Privacy Policy

1. Who we are

This Privacy Policy explains how Nirvest Tech Private Limited ("Nirvest", "we", "us"), a company incorporated in India, CIN U62011DL2026PTC468686, collects, uses, shares and protects personal data when you use Nirvest Lens, the Nirvest Wallet, our website, and related services (the "Services").

We are committed to complying with India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000 and its rules, and, where they apply to you, the EU/UK General Data Protection Regulation (GDPR) and other applicable privacy laws.

2. Our two roles

When we decide how data is used — we are the Data Fiduciary / controller. This covers your account, sign-in, Wallet, payments, withdrawals, referral and Partner programs, security logs, website enquiries and communications with us.

When we process data on behalf of a Workspace — the Workspace customer is the Data Fiduciary / controller and we are its Data Processor. This covers Your Content: records, emails, calendars, documents, notes, imports and enrichment data about the people and companies you track. The Workspace customer decides what goes into its Workspace and why. If you are an individual whose information appears in someone else's Workspace, please see Section 8.

3. Information we collect

3.1 Account and profile

• Name, email address and profile photo from the Google or Microsoft account you sign in with
• Workspace name, role, membership and permission settings
• Two-factor authentication settings and active session details

3.2 Content you connect, create or import (Workspace Content)

• Emails and attachments from inboxes you connect, and calendar events from calendars you connect
• Companies, people, deals, pipeline stages, notes, tags, pins and portfolio records
• Documents and pitch decks you upload
• Capital Partner contributions, allocations and payment receipts
• Client and fee records, including payment status
• Imports from WhatsApp exports, LinkedIn exports, CRM exports, CSV and spreadsheets (we keep the extracted records and their source details, not the raw imported file)
• Information about people and companies collected from public web sources when you use enrichment features
• Your conversations with Nirvu AI and the AI outputs generated for you
• Data used to generate Nirvu AI Tax reports, including the country you confirm

3.3 Wallet, payments and payouts

• NT balance, recharges, usage deductions, bonuses and ledger history
• Autopay settings, spend caps and per-member limits set by your Workspace Admin
• Recharge transaction references. Card and payment details are collected and held by our Merchant of Record, Paddle — we do not receive or store your full card details.
• For Commission Wallet withdrawals: bank account details (account number, IFSC or SWIFT/BIC/IBAN/routing code), account holder name, country, PAN (for Indian residents) or tax identification number and tax residency information (for non-residents), and records of tax deducted and payouts made

3.4 Referral, Partner and reward programs

• Referral codes, who referred whom, qualifying recharges and earnings
• Partner enrollment details and earnings history
• Fraud-prevention signals such as IP address, device information and payment characteristics
• Questionnaire responses you submit

3.5 Usage, device and security data

• Log data such as IP address, browser, device type, pages and features used, and timestamps
• AI request logs (task type, mode, NT used, success or failure)
• Security and audit logs, including sign-in events and exports

3.6 Communications

• Messages you send us (including Contact Us messages and support requests), and early access or Partner sign-up forms on our website
• SMS and email notifications we send you, and their delivery status

4. How we use information

• Provide the Services: Examples: Run your Workspace, sync email/calendar, search, AI features, exports. Basis: Your consent / performance of our contract with you.
• AI features: Examples: Triage, summaries, scoring, enrichment, translation, Nirvu AI answers, Nirvu AI Tax drafts. Basis: Your consent / contract; on the Workspace customer's instructions for Workspace Content.
• Wallet and billing: Examples: Deduct NT, record ledger entries, autopay, recharges, enforce spend caps. Basis: Contract.
• Withdrawals and tax: Examples: Verify bank and tax details, deduct and report tax, make payouts. Basis: Contract; legal obligation.
• Referral, Partner and rewards: Examples: Credit rewards, calculate Partner earnings, prevent abuse. Basis: Contract; legitimate interest in preventing fraud.
• Security and integrity: Examples: Enforce Workspace isolation, detect unauthorised access, audit logs. Basis: Legitimate uses permitted by law; legitimate interests.
• Support: Examples: Respond to requests, investigate issues. Basis: Contract; your consent.
• Service communications: Examples: Account, billing, security and product notices by email or SMS. Basis: Contract; legitimate interests.
• Improve the Services: Examples: Aggregate usage and performance analysis. Basis: Legitimate interests (using aggregated or de-identified data where possible).
• Legal compliance: Examples: Tax, accounting, responding to lawful requests. Basis: Legal obligation.

