Nvestiv Capital Corporation ("Nvestiv", "we", "us" or "our") provides an AI-enabled platform for private-investment work: a CRM, document and data-room tools, fundraising workflows, research, and IRIS, our AI assistant. This Privacy Policy explains how we collect, use, share, keep and protect personal information when you visit our websites, use our Services, or communicate with IRIS.
Please read it together with our Terms of Service, our Acceptable Use Policy, our Cookie Notice and our Subprocessor List.
1. Who we are and how to reach us
Nvestiv Capital Corporation is a company based in Toronto, Ontario, Canada. We are responsible for the personal information we control, as described in Section 3.
Privacy Officer (also our Data Protection Officer): Saad Hassan
Nvestiv Capital Corporation
80 Atlantic Ave, 4th Floor
Toronto, Ontario, Canada M6K 1X9
- Privacy questions: support@nvestiv.ai
- Deletion and other privacy-rights requests: support@nvestiv.ai
- Billing questions: support@nvestiv.ai
- Phone: 1 (888) 831-9886
2. Scope and key terms
This Policy applies to our websites (nvestiv.com, including the newsroom and journals), our app (app.nvestiv.com), shared documents (share.nvestiv.com), and all other Services. It applies to customers, users, website visitors, people who view data rooms or shared documents, people who contact IRIS, and people whose information our customers bring into the Services.
In this Policy:
- "Services" means our website, app, IRIS, APIs (the REST API at /api/v1 and our MCP server), integrations, data rooms, shared documents, newsroom, and managed services.
- "IRIS" means Nvestiv's AI assistant, on web chat, voice, email, WhatsApp, SMS, Slack and the API.
- "Customer" means the organization (or individual) that holds a workspace. A "workspace" belongs to the Customer. Workspace members have the role of owner, admin or worker.
- "User" or "you" means a person who uses the Services.
- "Customer Content" means everything a Customer or its users submit, upload, connect or create in the Services: documents, files, messages, emails, CRM records, contacts, deal data, data-room materials, financial information, investor lists, and prompts and conversations with IRIS.
- "Usage Data" means information about how the Services are used. Usage Data can identify you. It is not only anonymized or aggregated data.
- "IRIS Network" means Nvestiv's network of people who contact IRIS. IRIS uses it to suggest introductions.
- "Personal information" means information about an identifiable individual. In Europe it has the meaning of "personal data".
3. Our two roles
We handle personal information in two different roles.
3.1 Service provider (processor) for Customer Content. Customers decide what they put into the Services and why. This includes information about their contacts, their investors and prospective investors, the people in their email and messaging threads, meeting participants, data-room visitors, and the people and companies they research. For this information we act as the Customer's service provider (in Europe, a "processor"). We process it on the Customer's instructions and under our agreements with the Customer.
If you are not our Customer and your information is in a Customer's workspace, the Customer is responsible for it. Please send your request to that Customer. If you send it to us, we will refer it to the Customer and act on the Customer's instructions (see Section 17).
3.2 Organization in control (controller) for our own information. We decide how and why we process:
- account and sign-in information;
- billing information;
- information about visitors to our website;
- Usage Data;
- conversations with IRIS when you contact IRIS directly (Section 9); and
- IRIS Network profiles (Section 9).
For this information we are responsible under Canadian privacy law and, in Europe, we are the "controller".
4. Personal information we collect
4.1 Account information
When you sign up or are invited to a workspace, we collect your name, email address, job title, company, and workspace role. You sign in with a link we send by email, so we do not store a password for you. If you add a phone number, profile details or preferences, we collect those too.
4.2 Billing information
When a Customer buys a paid plan or add-on, our payment provider, Stripe, collects the payment card details. Stripe holds the full card number. We keep only the card brand and the last four digits, together with the plan bought and the payment history.
4.3 Customer Content
We store and process the Customer Content that you and your workspace add to the Services. Customer Content often contains personal information about other people, for example:
- contacts, CRM records, investor lists, and notes about people;
- deal data, financial information, and data-room materials;
- documents and files, including contracts and signed documents;
- emails and messages; and
- prompts and conversations with IRIS.
4.4 Messages across channels
We collect messages sent to and from the Services and IRIS by email, WhatsApp, SMS and Slack. This includes the message text, attachments, the sender and recipients, phone numbers or addresses, and timestamps. IRIS's email inbox, our notification emails (sent from noreply@nvestiv.app), SMS, WhatsApp and Slack each run through the providers named in our Subprocessor List.
