Privacy Policy

Last updated: September 26, 2026

This Privacy Policy explains what personal data Nivlus ("Nivlus," "the Platform," "we," "us") collects, why we collect it, who we share it with, and the choices and rights you have — including specific rights available to you under the EU/EEA General Data Protection Regulation ("GDPR").

Nivlus is operated by Vela Sebhan (a Norwegian sole proprietorship), which acts as the data controller for the personal data described in this policy.

Nivlus is a new, early-stage (beta) platform, and this policy may be updated as our data practices and the product evolve — see Section 9.

1. What data we collect

We do not currently use third-party analytics or advertising trackers. If that changes, we'll update this policy and Section 7 (Cookies) before doing so.

2. How we use your data

We use the data described above to:

• Create and manage your account.
• Let Posters and Developers find each other, communicate, and agree on projects.
• Process payments, hold funds until release, calculate the Platform fee, and process refunds — via Stripe.
• Review reports of spam, inappropriate content, or fraud, and enforce our Terms of Service.
• Keep the Platform secure and prevent abuse.
• Communicate with you about your account, transactions, or changes to the Platform.
• Comply with legal obligations (for example, tax or accounting record-keeping related to payments).

3. Legal basis for processing (GDPR)

If you're in the EU/EEA (or another jurisdiction with similar requirements), we rely on the following legal bases:

• Performance of a contract — most of what we do (creating your account, showing your idea to Developers, processing payment) is necessary to provide the service you've signed up for.
• Legitimate interests — for example, reviewing reports to keep the Platform safe, or basic security logging — balanced against your right to privacy.
• Legal obligation — for example, retaining transaction records for tax/accounting purposes.
• Consent — where we ask for it specifically (for example, optional communications, if introduced later).

4. Who we share data with

We share data with the following third parties, each acting as a processor on our behalf (or, for Stripe, in some respects also as an independent controller for its own regulatory compliance):

• Supabase — our database, authentication, and hosting provider. Supabase stores your account data, idea/project content, messages, and report records, and manages login sessions. See Supabase's privacy policy.
• Stripe (including Stripe Connect) — our payment processor. Stripe handles the actual collection, holding, and payout of funds, and stores your payment method details directly — we never see or store your full card number. See Stripe's privacy policy.

We do not sell your personal data. We only share data with other third parties if required by law, to protect our rights, or as part of a business transfer (e.g., a merger or acquisition), in which case we'll update this policy.

Other users of Nivlus can see: your name and bio on your public profile, ideas you've posted, and messages within a conversation you're part of. Reports you file are not visible to other users, or shown back to you after submission — they're only accessible to us via privileged administrative access.

5. International data transfers

Nivlus operates globally, and our infrastructure providers (Supabase, Stripe, Google) may process and store data outside the country you're in, including outside the EU/EEA. Where personal data of EU/EEA users is transferred outside the EU/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or the provider's own adequacy/compliance mechanisms (for example, Stripe's and Google's respective data-transfer frameworks). Our main database, hosted by Supabase, is located in the EU (Ireland).

6. How long we keep your data

• Account data is kept for as long as your account is active. When you delete your account, it's removed or anonymized immediately (see Section 8) and can't be restored.
• Transaction and payment records are kept for 5 years as required by applicable tax/accounting law, even after account deletion.
• Messages tied to a project are kept as part of the project record, primarily to support dispute resolution, for 5 years.

Where records are kept after you delete your account, they're anonymized (no longer linked to your name or email) and deleted when the retention period ends.

7. Cookies and similar technologies

Nivlus currently uses only the cookies necessary to keep you signed in and your session secure (set by our authentication provider, Supabase). We do not currently use cookies for advertising or third-party tracking. If that changes — for example, if we add analytics — we'll update this section and, where required, ask for your consent first.

8. Your rights (GDPR and beyond)

If you're in the EU/EEA, UK, or another jurisdiction with similar data-protection laws, you have the right to:

To exercise any of these rights, contact us at hello@nivlus.com. We'll respond within the timeframe required by applicable law (generally one month under GDPR).

You can also do two of these yourself, at any time, from your profile page:

• Download my data gives you a copy of the personal data we hold about you, in a machine-readable (JSON) format.
• Delete my account removes your login, email, name, bio, follows and notifications, and deletes your ideas and conversations — except where they involve a payment. Transaction records, and conversations tied to a payment, are kept in anonymized form (no longer linked to your name or email) for the retention periods in Section 6. An account can't be deleted while a payment is still in progress or under dispute.

9. Children's privacy

Nivlus is not intended for use by anyone under 18 years old, consistent with our Terms of Service, given the Platform involves real payments. We don't knowingly collect data from children below this age. If you believe a child has created an account, contact us so we can remove it.

10. Changes to this policy

We may update this Privacy Policy as Nivlus develops. We'll update the "Last updated" date above, and for material changes, we'll try to give you reasonable notice (for example, via email or an in-app notice) before they take effect.

11. Contact us

For any questions about this Privacy Policy, or to exercise your data rights, contact us at hello@nivlus.com. For general help with your account, contact support@nivlus.com.