Nirvani Company Privacy Policy

For personal information we collect through our public website, marketing channels, inquiries, sales, account registration, billing, support, and our own business operations, Nirvani is the data controller (or “business” under U.S. state privacy laws) and determines the purposes and means of processing.

For personal information that clients and their authorized users input into the platform, or that flows through Nirvani in connection with a client’s communications with its own customers, leads, or contacts (“Client Data”), Nirvani acts as a data processor (or “service provider” under the CCPA/CPRA and comparable U.S. state laws). Nirvani processes Client Data on documented instructions from the client, only for purposes the client has authorized, consistent with the client’s own privacy notice and our written agreement with the client.

We may collect billing contact information, billing address, invoice and receipt records, subscription status, transaction dates, amounts, payment status, and limited payment metadata from payment processors. We do not store full credit card or full bank account numbers; payments are handled by PCI-compliant third-party processors.

We do not sell client data or client customer personal data to third parties for AI model training. We do not use client Confidential Information or the substantive content of client customer messages to train third-party foundation models. We may use aggregated usage telemetry, metadata, configuration data, and performance data (excluding client customer message content) to operate, secure, monitor, benchmark, improve, and develop our own services. We maintain technical safeguards and business processes designed to prevent re-identification of de-identified data and contractually prohibit re-identification by downstream recipients.

Where GDPR or UK GDPR applies, we process personal information on the legal bases of contract performance, our legitimate interests in operating and securing the business, your consent (which you may withdraw at any time), and compliance with legal obligations.

We may use automated tools to score, qualify, route, tag, or prioritize inquiries, leads, and communications. These tools are decision-support only and do not produce solely automated decisions with legal or similarly significant effects on any individual. You may contact us to request human review of any outcome.

Because no uniform standard has been adopted, we do not currently respond differently to browser “Do Not Track” (DNT) signals. This disclosure is provided pursuant to the California Online Privacy Protection Act (CalOPPA).

Where required by applicable law, we honor browser-based opt-out preference signals, including the Global Privacy Control (GPC). When we detect a valid GPC signal from your browser, we treat it as an opt-out of the sale or sharing of personal information associated with that browser.

We do not sell personal information for money. Our use of advertising cookies, tracking pixels, and analytics technologies may be considered “sharing” or “targeted advertising” under certain U.S. state privacy laws. You have the right to opt out of such sharing by emailing us with the subject line “Do Not Sell or Share My Personal Information,” or by using any opt-out mechanism available on our website where required. Mobile opt-in data and consent are not shared with third parties or affiliates for their own marketing purposes.

We engage service providers and sub-processors bound by written contracts that require them to process personal information only for the purposes we direct, maintain reasonable security, support data-subject rights, and assist with breach notification. A current list of our material sub-processors, and any associated data-processing addendum, is available upon request. For clients under a data processing agreement, we provide reasonable advance notice of new or replaced sub-processors and an opportunity to object consistent with that agreement.

Some U.S. states and jurisdictions outside the United States require consent from all parties to the recording of a telephone, voice, or video communication. Where we record, we provide audible or written notice before a recorded session begins. If you do not wish to be recorded, you may decline to proceed with the recorded portion of the interaction.

By providing your mobile number and opting in, you consent to receive SMS messages from Nirvani related to your inquiry, account, services, scheduling, billing, support, and operational matters. Message frequency varies. Message and data rates may apply. Reply HELP for help, STOP to unsubscribe. Carriers are not liable for delayed or undelivered messages. Mobile opt-in data and consent are not shared with third parties or affiliates for their own marketing or promotional purposes.

Where our AI voice, transcription, or conversational features process audio recordings, we do not use those recordings to enroll, compare, or otherwise derive a voiceprint or biometric identifier for the purpose of identifying a specific individual within the meaning of the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), the Washington biometric privacy statute, or comparable laws. We do not sell or lease biometric information. If a prospective client engagement requires biometric enrollment or identification functionality, a separate written instrument will govern that handling and the required consents.

Unless specifically requested under a separate written agreement, do not send the categories above through general website forms, public chat, or ordinary email. We do not use or disclose sensitive personal information for purposes beyond those permitted under applicable law without additional notice and consent. Any handling of regulated information may be subject to separate contractual terms, compliance documentation, or additional legal requirements.

Nirvani is not a HIPAA covered entity. Our standard platform is not configured for the handling of Protected Health Information (PHI). Do not submit PHI through ordinary inquiry, demo, or support channels. Clients who are HIPAA covered entities or business associates and who wish to use the platform for PHI-adjacent workflows may request, under a separately executed Business Associate Agreement and any required technical configuration, the addition of contractual safeguards sufficient to meet their obligations under HIPAA.

Clients that are financial institutions or that otherwise process “nonpublic personal information” under the Gramm-Leach-Bliley Act, “consumer report” information under the Fair Credit Reporting Act, or similar regulated financial data, are solely responsible for maintaining compliance with those laws and their implementing rules (including the FTC Safeguards Rule). Additional contractual safeguards may be required and are available on request.

Email us with the subject line “Privacy Request.” We will respond within 45 days of receiving a verifiable request, with one additional 45-day extension where reasonably necessary, and will notify you of any extension. We may need to verify your identity before responding. We will not discriminate against you for exercising any privacy right.

You may designate an authorized agent to submit a privacy request on your behalf. We may require the agent to provide signed written permission from you, and we may require you to verify your identity directly with us or confirm that you provided the agent with permission.

If you believe your privacy rights have been infringed, you may lodge a complaint with us. You may also contact the Arizona Attorney General, the California Privacy Protection Agency, your state attorney general, or the data-protection supervisory authority in your jurisdiction (including, in the EEA, your national supervisory authority, and in the UK, the Information Commissioner’s Office).

You may unsubscribe from marketing emails at any time using the unsubscribe link in any message or by emailing us. You may opt out of marketing SMS by replying STOP. We may still send transactional, billing, service, and operational communications.

Where Nirvani holds personal information as a processor or service provider on behalf of a client, requests from the client’s end customers are directed to that client. Nirvani will cooperate with the client in responding consistent with applicable law and our agreement with the client.