Cookie Policy

Last updated 9 Oct 2026

Draft — under legal review. This document is awaiting sign-off by our lawyer and may change before it is final.

1. Who we are and what this covers

This Cookie Policy explains what cookies and similar browser storage Nirvest Tech Private Limited ("Nirvest", "we", "us"), CIN U62011DL2026PTC468686, places on your device when you use Nirvest Lens, the Nirvest Wallet, our administrative console (staff only) and our public website (together, the "Services"). It is part of, and should be read with, our Privacy Policy and Terms and Conditions.

A cookie is a small text file a website asks your browser to keep. Local storage and session storage are similar areas of your browser that a website can write to. Session storage is cleared when you close the tab. We use the word "storage" below for all of these.

The Services run on four addresses: nirvestlens.com (public website), app.nirvestlens.com (Nirvest Lens), wallet.nirvestlens.com (Nirvest Wallet) and admin.nirvestlens.com (staff console). The Services are in early access and this list is accurate as of the date above.

2. The short version

We use no analytics. No Google Analytics, tag manager, session-recording tool, heat-map, or any other analytics product is built into the Services.
We use no advertising or tracking cookies, and we do not let advertisers track you through the Services.
Everything we set ourselves is either strictly necessary (to sign you in and keep you signed in securely) or functional (to remember a choice you made, such as your language, or to display times in your time zone).
The only third-party cookies come from our payment provider, Paddle, and only on wallet.nirvestlens.com when you open the checkout to recharge (Section 5).
Our public website (nirvestlens.com) sets no cookies. If you choose a language while signing up on app.nirvestlens.com, we remember it in a cookie (nl_locale, Section 4.3).

3. Legal framing

India. Under the Digital Personal Data Protection Act, 2023 and the Rules made under it, and the Information Technology Act, 2000, we process the personal data that cookies carry only for the purposes described here. Strictly necessary cookies are used to provide the service you asked for. We do not rely on cookies for advertising or profiling.
EU and UK. Where the GDPR / UK GDPR and the ePrivacy rules (including the UK's Privacy and Electronic Communications Regulations) apply to you, storage that is strictly necessary to provide a service you have requested does not need consent. Storage that is only functional is, in our reading, either also strictly necessary (for example the language you chose) or set only because you took a specific action; we say below which. Analytics and advertising storage would need your prior consent, and we do not use either.
If we ever add storage that is not strictly necessary, we will update this Policy first and, where the law requires it, ask for your consent before setting it. We will not set it by default.

4. Cookies and storage we set ourselves

"Consent needed?" means: does the law require us to ask you before setting it. In every entry below the answer is No, for the reason given.

nl-auth (may be split into nl-auth.0, nl-auth.1 for size): Purpose: Keeps you signed in to Nirvest Lens and the Nirvest Wallet. Holds your session token. HttpOnly (scripts on a page cannot read it), Secure, SameSite=Lax. Set for the whole nirvestlens.com domain so that signing in on Lens also signs you in on the Wallet without a second login. Type: Strictly necessary. Duration: Until you sign out or your session expires. Consent needed? No — needed to provide the service you asked for.
nl-auth-h: Purpose: A one-time marker saying "this browser's session cookie already has our current security settings". Contains no personal data. Present only for browsers that signed in before a security upgrade. Type: Strictly necessary (security). Duration: Kept until you sign out or your session expires, in line with nl-auth. Consent needed? No.
nl-auth-flow-<id>-code-verifier, nl-auth-flows-code-verifier (Supabase PKCE code verifier): Purpose: A single-use secret that proves the browser finishing a Google / Microsoft sign-in is the same one that started it. HttpOnly, Secure, SameSite=Lax. Deleted as soon as sign-in completes. Type: Strictly necessary (security). Duration: 15 minutes at most. Consent needed? No.
nl_signup_draft: Purpose: Holds a draft identifier while you complete sign-up. HttpOnly, SameSite=Lax. Type: Strictly necessary. Duration: 24 hours. Consent needed? No.
nl_invite_token: Purpose: Carries the invitation you opened until you finish joining that Workspace. HttpOnly, SameSite=Lax. Type: Strictly necessary. Duration: 1 hour. Consent needed? No.
nl_auth_intent, nl_auth_next: Purpose: Remember whether you are signing in or signing up, and the page you were heading to, so we can return you there after the Google / Microsoft step. HttpOnly, SameSite=Lax. Type: Strictly necessary. Duration: 1 hour. Consent needed? No.
nl_nylas_state: Purpose: A single-use check that the return from connecting your mailbox or calendar was started by you. HttpOnly, SameSite=Lax. Cleared after the connection completes or fails. Type: Strictly necessary (security). Duration: 10 minutes. Consent needed? No.

