Privacy Policy

1. Who we are and what this policy covers

Nirvana Network Corporation, doing business as Nirvana Labs ("Nirvana", "we", "us"), is a Delaware corporation with its principal office at 201 N Illinois St Ste 1600, Indianapolis, IN 46204-4218, United States. We provide high-performance cloud infrastructure: compute, storage, networking and Kubernetes.

This policy explains what personal information we collect, how we use it, who we share it with and the rights you have over it. It applies to:

• our websites at nirvanalabs.io and docs.nirvanalabs.io;
• the Nirvana dashboard at dashboard.nirvanalabs.io and the Nirvana API, CLI, Terraform provider and MCP server (together, the "Platform");
• our sales, support and marketing communications.

It does not apply to the data you store or run on infrastructure you provision from us. That data is yours, we cannot see it, and it is governed by our Data Processing Addendum. See section 3.

If you use Nirvana through your employer or another organisation, that organisation controls your account and may have its own privacy terms that also apply.

2. Information we collect

Account information. When you create an account we collect your name, work email address, company name and password or single sign-on identity. If you enable two-factor authentication we hold the data needed to verify it.

Billing information. To charge for the Platform we collect your billing contact, billing address, tax identifiers where required, and transaction history. Card details are entered directly with our payment processor; we receive only the card type, last four digits and expiry, never the full number.

Platform usage and resource metadata. When you use the Platform we record which resources you provision and their configuration (instance types, volume sizes, network settings, regions), uptime and utilisation metrics, API and CLI calls, dashboard activity, and the IP addresses and user agents of requests. This is what we need to run, bill and secure the Platform.

Support and sales communications. When you contact us, we keep the correspondence, including the contents of support tickets, emails, chats and call notes, and the contact details you provide.

Programme applications. When you apply for startup credits, create or use a referral link, or request annual pricing, we collect what you enter on that form: your work email and, depending on the form, your company name and website, funding stage, investor or accelerator, estimated monthly spend and a description of your workload. This is recorded in a spreadsheet held by a service provider on our behalf. It is not added to our marketing list unless you separately subscribe.

Website visits. When you browse our websites we collect the information described in section 7.

We do not collect sensitive categories of personal information such as health, biometric, racial or ethnic, religious or precise geolocation data, and we ask that you do not send them to us.

3. Customer Content

Everything you store, run or transmit on compute, storage, network or Kubernetes resources you provision from us is Customer Content. It belongs to you and is under your control.

We have no access to Customer Content. We hold no credentials for your servers, install no agents inside them, and have no management interface into your environment. We cannot read, copy, decrypt or export what you run. Our visibility stops at the resource level: which resources exist, how they are configured and how much they are using.

If Customer Content includes personal information about other people, you are the controller of that information and we process it only as your infrastructure provider, on the terms of our Data Processing Addendum. Requests from individuals about data held in Customer Content should go to the customer who holds that data, not to us.

4. How we use personal information

We use the information in section 2 to:

• provide, operate and secure the Platform, including authenticating you, provisioning resources and detecting abuse;
• bill you and collect payment;
• respond to support requests and communicate with you about your account, service changes, security notices and incidents;
• assess programme applications and attribute referral credit;
• understand how the Platform and our websites are used so we can improve them;
• send marketing about our products where you have subscribed or where the law allows it (you can opt out at any time using the link in the email);
• comply with legal obligations, enforce our terms and protect our rights, our customers and others.

Where the GDPR or UK GDPR applies, we rely on performance of our contract with you (providing the Platform and billing), our legitimate interests (security, improving our services, business communications with existing customers), compliance with legal obligations, and consent where we ask for it (for example, marketing to new contacts).

We do not use personal information for automated decisions that have legal or similarly significant effects on you.

5. Who we share it with

We do not sell personal information and we do not share it with third parties for their own marketing.

We share personal information with service providers who process it on our behalf and only for the purposes above. They fall into these categories:

• payment processing and invoicing;
• identity and single sign-on;
• hosting of our websites and the Platform's dashboard and API, and the managed database behind them;
• customer relationship management, email delivery and support tooling;
• cloud productivity, document and spreadsheet tools used internally;
• data center and infrastructure providers, which have physical custody of hardware but no access to any data on it.

