Your data.
Your rights.

1. Who we are

Nikmani Inc. is a technology company incorporated in Canada and headquartered in Toronto, Ontario. We operate the Nikmani accounting platform available at nikmani.com and app.nikmani.com. When this policy refers to "Nikmani," "we," "us," or "our," it means Nikmani Inc.

This policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law, and with Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, which imposes additional obligations for personal information collected from Quebec residents.

2. What personal information we collect

We collect only the information necessary to provide you with the Nikmani platform, consistent with PIPEDA Schedule 1 Principle 4 (Limiting Collection). We collect information in three ways: information you provide directly, information generated by your use of the platform, and information from third-party services you connect.

Information you provide

• Account information: your name, email address, and password when you create an account.
• Business information: your business name, type, province of operation, and GST/HST number if you choose to provide it.
• Financial data: transactions, receipts, invoices, bank statements, and other financial records you upload, enter, or connect to the platform. This is the core data of the service and is held with the highest level of care.
• Payment information: your credit card or payment details when you subscribe to a paid plan. Payment information is processed directly by Stripe Inc. and is never stored on Nikmani's servers. We receive only a masked card summary and subscription status from Stripe.
• Communications: messages you send us through our contact form, support tickets, or email.

Information generated automatically

• Usage data: which features you use, how often, and how you interact with the platform.
• Technical data: browser type, operating system, IP address, and device information.
• Log data: actions taken within the platform, error reports, and security events.

Information from connected services

• Bank import data: transaction history you import into the platform via CSV export from your bank. Direct bank connections for Canadian institutions are in development and are not yet active; we will update this policy before enabling them and obtain any required additional consent.

We do not collect sensitive categories of personal information such as health data, racial or ethnic origin, political opinions, religious beliefs, or biometric data.

3. How we use your information

We use your information solely to provide, operate, and improve the Nikmani platform. Specifically, we use it to:

• Create and manage your account and subscription.
• Provide the accounting features you have subscribed to, including transaction tracking, invoicing, reporting, and financial analysis.
• Power AI-assisted features including receipt scanning, automatic transaction categorization, PDF import, and the AI Consultant, where you have consented to AI processing.
• Generate financial reports, forecasts, and business insights based on the data you enter.
• Process your subscription payments and send payment confirmations and receipts.
• Send transactional notifications required for the service, such as security alerts and account changes.
• Send product updates and tips by email, if you have opted in to marketing communications.
• Respond to your support requests and resolve technical issues.
• Detect, prevent, and investigate security incidents, fraud, and abuse.
• Improve the reliability, accuracy, and performance of the platform through aggregated and anonymized analysis.
• Comply with our legal obligations under applicable Canadian law.

4. Legal basis for processing

PIPEDA is a consent-based framework. For each use of your personal information, we rely on one of the following legal bases:

• Explicit consent: for collecting and processing your personal information to provide the service; for AI processing of your financial data through Anthropic's systems; and for optional marketing communications. Your consent is recorded when you accept this policy and the consent modal in the platform.
• Contract performance: processing that is necessary to deliver the service you have subscribed to, including account management, payment processing, and generating reports from data you enter.
• Legitimate interest: processing for security purposes, fraud prevention, and aggregated service improvement, where these interests do not override your privacy rights and where the processing would be reasonably expected by you.
• Legal obligation: processing required to comply with a court order, regulatory obligation, or applicable Canadian law.

You have the right to withdraw consent at any time for processing that is based on consent. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal. Withdrawing consent for core service processing will require account closure. You may withdraw consent for AI processing or marketing emails at any time from your account Settings without closing your account.

5. International transfers and cross-border disclosure

Data residency. All Nikmani data is stored on servers located in Canada. We use Amazon Web Services infrastructure in the ca-central-1 region (Montreal, Canada). Canadian data residency is the default and only option for all accounts.

Cross-border transfers for AI features. When you use AI-powered features (including automatic categorization, receipt scanning, PDF import, and the AI Consultant), descriptions of your transactions, receipt text, and document content are sent to Anthropic PBC, headquartered in San Francisco, California, United States. This constitutes a cross-border transfer of personal information outside of Canada. By consenting to AI features, you consent to this transfer. Pursuant to our agreement with Anthropic, Anthropic does not use this data to train its AI models and processes it solely to generate the requested output.