4.5 Calls with IRIS
When you call IRIS, we record the call audio and transcribe it. We keep the recording, the transcript, your phone number, and the call details.
4.6 Meeting recordings, transcripts and sentiment analysis
Users can record meetings in the browser, or import recordings and transcripts from Fathom, Fireflies, Otter or Granola. The in-browser recorder shows the user a consent step before it starts. We collect:
- the meeting audio and recording;
- a transcript with speaker labels; and
- a sentiment and credibility analysis, which uses voice features and AI scoring.
This analysis is an aid for the user. It is not a lie detector, and it can be wrong. The user who records a meeting is responsible for telling participants and getting any consent that the law requires.
4.7 Connected accounts and saved website logins
When a user connects another service, we collect the data that the user lets us access. Services that users can connect include Gmail and Outlook mail and calendar (through Nylas), HubSpot, QuickBooks, Addepar, Google Drive, Fathom, Fireflies, Otter, Granola and Plaid. This can include emails, calendar events, contacts, files, CRM records, accounting and portfolio data, and meeting recordings.
Users can save website logins and cookies in an encrypted vault. IRIS uses them to sign in to websites and complete tasks for the user.
4.8 Data rooms, shared documents and NDAs
When you open a data room or a document that someone shares with you through Nvestiv, we collect:
- the pages you view, how long you view them, and the document pages shown to you;
- your IP address, device and browser, and approximate location (from your IP address); and
- a recording of your session (see Section 8).
If the sender asks visitors to identify themselves, we collect the name and email address you enter. That information becomes a contact in the sender's CRM.
If you sign a non-disclosure agreement through our click-to-sign process, we keep a signature record: your name, email address, the time of signing, your IP address, and the signed PDF with its timestamp.
4.9 Research about people and companies
When a Customer uses our research and due-diligence features, we collect information about people and companies from public and commercial sources on the Customer's behalf. Sources include web search, PitchBook, Clay, A-Leads, and public records such as OpenSanctions, CourtListener, CanLII, FINRA BrokerCheck, SEC EDGAR, GDELT, Companies House and GLEIF, and news and adverse-media sources. The information can include names, roles, employment and company history, contact details, regulatory and court records, sanctions lists, and news coverage.
4.10 Usage Data, device data and log data
When you use our websites or the Services, we and our analytics providers collect:
- the pages and screens you view, clicks, scrolling, time spent, and features you use;
- recordings of sessions (see Section 8);
- your IP address, approximate location, browser, operating system, device type, language and time zone;
- referring pages and links; and
- logs of requests, errors and API use.
4.11 Audit and security logs
We keep an audit log of actions in the Services, including every staff view of Customer Content. We also log permission denials.
4.12 Communications with us
When you contact us, for example for support, billing or a privacy request, we keep your message, your contact details and our reply.
5. Where we get personal information
We collect personal information:
- from you, when you create an account, use the Services, sign a document, fill in a form, or contact us or IRIS;
- from Customers and their users, when they add contacts, investor lists, documents and other Customer Content, or invite you to a workspace, data room or shared document;
- from connected services, when a user connects an account (Section 4.7);
- from other people in conversations, when IRIS is part of an email thread or conversation in which someone mentions you;
- from public and commercial sources, for the research features (Section 4.9);
- automatically, through cookies, analytics and session recording (Section 8); and
- from service providers, such as our payment provider (payment status) and our analytics and error-monitoring providers.
6. How we use personal information
We use personal information for the purposes below. If you are in the European Economic Area (EEA) or the United Kingdom, the last column shows our legal basis under the GDPR and UK GDPR. Where we act as a processor (Section 3.1), the Customer decides the legal basis.
