal date, the brand and last four digits of the card on file (so you can tell which card it is), and when you last signed in. We keep it while you're a customer and for as long as tax and accounting rules require afterward. Email us to close it.
Nebby Starter and Pro
For subscribers we store the domains you monitor or bulk scan, the client names you give them, the scan results, and your report branding, including any logo you upload. Only your account can see them. Domains are checked the same way as the free scan: public records only. Removing a domain stops its weekly checks. On Nebby Pro, a subscriber can add team members (their email addresses are stored), create API keys (stored only in scrambled form), and turn on monthly scorecards for a client, which stores that client's email address and sends them a report once a month on the subscriber's behalf. Every scorecard has a one-click link to stop them. Pro subscribers can also send alerts to their own Microsoft Teams, Slack or webhook address; we store those addresses and send only alert details about their own monitored domains.
Tenant Checkup (Microsoft 365)
When a Microsoft 365 admin connects their tenant, they approve read-only access for our app through Microsoft's own page. We read directory, license, security-policy, sign-in activity, MFA registration and inbox-rule information to produce the checkup, and keep the results (including the names of accounts with problems) so the subscriber can see changes over time. We can't read email, files or chats, and can't change anything. Disconnecting deletes the stored results; the admin can remove our access entirely in Entra under Enterprise applications.
Policy Pack
To write your policies we keep your questionnaire answers: the business name, state, industry, how you work (email platform, devices, remote work, MFA, backups), which kinds of sensitive information you handle, and the names and titles of the people you list. The documents are generated from those answers when you download them; we don't keep copies of the files. We use the review date to send one reminder a year. Asking us to delete a pack or your account removes the answers; Nebby Pro subscribers can delete client packs themselves.
When you leave a testimonial
We store what you write, your name, and the optional role, company and rating you give. Nothing is published until we review it, and it's shown only the way you chose. Email us any time to have it changed or removed.
Emails from us
We only email people who gave us their address, and only about what they asked for: a Fix Kit, CMMC help, the Nebby Pro waitlist, or a testimonial. Every email says why you're getting it. Reply "stop" and we won't email you again.
Cookies and tracking
Nebby sets one cookie, and only after you sign in: a random sign-in code that keeps you signed in for up to 30 days. Signing out deletes it. Nebby doesn't use advertising trackers. Our network provider, Cloudflare, may process connection data to protect the site from attacks.
Contact
Yinzer IT, Pittsburgh, PA · [email protected]
Last updated October 3, 2026.