Each is bound by a contract that restricts its use of your information to providing its service to us. All are located in, or process data in, the United States.

We may also disclose personal information where required by law, court order or a valid government request; to protect the security of the Platform or the rights and safety of Nirvana, our customers or others; and to a successor in a merger, acquisition, financing or sale of assets, in which case this policy continues to apply until you are told otherwise.

6. Where your data is hosted

Our infrastructure and the systems behind the Platform are located in the United States. Personal information we collect is stored and processed in the United States, and our service providers process it there.

If you access the Platform from outside the United States, your information is transferred to the United States. Where the GDPR, UK GDPR or Swiss FADP applies, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum for those transfers. Business customers can obtain them by accepting our Data Processing Addendum.

7. Cookies and analytics

We use a small number of cookies and similar technologies on our websites and the Platform.

Essential. First-party cookies that keep you signed in, protect against cross-site request forgery, and remember settings such as your preferences. The Platform does not work without them.

Analytics. We use a small number of analytics services, acting on our behalf, to understand how our websites and the Platform are used so we can improve them: a web analytics service for aggregate website traffic (pages visited, referral source, country, device type), a performance monitoring service for page speed and reliability, and a product analytics service for how the Platform is used (which features are used, where users get stuck, errors encountered).

These services collect your IP address, browser and device information, the pages and features you use, and an identifier that lets them recognise repeat visits. The data is used by us, for our own analysis, and for nothing else. Our analytics providers are contractually prohibited from using it for their own purposes, combining it with data from other sources, or disclosing it to anyone else.

What we do not do. We do not use advertising pixels, retargeting tags or social media trackers, and we set no third-party cookies for anyone else's benefit. We do not sell personal information or share it for cross-site targeted advertising, so there is no sale or sharing to opt out of, and we treat Global Privacy Control signals accordingly.

Your choices. You can decline non-essential cookies through the cookie notice where one is shown, or block or delete cookies in your browser settings. Blocking essential cookies will stop the Platform from working.

8. How long we keep it

We keep account, billing and support information for as long as your account is active and for up to seven years afterwards where needed for tax, accounting and legal purposes. Platform usage logs and resource metadata are kept for up to twelve months for security and billing reconciliation, then deleted or aggregated. Programme application data is kept for the life of the programme and up to two years afterwards. Marketing contact data is kept until you unsubscribe.

Customer Content is deleted within 30 days after your account closes, as set out in the Data Processing Addendum. You can delete it yourself at any time before then.

9. How we protect it

We maintain a SOC 2 Type II program covering the Platform. Access to systems holding personal information is limited to named staff on a least-privilege basis with single sign-on and multi-factor authentication. Data is encrypted in transit, administrative actions are logged, and our devices are centrally managed and encrypted. Service providers are reviewed before onboarding and at least annually.

No system is completely secure. If we learn of a breach affecting your personal information we will notify you and any relevant authority as the law requires. See our Security page for more.

10. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or deleted, to receive a copy in a portable format, to object to or restrict certain processing, to withdraw consent where we rely on it, and to opt out of marketing.

US state privacy laws. If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon or another state with a comprehensive privacy law, you have rights to know, access, correct and delete your personal information and to opt out of its sale, sharing for targeted advertising, or use in profiling. We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of on that front. We do not discriminate against you for exercising your rights. You may use an authorised agent to make a request; we will verify the agent's authority and your identity.

EEA, UK and Switzerland. You have the rights above under the GDPR, UK GDPR or FADP, and the right to lodge a complaint with your local supervisory authority.

How to make a request. Email datadeletion@nirvanalabs.io for deletion requests and support@nirvanalabs.io for anything else. We will verify your identity, usually by confirming control of the email address on your account, and respond within the time the law requires, typically 30 to 45 days. If you have an account, you can update most of your information yourself in the dashboard.

11. Children

The Platform and our websites are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Changes to this policy

We will post any changes on this page and update the date at the top. For material changes we will also notify account holders by email or a notice in the dashboard before the change takes effect.

13. Contact

Privacy questions: support@nirvanalabs.io
Deletion requests: datadeletion@nirvanalabs.io