Payment processing. Payment card details are submitted directly to Stripe Inc. (United States), which processes payments on our behalf. Stripe receives only what is necessary to process your payment and does not receive your financial business data.

Email delivery. Transactional emails (account confirmations, security alerts, billing notices) are sent via Resend Inc. (United States). Resend receives your email address and the content of transactional messages only.

Contractual protections. All cross-border transfers are governed by data processing agreements requiring the recipient to provide a level of protection substantially equivalent to that required by Canadian law. For Quebec residents, we have conducted privacy impact assessments (PIAs) for each cross-border transfer as required by Quebec Law 25, and we confirm that adequate protections are in place before each transfer.

6. Service providers and sub-processors

We engage the following service providers to operate the platform. Each provider receives only the data necessary for their specific role and is bound by a data processing agreement with Nikmani:

• Supabase Inc. (database hosting and authentication): operates on Amazon Web Services infrastructure in the ca-central-1 region (Montreal, Canada). Receives all personal data stored in the platform.
• Amazon Web Services Inc. (AWS): underlying cloud infrastructure provider, operating in the ca-central-1 region (Montreal, Canada).
• Stripe Inc. (payment processing, United States): receives payment card details and subscription information only. Does not receive your financial business data.
• Anthropic PBC (AI processing, United States): receives transaction descriptions, receipt text, and document content when you use AI features. Does not use this data for model training under our agreement.
• Resend Inc. (transactional email, United States): receives your email address and the content of account-related notifications.

We do not share your data with any other third parties for their independent commercial purposes. We may share data when required by a court order, applicable law, or to protect the safety and rights of our users.

7. AI processing and automated decision-making

How AI is used. Nikmani uses Anthropic's Claude AI model to power certain features, including automatic transaction categorization, receipt and document scanning, PDF data extraction, and the AI Consultant chat. When you use these features, relevant data (such as transaction merchant names, amounts, dates, and receipt text) is transmitted to Anthropic's API for processing, and a response is returned to the platform.

Anthropic's data use. Pursuant to our agreement with Anthropic, Anthropic does not use data submitted through Nikmani to train or improve its AI models. Anthropic processes your data solely to generate the requested output.

Nature of AI outputs. AI-generated categorizations and other outputs are suggestions for your review. They are not final decisions. You retain full control to review, modify, or override any AI-generated output at any time. No AI output on the Nikmani platform produces a legal effect or a significantly significant effect on you without your review and confirmation.

Disabling AI features. You may disable AI features at any time from your account Settings, after which no data will be sent to Anthropic for processing.

8. How long we keep your information

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law (PIPEDA Schedule 1 Principle 5):

• Active accounts: your personal information and financial data are retained for as long as your account is active and for a reasonable period thereafter to allow account reactivation if desired.
• After account deletion: within 30 days of your account deletion request, all of your personal information and financial data in the Nikmani platform will be permanently and irreversibly deleted. This includes transaction records, invoices, profile data, and all related data.
• Payment records: Stripe retains records of payment transactions for the period required by their own legal obligations. We retain only a masked reference to your subscription status.
• Security and audit logs: retained for 90 days to support security investigations, then permanently deleted.
• Legal hold: in exceptional circumstances, we may be required by a court order, regulatory inquiry, or applicable law to retain certain information beyond the periods above. We will retain only what is legally required and delete it as soon as the obligation expires.
• Anonymized aggregate data: data that cannot be linked to any individual may be retained indefinitely for service improvement purposes.

9. How we protect your information

We implement technical and organizational security measures appropriate to the sensitivity of the personal information we hold, consistent with PIPEDA Schedule 1 Principle 7 (Safeguards):

• All data is encrypted in transit using TLS 1.2 or higher.
• All data is encrypted at rest using AES-256 encryption.
• Role-based access controls limit internal access to personal data to only what is necessary for each function.
• Column-level database access controls prevent unauthorized modification of sensitive account fields.
• Two-factor authentication is available and strongly encouraged for all accounts.
• Regular internal security reviews and system monitoring.
• Daily encrypted backups stored in Canada.
• Audit logging of all administrative actions for 90 days.

Despite these measures, no method of transmission over the internet or electronic storage is completely secure. We will notify you of any breach affecting your personal information as described in Section 11.