Older sessions may still carry cookies named sb-<project-id>-auth-token. These are the previous name of nl-auth. We revoke and delete them when we see them, and they are no longer used.

4.2 Staff console (`admin.nirvestlens.com`)

These cookies are set only for Nirvest staff and are never set for customers.

na_session: Purpose: Keeps a Nirvest administrator signed in to the separate staff console. A signed value (it cannot be altered without detection) that points to a session we hold on our side. HttpOnly, Secure, SameSite=Strict, limited to the /admin path. Type: Strictly necessary. Duration: Up to 12 hours; the session also ends after 30 minutes of inactivity. Consent needed? No.
na_mfa: Purpose: Remembers, during an administrator's sign-in, which authenticator step comes next (set up or verify) and the administrator's email address. HttpOnly, Secure, SameSite=Strict, /admin path. Type: Strictly necessary. Duration: 10 minutes. Consent needed? No.

4.3 Preferences (functional)

nl_locale: Purpose: Remembers the language you chose, so the Services open in it before you sign in. If you have not chosen one we use your browser's language setting. Readable by scripts, SameSite=Lax. Once you are signed in, your language is also stored in your account. Set when you choose a language while signing up, before you sign in, and updated when you change your language in your account settings. Our public website (nirvestlens.com) never sets it. Type: Functional. Duration: 1 year. Consent needed? No — it only stores a choice you made and is needed to show the page in the language you asked for.
nl_tz: Purpose: Stores your browser's time zone so dates and times are shown in your local time. The value is a time-zone name such as Asia/Kolkata. We store no time zone in your account. Readable by scripts, SameSite=Lax. Type: Functional. Duration: 1 year. Consent needed? No — needed to display times correctly. Contains no identifier.

4.4 Local storage and session storage (not cookies)

These stay in your browser. They are not sent to our servers with each request.

nl-theme: Where it lives: Local storage. Purpose: Your light / dark theme, read before the page is drawn so it does not flash. Also saved to your account when you are signed in. Type: Functional. Duration: Until you clear it. Consent needed? No — set by your own choice of theme; no identifier.
nirvest.financials.show_projections: Where it lives: Local storage. Purpose: Whether you chose to show projections on a company's Financials tab. Type: Functional. Duration: Until you clear it. Consent needed? No.
nl:forms-strip:dismissed:<form id>: Where it lives: Local storage. Purpose: Remembers that you closed a reward banner for a form. Type: Functional. Duration: Until you clear it. Consent needed? No.
nirvest.push_subscription_id: Where it lives: Local storage. Purpose: Remembers which browser notification subscription belongs to this browser, so you can turn it off. Set only if you turn on browser notifications. Type: Functional. Duration: Until you clear it or turn notifications off. Consent needed? No — set only because you asked for notifications.
nl_recent_searches, nl_search_auto_interpret: Where it lives: Session storage. Purpose: Your recent search terms in this tab and your choice for the search helper. Type: Functional. Duration: Until the tab is closed. Consent needed? No.
nl_bulk_sel:<page>: Where it lives: Session storage. Purpose: Which rows you had selected on a list page, so a refresh does not lose them. Type: Functional. Duration: Until the tab is closed. Consent needed? No.
nl_bug_ring, nl_bug_ring_owner: Where it lives: Session storage. Purpose: A short, redacted, rolling record of recent screen events kept on your device only so that, if you choose "Report a bug", the report can include what happened. It is emptied when you sign out. Nothing is sent unless you submit a report. Type: Functional. Duration: Until the tab is closed or you sign out. Consent needed? No — nothing leaves your device unless you submit a report.

We do not currently store a sidebar-collapsed state or a product-tour progress marker in browser storage; if we add one it will be listed here.

Our service worker for browser notifications (notifications-sw.js) is installed only if you turn on browser notifications.

