Legal
Privacy Policy
This Privacy Policy is the public notice of Devxnext Canada Inc. regarding personal information collected in connection with Nimva. It is drafted to describe our actual practices and to meet the transparency expected under the Personal Information Protection and Electronic Documents Act (Canada) and, where they apply, the laws identified below. It does not waive any right the law does not allow you to waive. It is not a substitute for advice from your own lawyer. This draft is prepared for review by Canadian counsel; publication does not mean counsel has signed off.
1. Accountability
Devxnext Canada Inc. (“Nimva,” “we,” “us,” or “our”), a corporation organized under the laws of Canada, with its principal place of business at Woodbine Steeles Corporate Centre, 7030 Woodbine Avenue, Suite 500, Markham, Ontario L3R 6G2, Canada, is accountable for personal information under its control. The Service is operated from Ontario, Canada. Soft-launch sales are aimed primarily at Canada. Sections below that mention Quebec, the EEA, the United Kingdom, or California apply only where those laws reach the processing described.
This Policy applies to the Nimva macOS application, the website at nimva.app, and related account, licence, and billing services (together, the “Service”). It does not apply to third-party websites, model providers, or payment networks except to the extent we describe our relationship with them.
| Data | Leaves your Mac? | Who receives it |
|---|---|---|
| Dictation microphone audio / on-device transcript for speech recognition | No | Stays on your Mac |
| Account email, auth, licence status | Yes | Supabase (auth/licence); Nimva operators |
| Payment and tax metadata | Yes | Stripe (card data under Stripe’s notice) |
| Transactional and reminder emails | Yes | Email delivery provider (currently Resend), acting for Nimva |
| Optional rewrite transcript (off by default) | Only if you enable rewrite | Your chosen model provider, from your Mac — not via Nimva servers |
| Optional dictionary backup (off by default) | Only if you enable it | Account storage with Supabase — never audio |
Privacy officer for the purposes of this Policy: the person designated by Devxnext Canada Inc. to receive privacy requests, reachable at hello@nimva.app. Please write “Privacy request” in the subject line and include the email address on your Nimva account. Postal notices may be sent to the Markham address above.
We have not appointed a representative in the European Economic Area or the United Kingdom. If the volume of accounts in those places makes an Article 27 representative of the GDPR or UK GDPR required, we will name that representative in an updated version of this Policy. Until then, you may contact us at the address above and, where the law gives you the right, your local supervisory authority.
2. What this Policy covers, and what it does not
Speech recognition for dictation is performed on your Mac with local speech models. Microphone audio used for that recognition is not uploaded to Nimva, to Supabase, or to Stripe for transcription. Successful recording files are deleted on the device after transcription. Failed or cancelled recordings may remain in a private folder on that Mac until you retry them, discard them, or they are removed by the application’s cleanup.
On macOS, Nimva may request Microphone (to capture speech locally), Accessibility (to insert text into the field that was active when recording began), and Input Monitoring (to detect the global shortcut). Those permissions are granted or refused in System Settings by you. Granting Accessibility does not mean Nimva uploads the contents of other applications to our servers for recognition.
On Windows (when a Windows client is made available after our Dual-OS QA gate), speech recognition likewise runs on your PC with local models. Microphone audio used for recognition is not uploaded to Nimva for transcription. Nimva may use UI Automation and related focus APIs to insert text into the application that was active when recording began, and a keyboard hook to detect the global shortcut. Session tokens, licence cache metadata, and optional rewrite API keys are stored in Windows Credential Manager. For trial claim and device-session limits, the Windows app may send a privacy-preserving hash derived from the PC’s machine identifier (or a local fallback identifier under your user profile). That hash is not used for advertising. Device sessions may be labelled as Mac or Windows so you can see which seats are in use.
Local history, notes, and dictionary entries are stored on your Mac under ~/Library/Application Support/LocalAIDictation/ with restricted file permissions. That storage is not full-disk encryption. You may clear or export local history in the application. We do not receive that local store unless you separately send it to us, for example in a support email.