| Purpose | What this includes | Legal basis (EEA/UK) |
|---|---|---|
| Provide the Services | Create and run accounts and workspaces; store and process Customer Content; run IRIS and the actions a user asks IRIS to take; connect integrations; host data rooms and shared documents; send sign-in links and notifications | Contractual necessity; legitimate interests (to provide the Services to the Customer's users) |
| Billing | Charge for plans and add-ons, send invoices, handle billing questions | Contractual necessity; compliance with law (tax and accounting) |
| Conversations with IRIS and the IRIS Network | Reply to people who contact IRIS, remember context, and suggest introductions (Section 9) | Legitimate interests (to answer people who contact IRIS and to connect people who may want to meet); consent for each introduction |
| Maintain, secure and improve the Services | Fix errors; understand how features are used; learn from how the Services are used so that IRIS works better for all customers (Section 7) | Legitimate interests (to run a reliable, secure and useful service) |
| Analytics and session recording | Website and app analytics, session replay, and error monitoring (Section 8) | Legitimate interests; consent where the law requires it (for example, for optional cookies and website session recording) |
| Communicate with you | Service messages, security alerts, support replies, and, where permitted, news about Nvestiv | Contractual necessity; legitimate interests; consent where the law requires it (including under Canada's anti-spam law, CASL) |
| Managed services | Let Nvestiv specialists review deliverables when a Customer switches on a managed service | Contractual necessity |
| Security and compliance | Prevent fraud and misuse, enforce our Terms and Acceptable Use Policy, keep audit logs, respond to legal requests, and establish or defend legal claims | Compliance with law; legitimate interests (to protect the Services, our users and Nvestiv) |
| Business transfers | Share information in a merger, financing or sale (Section 11) | Legitimate interests |
| De-identified data | Create de-identified or aggregated data | Legitimate interests |
If we want to use personal information for a new purpose that is not compatible with the purpose for which we collected it, we will ask for your consent first where the law requires it.
We do not sell Customer Content or personal information.
7. AI processing and no model training
Use of Customer Content. We process Customer Content to provide, maintain, secure and improve the Services. This includes learning from how the Services are used, so that IRIS works better for all customers. We never show one customer's Customer Content to another customer in a form that identifies the customer or any person.
No model training. We do not use Customer Content to train or fine-tune AI models, and we do not sell Customer Content or personal information.
The AI models we use. The Services use large language models from Google (Gemini) and TypeSafe, and voice models from ElevenLabs. We access them through paid enterprise API services. We send Customer Content to these providers only to produce the outputs the Services need.
No training by AI providers. Under our agreements with them, these providers do not use Customer Content to train or improve their models. We do not train or fine-tune any AI model on Customer Content.
AI output can be wrong. IRIS and other AI features can produce information that is incorrect or incomplete. Check AI output before you rely on it.
8. Observation, session recording and analytics
How we observe use of our website and Services. We and our analytics providers (PostHog, Microsoft Clarity, Google Analytics and Plausible) collect information about how you use our website and the Services. This includes the pages and screens you view, clicks, scrolling, the time you spend, your device and browser, your IP address and approximate location. We may record and replay these sessions. In the app, recordings hide the text you type. We use this information to run, secure and fix the Services, to understand how features are used, and to improve the Services.
On our website we use Google Analytics, Microsoft Clarity (session recording and heatmaps) and Plausible. In the app we use PostHog (product analytics and session replay) and Sentry (error monitoring).
Data rooms and shared documents. When you open a data room or a document that someone shares with you through Nvestiv, we record your session. The recording includes the pages you view, how long you view them, your IP address, your device and your approximate location. We share this activity with the person or company that sent you the material. Our provider keeps recordings for up to 30 days. Copies linked to a data room are kept for up to 12 months.
Your choices. You can manage cookies through our cookie banner and your browser settings. See our Cookie Notice.
9. Conversations with IRIS and the IRIS Network
When you talk to IRIS. IRIS is Nvestiv's AI assistant. When you message, email or call IRIS, we keep the conversation, your contact details and what you tell IRIS. We do this so that IRIS can reply, remember context in later conversations, and do what you ask. This applies even if you are not a Nvestiv customer. We record and transcribe calls with IRIS.
When a customer involves IRIS. If a Nvestiv customer copies IRIS on a conversation with you or asks IRIS to contact you, we keep that conversation in the customer's workspace on the customer's behalf.
Emails to support@nvestiv.ai. IRIS, acting as our support assistant, answers emails sent to support@nvestiv.ai and passes to our team what it cannot answer. We keep a record of each request, our response and the actions we took, so that we can resolve it and show that we did. Emailing support@nvestiv.ai does not make you a member of the IRIS Network.
