Privacy Policy

• Our personas are synthetic: statistical composites built from public census and survey aggregates. We do not collect, scrape or buy data about real social-media users.
• We collect what we need to run your account: your email, name, sign-in details and what you upload or ask us to test.
• Your creatives and pages are processed to run your tests and are never used to train shared AI models.
• We use only essential cookies — no advertising or analytics trackers.
• You can delete your workspaces and ask us to delete your account at any time.

The personas in your results are not people. They are generated from aggregate statistics; their names, jobs and stories are illustrative and do not describe any real individual.

• To provide the service (performance of our contract with you): run your tests, read your creatives, crawl the pages you submit, show results, operate chat, manage credits and plans.
• To keep it secure (legitimate interests): authenticate you, prevent abuse and fraud, rate-limit sign-in attempts, keep audit records.
• To communicate with you (contract and legitimate interests): verification and password emails, service and billing notices, replies to support requests.
• To improve Nivera (legitimate interests): aggregate, de-identified usage and cost metrics. We do not use your creatives, pages or results to train shared models unless you explicitly opt in.
• To meet legal obligations: tax, accounting and lawful requests.

To read your creatives and simulate persona reactions, the content of your tests (creative files and copy, captured pages and test settings) is sent to AI models hosted on Google Cloud Vertex AI (including Anthropic Claude and Google Gemini models). These providers process it on our behalf under their enterprise terms, which do not permit using your content to train their models.

Results are simulations and predictions; they are not decisions about any real person.

We do not sell or rent personal data. We share it only with service providers that help us run Nivera, under contracts that limit their use of it:

We may also disclose data if required by law, to protect our rights or users' safety, or as part of a merger or acquisition (with notice to you). Workspace members can see that workspace's tests and results; share links you create show a read-only report to anyone holding the link until you revoke it.

Our providers may process data in the United States and other countries. Where data protection law requires it, transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.

• Account data: while your account is open, then deleted or anonymised within 30 days of closure.
• Workspaces, uploads and results: until you delete them or the workspace. Deleting a workspace removes its uploaded files and test data.
• Sessions and security logs: sign-in sessions last up to 30 days; security records are kept for up to 180 days.
• Billing records: as long as tax and accounting law requires (typically up to 7–10 years).
• Backups roll over and are overwritten within 35 days.

We use only cookies that are strictly necessary to run the service:

We do not use advertising, cross-site tracking or third-party analytics cookies. If that changes, we will update this policy and ask for consent where required.

Data is encrypted in transit (TLS) and at rest, passwords are stored only as salted argon2 hashes, workspaces are isolated from each other, and access to production systems is restricted. No system is perfectly secure; if a breach affects your personal data we will notify you and regulators as the law requires.

Depending on where you live — including the EU/EEA and UK (GDPR), California (CCPA/CPRA), India (DPDP Act 2023), the UAE, Saudi Arabia, Singapore (PDPA), Canada (PIPEDA) and Australia (Privacy Act) — you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to a data protection authority.

You can edit your account details and delete workspaces in Settings. For anything else, email privacy@nivera.tech; we respond within 30 days (sooner where the law requires). We do not sell or “share” personal data for cross-context behavioural advertising.

Nivera is a business tool for people aged 18 and over. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

We will post changes here and update the date above; for material changes we will notify account holders by email or in the app. Questions or requests: privacy@nivera.tech · [Nivera legal entity name], [registered address].