Nirvana Privacy Notice (GDPR)
Welcome! If you are from Europe or the UK, this is the privacy notice that covers you. This privacy notice is in addition to our general privacy policy, which also applies to you. If there are any contradictions between this notice and the general privacy policy, this notice shall govern.
This privacy notice is meant to comply with the European Union's General Data Protection Regulation ("GDPR"). Many terms in this notice are as defined by the GDPR, and as such, will use the GDPR definitions. To make it easier to read, these terms will have their first character capitalized.
What is your Personal Data and who is the Data Controller?
In order to use our Service, you must create an Account. By creating an Account, you provide us with Personal Data. This is data that you have given us that can be used to identify you directly or indirectly. Your Personal Data is Controlled by us, Nirvanahq, Inc., which means we decide what Personal Data is collected and how it is used.
If you wish to contact us (the Data Controller) regarding this privacy notice, or if you wish to exercise any of your rights under the GDPR or otherwise, please write us at:
Nirvanahq, Inc.
1981 McGill College Ave
Montréal, QC H3A 0G6
Canada
Or by email legal@nirvanahq.com
Supervisory Authorities
Under the GDPR, you have the right to lodge a complaint with a Supervisory Authority regarding the Processing of your Personal Data. For more information, visit your national data protection authority, or visit the European Data Protection Board for a list of national Supervisory Authorities in Europe.
What are my rights?
When it comes to your Personal Data, you have certain rights as follows:
- You have the right to object to Processing carried out on the basis of our legitimate interests (for example, usage analytics). To exercise this right, contact us at legal@nirvanahq.com.
- You have the right to withdraw your consent where Processing is based on your consent (for example, Nirvana AI features). You may do this at any time through your Account settings.
- You have the right to request the erasure of your Personal Data (subject to exceptions in the applicable legislation).
- You have the right to receive the Personal Data that you provided to us in a structured, machine-readable format, and you have the right to transmit that Personal Data to another Data Controller. This is your right to Data Portability.
- You have the right to have your Personal Data corrected if it is inaccurate or incomplete.
- You have the right to request access to your Personal Data that we store.
To exercise any of these rights, write us at the address above, or send us an email (also above).
What Personal Data do you collect about me?
This table provides an overview of the Personal Data we collect.
| Type | Examples | Purpose | Category of Personal Data |
|---|---|---|---|
| Contact information | Email address | To identify you as a unique user, to respond to your requests and to send service- and Account-related emails | Identifiers |
| Account information | Name, email, password | To provide you with access to and use of the Service | Identifiers |
| Billing information | Credit card information, billing address, phone number | To process billing for the Service (if you subscribe to Nirvana Pro) | Identifiers; Commercial Information |
To whom do you transfer my Personal Data?
As explained in the general Privacy Policy, we use third party services. This may mean that your Personal Data is transferred to third parties. We can assure you that we are very careful as to which third party services we use, and any Personal Data transferred to them is only used in a manner consistent with our policies as described in the general Privacy Policy.
The following is a complete listing and description of where your Personal Data may be transferred.
| Third Party | Data Sent | Purpose | Country |
|---|---|---|---|
| Paddle | Name, credit card information, billing address, phone number | To process billing for Nirvana Pro | US / UK |
| Stripe | Name, credit card information, billing address, phone number | To process billing for Nirvana Pro (legacy subscriptions only) | US |
| Recurly | Name, credit card information, billing address, phone number | To process billing for Nirvana Pro (legacy subscriptions only) | US |
| RevenueCat | Hashed internal subscriber ID, App Store receipt data | To verify and manage subscription entitlements for Nirvana Pro (App Store and Google Play) | US |
| MailChimp | Email address | To manage our mailing list | US |
| Postmark | Email address, name, email content | To send transactional emails (e.g. password resets, account notifications) | US |
| PostHog | Internal user ID, feature usage events (no task content) | To analyse product usage in order to improve the Service | EU |
| Google Analytics | IP address, browser information | To analyse our user base in order to improve the Service | US |
| Google Cloud Platform (GCP) | All Personal Data processed by the Service | To host and operate the Service infrastructure | US |
| PlanetScale | All Personal Data stored by the Service | To provide the primary database for the Service | US |
| Vercel | IP address, browser information, account data | To host and operate the Nirvana website and account pages | US |
AI Features
The following applies only to users who have opted into Nirvana AI. If you have not opted in, none of the processing described in this section applies to you.
By opting into Nirvana AI, you consent to your task content and AI chat messages being processed by Google Gemini in order to generate AI responses. This processing is carried out solely for the purpose of providing the AI features you have requested, and your data is not used to train Google's models.
| Third Party | Data Sent | Purpose | Country |
|---|---|---|---|
| Google Gemini | Task content and AI chat messages | To power Nirvana AI features for opted-in users | United States |
You may withdraw your consent and opt out of Nirvana AI at any time through your Account settings, after which no further task content will be sent to Google Gemini.
How do you protect my Personal Data and where do you store and transfer it?
We take the security of your Personal Data seriously. Our website uses Secure Sockets Layer ("SSL") encryption for all communications with the Service. Furthermore, we use Google Cloud Platform (GCP) servers located in the United States, and these servers are secured and inaccessible by third parties.
We may transfer Personal Data from the European Economic Area (EEA) to the United States. We work with third-party service providers who participate in the EU-US Data Privacy Framework or who implement appropriate safeguards such as Standard Contractual Clauses (SCCs) to protect your Personal Data.
How long do you keep my Personal Data?
We will retain your Personal Data for as long as it is needed to provide you with the Service. You can close your Account at any time, and you can ask us to delete your Personal Data as described further above in this notice. If you don't use your Account, we will delete your Personal Data 1 year after your last log-in to the Service.
Changes to this Privacy Notice
We may change this privacy notice from time to time. Any changes to this privacy notice will be posted here, and we may inform you via email to your registered email address if the changes are significant. You are responsible for periodically checking this privacy notice for updates.
Last updated: March 25, 2026