The IRIS Network. When you contact IRIS at its own addresses and numbers, you become a member of the IRIS Network. The Network is how IRIS connects people who may want to meet, for example investors and companies that are raising capital. For each member we keep a profile, which includes your name, title, city, country and contact details, and facts about you. We take these facts from your conversations with IRIS and from email threads that IRIS is part of, including what other people in those threads say about you. IRIS uses your profile to decide whether to suggest an introduction.
Introductions. IRIS asks you first, and an introduction happens only if you reply YES. IRIS does not tell the other person who you are until you agree. IRIS limits how often it contacts you: at most 2 approaches in 30 days if you are an investor, and at most 1 approach in 7 days otherwise. It does not ask again for 90 days after you say NO.
Your choices. You can ask IRIS to stop suggesting introductions at any time. Reply STOP to stop messages on a channel. To leave the Network or delete your profile and conversations, email support@nvestiv.ai.
What we do not share. IRIS does not share what you tell it with other people without your permission, except as this Policy describes.
10. Automated decisions
Some decisions in the Services are made by automated means, including AI:
- Routing and triage. AI classifiers decide how to route and prioritize incoming messages and requests.
- Scores and verdicts. AI scores deals and fundraising raises, and produces due-diligence verdicts (for example ADVANCE, DECLINE or CONDITIONAL). A Customer may show a raise verdict to the investors it invites.
- IRIS Network matching. IRIS decides whether to suggest an introduction between Network members (Section 9).
These outputs are information for the people who use them. They are not investment advice.
Your rights. If a decision about you is based only on automated processing, you can ask us:
- to tell you that the decision was made by automated means;
- which personal information we used to make it;
- the reasons and the main factors that led to it;
- to correct the personal information we used; and
- to have a person at Nvestiv review the decision. You can send us your comments for that review.
Email support@nvestiv.ai to make any of these requests. This notice is given under section 12.1 of Quebec's Act respecting the protection of personal information in the private sector, and the same right is available to everyone. If the decision was made in a Customer's workspace, we may refer your request to that Customer.
11. How we share personal information
We share personal information only as described below.
Subprocessors and service providers. We use service providers to host the Services, run AI models, store files, send email and messages, process payments, provide analytics and error monitoring, run background jobs, automate browsers, and supply research data. They may use personal information only to provide their services to us. Our current list, with each provider's purpose and location, is in our Subprocessor List.
Customers and the senders of shared material. When you open a data room or a shared document, we share your viewing activity with the sender (Section 8). If you identify yourself on a shared document, the sender receives your name and email address as a CRM contact. If you sign an NDA, the sender receives the signature record. Other members of a workspace can see the Customer Content in that workspace, according to their role.
Introductions you approve. When you reply YES to an introduction, IRIS shares your name, contact details and the context of the introduction with the other person.
Connected services you direct. When a user tells IRIS or the Services to act through a connected service, we send the information needed to that service. For example, IRIS sends email from the user's connected mailbox (always after the user approves the exact message), posts to Slack, updates a CRM, sends investor invitations, or fills in and submits a website form. The connected service's own privacy policy then applies.
Managed-service specialists. When a Customer switches on a managed service, Nvestiv specialists review the deliverables, with the Customer's consent. The Customer can withdraw that consent.
Professional advisers. Lawyers, accountants, auditors, bankers and insurers, when they advise us.
Legal and safety. Law enforcement, courts, regulators and others, when we believe in good faith that the law requires it, or that it is needed to protect the rights, safety or property of our users, the public or Nvestiv, to investigate fraud or misuse, or to enforce our agreements.
Business transfers. Parties to an actual or proposed merger, acquisition, financing, sale of assets, insolvency or similar transaction, and their advisers. A buyer or successor may continue to use the information as this Policy describes.
De-identified information. We may share information that has been de-identified or aggregated so that it does not identify any person or customer.
We do not share personal information with third parties for their own marketing.
12. Text messages and WhatsApp
IRIS can send and receive SMS (through Telnyx) and WhatsApp messages (through Meta).
Text messages (SMS). If you give us your mobile number or text our business number, we use it only to reply to you and to message you about your account and your requests. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help at any time. We do not sell, rent or share mobile numbers or text-message opt-in data with third parties or affiliates for their marketing purposes.
How STOP works. Replying STOP, STOPALL or UNSUBSCRIBE pauses messages on that channel to that number. If you later send IRIS an ordinary message on that channel, messages resume.