The optional feature “Use my model for rewrite” is off by default. If you leave it off, transcript text is not sent to a model provider for rewrite.
3. Categories of personal information
3.1 Account and licence
If you create an account or sign in, we process your email address, authentication identifiers, session tokens, and licence status (including plan, trial, active, past due, or inactive). Session tokens on a Mac are stored in the macOS Keychain; on Windows they are stored in Windows Credential Manager. Licence status may be cached on the device for a limited offline period so the application can determine whether dictation outside any preview is permitted.
3.2 Billing
Payments are processed by Stripe. We do not store your full payment-card number. Stripe may receive your name, email, billing address, tax identifiers you choose to enter, and payment-method details. We receive subscription and invoice metadata needed to grant, renew, suspend, or revoke a licence, including plan, amounts, currency, tax shown by Stripe, and refund status.
3.3 Optional dictionary backup
This feature is off by default. If you enable it, spoken phrases and replacements you save may be stored with your account so they can be restored. Audio is not included.
3.4 Optional rewrite
If you turn rewrite on, supply your own API key, and choose Rewrite, transcript text is sent from your Mac or Windows PC to the provider you select, which may be OpenAI, Anthropic, Google, or OpenRouter. The API key remains in the macOS Keychain or Windows Credential Manager. Nimva, Supabase, and Stripe do not receive the key or the rewrite request. The provider’s terms and privacy notice govern that provider’s handling of the text. Rewrite output is machine-generated. You must review it before you rely on it or send it.
3.5 Website and support
If you choose light or dark appearance, that choice is stored in this browser under the name nimva-theme so a later visit matches. It is written only after you click that control. The sign-in page stores a Supabase session in this browser only while you complete login and return to the Mac application. That storage does not leave the browser except as the sign-in request needed to finish authentication.
nimva.app may use Google Analytics, PostHog, Microsoft Clarity, and Meta Pixel only after you Accept analytics on the site banner. Decline is offered with equal prominence. If you Accept, those providers may set cookies and receive page-view, click, funnel, heatmap, and—except on sign-in / auth pages—session-replay data (PostHog and Clarity) so we can understand how the website is used and how our Facebook/Instagram campaigns perform. We do not sell personal information. See the Cookie and tracking notice.
If you email us, we keep the message, the address you used, and our reply, so we can respond, handle refunds, and keep a record of the request.
3.6 Information we do not seek
We do not ask you to dictate government identifiers, payment-card numbers, or health records into Nimva. If you choose to speak or type such information into a document on your Mac, that act is yours. We do not receive dictation audio for recognition.
4. Purposes and legal grounds
We use personal information only for purposes a reasonable person would consider appropriate in the circumstances, including:
- to provide the Service, authenticate you, and determine whether a paid licence is active;
- to take payment, calculate tax through Stripe, issue invoices, and honour cancellation and refunds;
- to secure the Service, prevent abuse of licences, and investigate fraud or chargebacks;
- to respond to support and privacy requests;
- to meet legal duties, including tax and accounting record-keeping;
- to send transactional messages about an account or purchase;
- to measure and improve nimva.app, and measure our own paid social campaigns, with optional Google Analytics, PostHog, Microsoft Clarity, and Meta Pixel when you Accept; and
- to send commercial electronic messages only as described in section 7.
We do not sell personal information. We do not use dictation audio to train Nimva models. We do not place advertising or third-party analytics software-development kits in the Mac application.
Where the GDPR or UK GDPR applies, we rely on performance of a contract (account and paid Service), legitimate interests (security, licence enforcement, and service administration, balanced against your rights), and legal obligation (tax and accounting). We ask for consent where the law requires it, including for non-essential cookies and for marketing email.