Where we rely on consent, you can withdraw it at any time (Section 11). Withdrawal does not affect processing already carried out, and some features may stop working without it.

We do not sell your personal data, and we do not use it for third-party advertising.

5. How AI features handle your data

• Workspace-scoped. AI features use only data from your own Workspace. AI context, learned preferences and search results are never shared across Workspaces.
• Minimum necessary data. We send AI providers only the data needed to perform the specific task you requested.
• Web search. When your Workspace data is insufficient, Nirvu AI may send a search query — not your Workspace records — to third-party search providers.
• Human confirmation. AI-proposed changes to your records are shown for your confirmation before they are saved.
• We do not train AI models on your content. We do not use your Workspace Content to train AI models, and we do not build models from it.
• Personalisation is not model training. Our personalisation features record plain-language observations about how your team has handled past suggestions — for example, that your Workspace usually confirms a particular kind of update. These observations are stored per Workspace, visible to your Workspace in settings, can be reset by your Workspace at any time, and are never read across Workspaces. They do not create or modify any AI model.

6. Google and Microsoft user data

If you connect a Google account (for example Gmail or Google Calendar), our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• we use Google user data only to provide and improve the user-facing features you have enabled;
• we do not use it for advertising;
• we do not sell it or transfer it to third parties except as needed to provide the Services, comply with law, or as part of a merger or acquisition with your notice;
• humans do not read it except with your permission, for security purposes, to comply with law, or where it has been aggregated and anonymised.

We apply the same standards to Microsoft account data. You can disconnect an account at any time from your settings or from your Google or Microsoft account permissions page.

7. Who we share information with

We share personal data only as described below.

Service providers (processors) who help us run the Services, under contracts requiring them to protect your data. We use providers in the following categories:

• cloud hosting, database and file storage
• search indexing
• email and calendar connectivity
• SMS and email delivery
• AI model providers
• web search providers used by AI features
• payment processing and Merchant of Record services
• payout processing in India and internationally
• error monitoring and service reliability

A current list of the named providers we use is available on request — write to us at the address in Section 16.

Your Workspace. Workspace Admins and members can access Workspace data according to the permissions set in that Workspace.

Tax authorities and professional advisers. Payout and tax information is shared with tax authorities as required by law, and with our professional advisers where needed to meet our legal obligations.

Legal and safety. Where required by law, court order or lawful government request, or to protect the rights, safety and security of Nirvest, our users or others.

Business transfers. In a merger, acquisition or sale of assets, subject to this Policy.

8. If your information is in someone else's Workspace

Nirvest Lens users record information about people they work with — founders, investors, capital partners, clients and contacts — including information from emails, calendars, documents, imports and public web sources. For that information, the Workspace customer is responsible for having a lawful basis and giving any required notice.

If you believe a Nirvest customer holds your information and you want to exercise your rights, please contact that customer directly. You may also contact us at the address in Section 16 and we will help route your request to the relevant customer and support them in responding.

9. International transfers

We and our service providers may store and process data in India and in other countries, including the United States and the European Union. Where required, we use appropriate safeguards for international transfers, such as contractual clauses, and we comply with any transfer restrictions notified under Indian law.