5. Third-party cookies

5.1 Paddle (payments)

Recharges of NT are sold by our Merchant of Record, Paddle (Paddle.com Market Ltd and its affiliates). On wallet.nirvestlens.com, when you start a recharge, we load Paddle's checkout script (cdn.paddle.com) and open Paddle's checkout (buy.paddle.com) on top of our page. Paddle may set its own cookies and use similar technologies on its own domains while the checkout is open, for example to process the payment, prevent fraud and remember your checkout session.

We do not control these cookies and do not receive your card details. They are set by Paddle during checkout on wallet.nirvestlens.com. Paddle decides which cookies it sets and for how long; see Paddle's privacy notice, which covers its cookies, before paying.
Type: third party; strictly necessary for completing a payment you asked to make, to the extent Paddle's own policy says so.
When: only on the Wallet recharge screens, not elsewhere in the Services. Paddle's script is not loaded on the public website, in Nirvest Lens, or in the staff console.
Consent: our position is that opening the checkout is an action you take yourself and that the cookies are needed for the payment, so no separate banner is needed. Paddle's own notices apply.

When you choose "Continue with Google" or "Continue with Microsoft", your browser goes to Google's or Microsoft's own sign-in page. Those companies set their own cookies there, under their own policies. We do not control them. Nirvest never sees your Google or Microsoft password.

5.3 Mailbox and calendar connection

When you connect an inbox or calendar, you are taken to our connectivity provider and then to your email provider's consent screen. Those pages set their own cookies under their own policies.

5.4 Images loaded from other websites

Where a company logo or a person's sign-in photo is shown from a link rather than from our storage, your browser fetches it directly from the website that hosts it. That website receives your IP address, browser details and the time of the request, and may use its own cookies. We add no cookie, identifier or referrer to the request. See the Privacy Policy.

6. Analytics, advertising and tracking

We use none. We have checked: the Services contain no analytics library, no tag manager, no advertising pixel, no session-recording or heat-map tool, no social-media widget and no third-party fonts that call out to another site. We do not track you across other websites.

Two things are worth knowing so that nothing here surprises you:

Server logs. Our hosting provider records standard request logs (such as IP address and the page requested) when you use the Services. Nothing is placed on your device. Our own security logs record sign-in events and, for the security-report endpoint below, a hashed form of your IP address.
Security reports. Your browser may automatically send a small report to https://app.nirvestlens.com/api/csp-report when something on a page breaks our browser security rules (a "Content Security Policy" report). It sets no cookie and reads none. We store only the page address, which rule was broken, the blocked address and a shortened browser description, never your session, a cookie, or a query string, and the report is not linked to your account. It is a security control, not tracking.

7. How you can control cookies

Browser settings. Every major browser lets you see, block and delete cookies and clear local and session storage. Look in the "Privacy" or "Site data" settings of your browser. You can block all cookies, or only third-party cookies (which will stop Paddle's checkout cookies).
What happens if you block them. If you block the strictly necessary cookies in Section 4.1, you will not be able to sign in or stay signed in, and the Wallet will not recognise you. If you block nl_locale or nl_tz, the Services still work, but may show the language of your browser and times in a default time zone until you set them in your account. If you block Paddle's cookies, the checkout may not complete.
Sign out. Signing out clears your session cookie. You can see and revoke your active sessions at any time from your account settings.
Language, theme and notifications. Change them in your account settings, or turn browser notifications off, to remove the matching stored value.
No banner. Because we set only strictly necessary and functional storage, we do not show a cookie consent banner. If that changes, you will be asked before anything non-essential is set, and you will be able to withdraw consent as easily as you gave it.
Do Not Track and Global Privacy Control. We do not track you, so there is nothing for these signals to switch off.

8. Your rights

Your rights over personal data held in cookies are the same as under the Privacy Policy (Section 11), including access, correction, erasure and, where you gave consent, withdrawal of consent. To exercise them, use the contact in Section 10.

9. Changes to this Policy

We will update this Policy and the "Last updated" date whenever we add, remove or change a cookie or similar storage in a way that matters to you. For any non-essential storage we will tell you and ask before we set it.

10. Contact and Grievance Officer

For questions about this Policy:

Vanshaj Sharma

Director and Grievance Officer, Nirvest Tech Private Limited

Email: nirvest29@gmail.com

(Same details as the Privacy Policy, Section 16. Governing law and courts: see Terms and Conditions, Section 24: laws of India, courts at Delhi.)