10. Your rights

Under PIPEDA and Quebec Law 25, you have the following rights with respect to your personal information. These rights may be exercised at any time by contacting us at privacy@nikmani.com or, where noted, through your account Settings page. We respond to all requests within 30 days and will never charge a fee for exercising your rights.

• Right of access (PIPEDA Principle 9): you have the right to request confirmation of whether we hold personal information about you and, if so, to receive a copy in a generally understandable format.
• Right to rectification: you have the right to request correction of inaccurate or incomplete personal information we hold about you. You may update your name and email directly from your account Settings.
• Right to erasure (Law 25): you have the right to request deletion of your personal information. You may permanently delete your account and all associated data from your account Settings at any time. Deletion is completed within 30 days and is irreversible.
• Right to data portability (Law 25): you have the right to receive your personal information in a structured, commonly used, machine-readable format. A complete data export in JSON format is available at any time from your account Settings.
• Right to withdraw consent: you may withdraw consent for AI processing or marketing emails at any time from your account Settings, without penalty. Withdrawal does not affect the lawfulness of prior processing.
• Right to de-indexing (Law 25): if your personal information has been made publicly available, you have the right to request de-indexing. Nikmani does not publish your personal information publicly; this right is noted for completeness.
• Right to contest automated decisions (Law 25): you have the right to request that a person review any matter involving automated processing of your personal information. See Section 7.
• Right to lodge a complaint: if you are not satisfied with how we have handled your personal information, you may file a complaint with our Privacy Officer at privacy@nikmani.com or with the regulatory authorities listed in Section 15.

In some cases, we may need to verify your identity before fulfilling a request. We will never deny a request without explanation.

11. Breach notification

In the event of a security breach involving your personal information, we will:

• Notify you: as soon as reasonably possible when a breach creates a real risk of significant harm to you, by email to the address on your account, describing the incident and steps we are taking.
• Notify the OPC: notify the Office of the Privacy Commissioner of Canada as required by PIPEDA where the breach creates a real risk of significant harm.
• Notify the CAI (Quebec): for breaches affecting Quebec residents where there is a risk of serious injury, notify the Commission d'acces a l'information within 72 hours of becoming aware of the breach, as required by Quebec Law 25.
• Maintain a breach register: keep a record of all privacy incidents for a minimum of 24 months, as required by applicable law.

12. Cookies and tracking technologies

We use cookies and similar technologies solely to operate the platform and understand how it is used:

• Session cookies: required to keep you logged in during your session. Without these, the platform cannot function.
• Preference cookies: store your display preferences such as theme and language selection.
• Analytics cookies: aggregate, anonymized usage data to help us improve the platform. We do not use third-party advertising analytics networks.

We do not use cookies for advertising, cross-site tracking, or behavioral profiling. You may control cookies through your browser settings; disabling session cookies will prevent you from logging in to the platform.

13. Children's privacy

The Nikmani platform is designed exclusively for use by adults (18 years of age and older) operating businesses. We do not knowingly collect personal information from any person under the age of 18. If you believe we have inadvertently collected personal information from a minor, please contact us immediately at privacy@nikmani.com and we will delete it promptly.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the platform, or applicable law. When we make changes:

• Material changes: we will notify you by email at least 14 days before a material change takes effect, describing what has changed and why.
• Consent renewal: for changes that materially affect the purposes for which we collect or use your personal information, we will re-present the consent process in the platform and require your renewed consent before the change takes effect for your account.
• Continued use: continued use of the platform after a non-material change takes effect constitutes your acceptance of the updated policy.
• Version tracking: the version of this policy you consented to is recorded in your account profile. You may view your consent history from your account Settings.

The "Last updated" date at the top of this page indicates when the most recent changes were made.

15. Contact and complaints

For any privacy-related questions, requests, or concerns, please contact our Privacy Officer:

• Privacy Officer: Reza Najafi
• Email: privacy@nikmani.com
• Mail: Nikmani Inc., Attention: Privacy Officer, Toronto, Ontario, Canada

We will acknowledge your request within 5 business days and provide a full response within 30 days. If you are not satisfied with our response, you have the right to escalate your complaint to the applicable regulatory authority:

• Office of the Privacy Commissioner of Canada (OPC): priv.gc.ca  |  1-800-282-1376
• Quebec Commission d'acces a l'information (CAI): cai.quebec.ca  |  1-888-528-7741