10. How long we keep data

• Account and Workspace data — while your account or Workspace is active.
• After a Workspace is closed, or its NT balance falls below 20 NT — a 30-day period, with reminders on days 0, 7, 15, 25 and 29, during which an admin can cancel the closure or a recharge to 20 NT or more ends the suspension (Terms, Sections 10.9 and 17.1). On day 30 the Workspace's encryption key is destroyed first, and then its data and files are deleted from active systems. Backups expire within 30 days after that.
• Payment, payout and tax records — retained for eight years, in line with Indian company and tax law, even after account deletion.
• Wallet ledger — the record of every NT and Commission Wallet credit and debit is kept with no time limit, even after deletion, together with a record of who created each deleted Workspace (their account identifier and sign-in email address). This is how we return the remaining NT balance of a deleted Workspace to the person who created it when they create a new Workspace with the same Google or Microsoft account (Terms, Section 17.3). Commission Wallet balances are not restored.
• Security logs — security events, such as sign-ins, are deleted after 12 months. The records that show a Workspace was suspended for low balance, deleted, or had its kept NT balance restored are exempt and kept with no time limit.
• AI request logs — deleted 12 months after the request.
• Administrative audit log — the log of what our staff do is kept with no time limit. Our staff cannot edit or delete it.
• Imported raw files — not stored; only extracted records and source details are kept.

11. Your rights

Depending on where you live, you may have the right to:

• access a summary of your personal data and how it is processed;
• correct inaccurate or incomplete data, and update your data;
• erase your data (subject to the legal retention periods in Section 10);
• withdraw consent at any time, as easily as you gave it;
• nominate another person to exercise your rights if you die or become incapacitated (India);
• data portability — receive your data in a usable format (you can also use the Export Center where your Workspace permits);
• object to or restrict certain processing (GDPR);
• grievance redressal — raise a complaint with us, and escalate to the Data Protection Board of India or your local data protection authority if you are not satisfied.

To exercise your rights, email us at the address in Section 16. We may need to verify your identity. We will respond within 30 days, and in any case within the time the law requires.

12. Security

We protect personal data with measures including:

• sign-in through Google or Microsoft, with optional two-factor authentication enforced by Workspace Admins;
• visible session management with the ability to revoke sessions;
• strict Workspace isolation enforced at the database level;
• encryption of sensitive secrets at rest and encryption in transit;
• a separate administrative system with its own independent sign-in, not reachable from customer accounts;
• a support mode that is limited to one Workspace for at most 60 minutes, needs a written reason, is logged, and adds only fixed summaries such as job statuses, mailbox sync status and members' roles, never your emails, documents or notes (our administrative console has no screen that shows those, other than in messages, bug reports or screenshots that you choose to send us);
• audit logging of sensitive actions and exports.

No system is completely secure. If a personal data breach affects you, we will notify you and the relevant authorities as the law requires.

13. Children

The Services are not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Cookies and local storage

We use no analytics, advertising or tracking technologies of any kind. We do not use Google Analytics, tag managers, advertising pixels, session-recording tools or any third-party analytics product, and we do not allow third parties to track you across other websites through our Services.

The only cookies and browser storage we use are strictly necessary (to sign you in and keep you securely signed in) or functional (to remember choices such as your language, theme and time zone). Our public website (nirvestlens.com) sets no cookies; if you choose a language while signing up, we remember that choice in a cookie. Our full, current list is in our Cookie Policy. If we introduce analytics or any other non-essential storage in future, we will update this Policy and, where required, ask for your consent first.

Our hosting provider records standard server-side request logs (such as IP address and request details) as part of operating and securing the Services. This happens at the server and places nothing on your device.

Revised 9 October 2026: the cookie table was replaced by a summary and a pointer to the Cookie Policy.

15. Changes to this Policy

We may update this Policy. We will notify you of material changes in the product or by email before they take effect, and update the "Last updated" date.

16. Contact and Grievance Officer

For privacy questions, requests and complaints:

Vanshaj Sharma

Director and Grievance Officer, Nirvest Tech Private Limited

Email: nirvest29@gmail.com

We will acknowledge complaints within 48 hours and resolve them within the time the law requires.