13. Connected Google accounts
When you connect a Google account (for example Gmail, Google Calendar or Google Drive), we use the data we receive only to provide and improve the features you use. We do not use it to train or fine-tune AI models. We do not use it for the cross-customer learning described in Section 7, and humans at Nvestiv read it only with your permission, for security purposes, to comply with law, or when it has been aggregated and anonymized for internal operations.
Nvestiv's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect a Google account at any time in the Services or in your Google account settings. Disconnecting stops new access. It does not delete data we already received; to delete it, see Section 17.
14. Staff access
Nvestiv platform administrators may view Customer Content, including messages with IRIS, to operate, support and secure the Services. Staff access to Customer Content is restricted, needs two-factor authentication, and every view is logged in our audit log. Managed-service specialists see deliverables only with the Customer's consent, which the Customer can withdraw.
15. International transfers
We host the app and its databases with Hetzner in Germany. Many of our service providers are in the United States, and some are in the European Union. Our team can access information from Canada. Your personal information may therefore be stored or processed in Canada, Germany, the United States and other countries where our providers operate (see the Subprocessor List). The laws of those countries may differ from the laws where you live, and authorities there may be able to access the information under their laws.
We use contracts and other measures to protect personal information that we transfer:
- From Canada: we use contracts with our service providers to give the information a comparable level of protection. Where Quebec law requires it, we assess whether information about Quebec residents will receive adequate protection before we send it outside Quebec.
- From the EEA or UK: the European Commission recognizes Canada as giving adequate protection for organizations subject to Canada's federal private-sector privacy law. For transfers to countries without such a decision, such as the United States, we use the Standard Contractual Clauses approved by the European Commission (with the UK Addendum for UK data) where required, or another lawful mechanism.
To ask for more information about these safeguards, email support@nvestiv.ai.
16. How long we keep personal information
We keep personal information only as long as we need it for the purposes in this Policy, unless the law requires us to keep it longer. Archiving is not deletion. When you delete an item inside the Services, we archive it so that it can be restored.
| Information | How long we keep it |
|---|---|
| Account information | While the account is active, then as described for Customer Content after the account ends |
| Customer Content, including emails and messages | While the account is active, until the Customer or you ask us to delete it. Deleting inside the Services archives it; archived items stay until a deletion request |
| Customer Content after an account ends | 90 days so that the Customer can ask for a copy, then archived for up to 12 months unless deletion is requested sooner, then deleted or de-identified |
| Conversations with IRIS and IRIS Network profiles | Until you ask us to delete them at support@nvestiv.ai |
| App session recordings (PostHog) | Up to 30 days |
| Data-room and shared-document recording copies | Up to 12 months |
| Permission-denial logs | 90 days |
| Audit log | The audit log is append-only: entries cannot be edited or deleted. We keep it for 7 years, then delete it |
| Billing records | As long as tax and accounting law requires |
| Website analytics | As set by each analytics provider; see our Cookie Notice |
When we no longer need personal information, we delete it or de-identify it. If we de-identify information so that it no longer identifies you, we may keep and use it.
17. Deleting your information and your rights
17.1 Deleting your information
Deletion requests. You may ask us to delete your personal information by emailing support@nvestiv.ai. We will verify your identity, then delete or de-identify the information within 30 days and confirm when we are done. We may keep information that we must keep by law, need to resolve a dispute or enforce our agreements, or hold in security and audit logs. We restrict access to those logs and use them only for those purposes.
Archiving is not deletion. When you delete an item inside the Services, we move it to an archive so that it can be restored. To erase it permanently, email support@nvestiv.ai.
Information held for our customers. If your information is in a workspace that a Nvestiv customer controls, we act on that customer's instructions. We will send your request to that customer.
After an account ends. We keep Customer Content for 90 days so that the Customer can ask for a copy. After that, we keep it archived for up to 12 months unless the Customer asks us to delete it sooner by emailing support@nvestiv.ai. Then we delete or de-identify it.