5. Consent, and how to withdraw it
By creating an account, signing in, or paying for Nimva, you consent to the collection, use, and disclosure described in this Policy for those purposes, except where a statute requires a separate consent. You may withdraw consent to optional processing, including rewrite, dictionary backup, website analytics, and marketing email, subject to legal or contractual limits and to reasonable notice.
Withdrawal of consent to account or billing processing may mean we cannot provide the paid Service. It does not affect the lawfulness of processing that already occurred. Dictation that stays on your Mac does not depend on a cloud consent to Nimva for the audio itself.
6. Disclosure and service providers
We disclose personal information to service providers who process it for us, and only for the purposes in this Policy:
- Supabase — authentication and licence records. Hosting is outside Canada, typically in the United States, unless we later state a different region in this Policy.
- Stripe — payments, tax calculation, invoices, and the customer billing portal. Stripe handles card data under its own privacy notice as an independent controller of that payment data.
- Resend (or a successor email delivery provider we name in an update) — sends transactional account and billing email, and commercial messages only where CASL permits. Message content and recipient address are processed to deliver that mail.
- Google LLC (Google Analytics) — only if you Accept analytics on nimva.app. Processes website measurement data as described in the Cookie and tracking notice. Processing may occur outside Canada, typically in the United States.
- PostHog Inc. — only if you Accept analytics on nimva.app. Processes product analytics and masked session replays (not on sign-in / auth pages) as described in the Cookie and tracking notice. Processing may occur outside Canada, typically in the United States or another PostHog region we select.
- Microsoft (Clarity) — only if you Accept analytics on nimva.app. Processes website heatmaps, click data, and session recordings (not on sign-in / auth pages) as described in the Cookie and tracking notice. Processing may occur outside Canada, typically in the United States.
- Meta Platforms, Inc. (Meta Pixel) — only if you Accept analytics on nimva.app. Processes website event data for measuring our Facebook and Instagram ads and selected on-site actions, as described in the Cookie and tracking notice. Processing may occur outside Canada, typically in the United States. Meta may use events for ad delivery and measurement under Meta’s terms.
- Your chosen model provider — only if you enable rewrite and send a rewrite. The request goes from your Mac to that provider. We are not the recipient of that request.
We may disclose information if required by law, or if we reasonably believe disclosure is necessary to protect a person from harm, to investigate abuse of the Service, or to establish or defend a legal claim. We do not sell personal information. Optional Meta Pixel events after Accept are disclosed to Meta for measuring our ads and site actions as described in the Cookie and tracking notice; Meta may use those events for ad delivery and measurement under Meta’s terms.
7. Commercial electronic messages (CASL)
This section concerns messages Nimva sends to you. Nimva is not a platform through which you send campaigns to other people.
Receipts, licence notices, security alerts, and similar messages about a purchase or account are transactional. They identify Devxnext Canada Inc. and Nimva and include hello@nimva.app and our mailing address where identification is required.
We send commercial electronic messages, including product news or offers, only with your express consent, or another permission Canada’s Anti-Spam Legislation (S.C. 2010, c. 23) allows. Each such message will identify Devxnext Canada Inc., include our mailing address, and include a working unsubscribe mechanism. We honour an unsubscribe request within ten (10) business days. We keep a record of consent and of unsubscribe. We do not sell or rent your email address for another person’s marketing.
8. Cross-border processing
Nimva is operated from Ontario, Canada. Account and billing providers may store or access personal information in the United States or another country. Those countries may not provide the same legal protections as your home province or country. A foreign court, law-enforcement authority, or regulator may be able to compel a provider to disclose information held there.
Where required, we use contractual terms with processors. By creating an account or paying for Nimva, you acknowledge that account and billing information may be processed outside Canada. Dictation audio used for speech recognition is not part of that transfer.
9. Retention
- Local transcripts and history remain on your Mac until you delete them or remove the application data.
- Account and licence records are kept while the account exists, and for a limited period afterward to resolve disputes, refunds, chargebacks, and security incidents.
