Privacy Policy

Effective date: 24 June 2026  ·  Last updated: 1 October 2026

1. Who we are

This Privacy Policy explains how Niravi Inc. ("Niravi", "we", "us", or "our") collects, uses, and protects your personal data when you use our marketing site (niravi.io), our web application (web.niravi.io), and our API (api.niravi.io) (together, the "Service"). Niravi is a video intelligence platform for search, recall, and analysis over video.

For the purposes of the EU/UK General Data Protection Regulation (GDPR), Niravi Inc. is the data controller of the personal data described in this policy.

Niravi Inc., a Delaware C-corporation.
Postal address: 1111B South Governors Ave, Ste 94007, Dover, DE 19904, USA
Privacy contact: [email protected]

2. What data we collect

We collect the following categories of personal data:

• Account data. When you sign up or sign in, authentication is handled by our identity provider, Auth0 (an Okta company). We receive your email address, name (where provided), and an account identifier. We do not store your password — credentials are managed by Auth0.
• Content you upload for processing. Videos, audio, images, and related metadata that you (or your organisation) submit to the Service so that we can index, search, transcribe, and analyse them on your behalf, together with the analysis outputs we generate from that content.
• Usage data. Information about how you interact with the Service, such as features used, queries run, and actions taken.
• Technical and log data. IP address, browser and device type, and server log information generated when you access the Service, used for security, debugging, and service reliability.
• Website visit data. When you visit niravi.io or download our app, we log each page request or download: your IP address, the approximate location and timezone derived from it (country, region, city), your network provider, the page requested and any campaign tags in its link (utm parameters), the referring page, your browser's preferred language, and its user-agent string. A small first-party script on niravi.io also reports, without cookies, which download, call-to-action and outbound links you click, how far down a page you scroll (25/50/75/100%), and how many seconds the page was visible. We use this to understand how the site is used, to measure downloads, and to detect abuse. No cookie or other identifier is placed on your device for this. Legal basis: legitimate interests (Art. 6(1)(f)).
• App update checks. Once a day, the Niravi ACE desktop app asks our server whether an update is available. That request carries your IP address (and the location and network provider derived from it), the app version, a random install identifier created by the app on first launch, and a basic device profile: macOS version, chip, Mac model, memory, processor count, and language setting. It carries nothing about your files, your library, or your identity. We use it to count active installs, see which versions and Macs are in use, and support you. You can turn it off with defaults write io.niravi.ace ace.shareInstallInfo -bool false; update checks keep working without it. Legal basis: legitimate interests (Art. 6(1)(f)).
• Niravi's cloud (Nira, voice, pictures, stock). Niravi ACE does its indexing and search on your Mac. Some things it does through our server at api.niravi.io instead, and only then is anything sent:
  • Asking Nira, when you have not set up a key or a model of your own: your question and the earlier messages of that conversation, the passages Nira read to answer it, and the names of those files (never their paths). We pass them to the model on Microsoft Azure that writes the answer.
  • Narration (voice): the words of the line to be spoken. Microsoft Azure speaks them.
  • Pictures: the words you asked for and the shape of the picture. Google makes the picture.
  • Stock: the words you searched for. We ask the stock libraries (Pexels, Unsplash and Freesound) and send back what they found; the libraries see our server, not your Mac. When you take a stock file, our server confirms the take with that library, and your Mac then downloads the file from the library's own servers, which see your IP address and the app version, but not your install identifier or token. If you sign in to Freesound, the sign-in passes through our server because it holds Niravi's Freesound key. Your Freesound token goes back to your Mac, travels through our server only when you take a Freesound sound, and is never stored or logged by us.
  Every one of these requests also carries your IP address, the app version, a token the app gets from our server the first time it asks, and, unless you turned it off, the same random install identifier the update check sends. The install identifier is there so that our counts belong to one Mac.
  What we keep is counts, not content: for each Mac and each day, how many answers, lines, pictures, stock searches and stock files it used, how many failed or were refused, the number of characters spoken and tokens used, and what they cost us. Beside those counts we keep the install identifier, the app version, and when that Mac first and last asked. To limit how many new Macs one network can sign up in a day, we count sign-ups against a keyed hash of the network address, not the address itself. We do not keep your questions, the passages, the words you asked for, or what came back. Our server logs record the same counts and identifiers (see "Technical and log data" above), never the content.
  We use this to apply each Mac's daily limits, to see what the service costs, and to stop abuse. The same command, defaults write io.niravi.ace ace.shareInstallInfo -bool false, stops the app sending the install identifier here too, from the next time the app starts; the counts are then kept against the token alone. Answering with your own key or a model on your Mac keeps your questions off our server, and NIRAVI_RELAY_URL=off in ~/.niravi-ace/env (or ~/.arrow/env on a Mac that had Arrow) stops every one of these requests. Legal basis: performance of a contract (Art. 6(1)(b)) for sending what you asked for, and legitimate interests (Art. 6(1)(f)) for the counts.
• Cookies. Strictly-necessary authentication and session cookies. See our Cookie Policy for details. We do not set advertising or third-party tracking cookies.

3. Purposes and legal bases

We process your personal data for the following purposes, relying on the legal bases in Article 6 GDPR:

• To provide the Service — creating and maintaining your account, processing the content you submit, and returning analysis and search results. Legal basis: performance of a contract (Art. 6(1)(b)).
• To secure and improve the Service — preventing abuse, maintaining reliability, debugging, and improving features. Legal basis: our legitimate interests (Art. 6(1)(f)) in running a secure, functional service.
• To communicate with you — service announcements and responses to your requests. Legal basis: performance of a contract and/or legitimate interests.
• Where you give consent — for any processing that requires it (for example, optional future analytics or marketing communications). Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time.
• To comply with the law — where we are subject to a legal obligation. Legal basis: legal obligation (Art. 6(1)(c)).

4. Cookies

We minimise cookies. The Service sets only strictly-necessary authentication and session cookies (via Auth0). We use no analytics, advertising, or social-media tracking cookies. Website visits are measured from server request logs, without cookies (see Section 2). Fonts are self-hosted, so no font data is transferred to a third party. For full details, see our Cookie Policy.

5. Sub-processors and infrastructure providers

We use a small number of trusted infrastructure providers ("sub-processors") to operate the Service. Some of these providers may process data outside the European Economic Area (EEA); see Section 7 for the safeguards we apply.

We may update this list as our infrastructure evolves; material changes will be reflected in this policy.

6. Data retention

We retain personal data only for as long as necessary to provide the Service and to meet our legal, accounting, and security obligations. Account data is retained for the life of your account. Content you upload is retained until you delete it or close your account, after which it is removed from active systems within a reasonable period, subject to routine backup cycles. Technical and log data, including website visit and app update-check data, is retained for up to three months for analytics, security, and debugging. The per-Mac daily counts, the install registry (install identifier, app version, first and last seen) and the sign-up counters described under "Niravi's cloud" are not log data: we keep them as service and billing records for as long as Niravi's cloud runs. We have not yet set a fixed deletion period for them, and will state one here when we do. After you close your account, we delete or anonymise your personal data within 90 days, except where we are required to retain it longer to comply with legal, tax, accounting, or security obligations, or to resolve disputes.

7. International transfers and safeguards

Because our providers (Microsoft Azure, Google Cloud, Cloudflare, and Auth0/Okta) operate globally, your personal data may be transferred to and processed in countries outside the EEA, including India and the United States. Where we transfer personal data outside the EEA/UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs) and equivalent UK mechanisms, together with any supplementary measures required to ensure an adequate level of protection.

8. Your rights

Subject to applicable law, you have the right to access your personal data, request rectification of inaccurate data, request erasure, obtain data portability, object to certain processing, and request restriction of processing. Where we rely on consent, you may withdraw it at any time. You also have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law.

California residents (CCPA/CPRA) and residents of India under the Digital Personal Data Protection Act, 2023 (DPDP Act) have analogous rights, including rights of access, correction, and deletion. You can exercise these rights using the same contact above; we do not "sell" personal data as that term is defined under California law.

9. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including encryption in transit, access controls, and use of reputable infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children

The Service is not directed to children. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after an update constitutes acceptance of the revised policy.

12. Contact

Questions about this policy or our data practices? Contact us at [email protected], or write to us at: Niravi Inc., 1111B South Governors Ave, Ste 94007, Dover, DE 19904, USA.