- Billing and tax records are kept for so long as applicable Canadian and other tax and accounting laws require, which may be several years after the transaction.
- Support correspondence is kept for so long as needed to handle the request and any related claim.
- Website analytics and ad-measurement records held by Google Analytics, PostHog, Microsoft Clarity, and Meta are retained according to the retention periods we configure with those providers and their product terms, and only for visitors who Accepted analytics.
When retention ends, we delete or de-identify the information, except where a law requires us to keep it or where it is in a backup that is overwritten on a cycle.
10. Your requests
You may request access to personal information we hold about you, correction of inaccurate information, and deletion, subject to records we are required to keep. Where a statute gives you the right, you may also request a portable copy of information you provided, object to or restrict certain processing, or withdraw consent.
Email hello@nimva.app with the subject “Privacy request” and the email address on your account. We may ask for information reasonably necessary to verify that the request comes from you or from a person authorized to act for you. We will respond within the time the applicable law requires. We will not deny a good or service, or charge a different price, because you exercised a privacy right, except where the law allows a difference that is reasonably related to the value of the data.
Deletion of your Nimva account does not delete text you already sent to a third-party model provider through optional rewrite. You must use that provider’s own tools and notices for that copy. We cannot delete information from a provider we do not control.
10.1 Canada, including Quebec
You may request access or correction under PIPEDA, and you may withdraw consent subject to legal or contractual restrictions and reasonable notice. If you are in Quebec, you may also request information about a decision based exclusively on automated processing that produces legal effects or similarly significant effects concerning you, where the Act respecting the protection of personal information in the private sector so provides, and you may file a complaint with the Commission d’accès à l’information du Québec. This Policy is published in English. A French version of consumer contracts intended for Quebec residents will be made available before an active sales campaign directed at Quebec.
10.2 European Economic Area and United Kingdom
You may lodge a complaint with a supervisory authority. A list of EEA authorities is published by the European Data Protection Board. Residents of the United Kingdom may contact the Information Commissioner’s Office. You may also contact us first so we can try to resolve the matter.
10.3 California
In the twelve (12) months before the effective date, the categories we collect are those described in section 3: identifiers such as email; commercial information such as subscription and invoice records; and internet or similar activity limited to the website events described above. We use them for the purposes in section 4. We do not sell personal information. If you Accept analytics, Meta Pixel events disclosed to Meta for measuring our Facebook and Instagram ads may be treated as a “share” for cross-context behavioural advertising under the CCPA/CPRA. Decline on the banner, or clear site data for nimva.app and Decline on a later visit, is how you opt out of that optional Meta measurement for future visits. We do not use sensitive personal information to infer characteristics. We do not knowingly sell or share personal information of consumers under 16 years of age. You may use an authorized agent where California law allows it.
11. Children
The Service is not directed to children. You must be at least sixteen (16) years of age to create an account. The person who pays must have the legal capacity to enter a binding contract in the place where that person lives. We do not knowingly collect personal information from a child under 16. If you believe we have done so, contact us and we will delete it.
12. Security
We use access controls appropriate to the sensitivity of the information, encrypted connections to account and billing providers, and the macOS Keychain for session tokens and optional rewrite keys. No method of storage or transmission is perfectly secure. You are responsible for the security of the Mac on which you install Nimva and for the confidentiality of your sign-in credentials.
13. Changes
We may update this Policy. We will change the effective date above. If a change is material, we will give notice in the application, on the website, or by email before the change applies, where the law or the nature of the change requires notice. Continued use after the effective date is acceptance of the updated Policy, except where the law requires a fresh consent.
14. Contact
Devxnext Canada Inc.
7030 Woodbine Avenue, Suite 500
Markham, Ontario L3R 6G2
Canada
hello@nimva.app
Related instruments: Terms of Service · Billing, cancellation, and refunds · Cookie and tracking notice.