17.2 Your rights in Canada
Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector (as amended by Law 25), you have the right to:
- access the personal information we hold about you, and learn how we use and share it;
- correct personal information that is inaccurate or incomplete;
- withdraw your consent to our use of your personal information, subject to legal and contractual limits. If you withdraw consent, we may not be able to provide some Services;
- ask us to delete your personal information (Section 17.1);
- in Quebec, receive computerized personal information you gave us in a structured, commonly used technological format, or have it sent to a person you choose;
- in Quebec, ask us to stop disseminating your personal information or to de-index a link to it, where the law allows; and
- ask about automated decisions and ask for a human review (Section 10).
17.3 How to make a request
- Where to send it. Email support@nvestiv.ai. Tell us what you are asking for and which email address, phone number or workspace your request is about.
- Verification. We will verify your identity before we act. For example, we may ask you to confirm that you control the email address or phone number linked to your information. We use the information you give us for verification only to verify your request.
- Authorized agents. Someone else can make a request for you if you give them written permission or if they hold a valid power of attorney. We may ask you to confirm your identity and the agent's authority directly with us.
- Timing. We will respond within 30 days. If the law allows us more time and we need it, we will tell you why within those 30 days.
- If we cannot do what you ask, we will tell you why, unless the law prevents us.
17.4 Complaints in Canada
If you have a concern, please contact our Privacy Officer first at support@nvestiv.ai. You also have the right to complain to:
- the Office of the Privacy Commissioner of Canada (www.priv.gc.ca); or
- if you live in Quebec, the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).
17.5 Other choices
- Account information. You can view and update your profile in the Services.
- Marketing email. If we send you marketing email, you can unsubscribe with the link in each message. You will still get service messages.
- IRIS introductions and messages. See Sections 9 and 12.
- Connected accounts. You can disconnect a connected account at any time.
- Cookies. See Section 20 and our Cookie Notice.
Rights in Europe and in some US states are in Sections 21 and 22.
18. Security
We use technical and organizational safeguards to protect personal information, including:
- encryption in transit (TLS);
- field-level encryption at rest for credentials, secrets and API keys, including saved website logins in the vault;
- separation of each Customer's workspace from other workspaces;
- role-based permissions inside each workspace;
- an audit log that cannot be edited or deleted;
- restricted staff access to Customer Content, which needs two-factor authentication and is logged each time; and
- malware scanning of uploaded files.
No system is completely secure, and we cannot guarantee the security of your information. Keep your email account, API keys and connected accounts secure. Revoke any API key you think is exposed. If you believe your account has been compromised, contact support@nvestiv.ai.
19. Children
The Services are for business use by adults. They are not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has given us personal information, contact support@nvestiv.ai and we will delete it.
20. Cookies and similar technologies
We use cookies, local storage and similar technologies to keep you signed in, keep the Services secure, remember your preferences, measure use of our website and app, and record sessions as described in Section 8. Some are strictly necessary. Others are for analytics and session recording.
You can manage cookies through our cookie banner and your browser settings. For the list of cookies and your choices, see our Cookie Notice.
21. Additional information for people in the EEA and UK
This section applies to individuals in the European Economic Area and the United Kingdom ("Europe").
Controller. Nvestiv Capital Corporation is the controller for the processing described in Section 3.2. For Customer Content, the Customer is the controller and we are its processor. Our contact details are in Section 1.
Representatives. We have not appointed a representative in the European Union or the United Kingdom. Contact us at support@nvestiv.ai.
Data Protection Officer. You can contact our Data Protection Officer, Saad Hassan, at support@nvestiv.ai.
Legal bases. Our legal bases for each purpose are in the table in Section 6. Where we rely on legitimate interests, you can ask us for more detail about how we balanced those interests against your rights.
Your rights. You may ask us to:
- access your personal information and receive information about how we process it;
- correct inaccurate or incomplete personal information;
- delete your personal information where there is no good reason for us to keep processing it;
- transfer a machine-readable copy of your personal information to you or to a third party you choose;
- restrict the processing of your personal information, for example while we check its accuracy;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw your consent at any time, where we rely on consent. This does not affect processing before you withdrew it; and
- not be subject to a decision based only on automated processing that has legal or similarly significant effects on you. Where such a decision is made, you can ask for human review, give your point of view, and contest the decision (Section 10).
Send requests to support@nvestiv.ai. Section 17.3 describes how we handle them. If we refuse a request, we will tell you why, unless the law prevents us.
Complaints. You can complain to the data protection authority where you live or work, or where you think a breach happened. In the EEA, find your authority at www.edpb.europa.eu. In the UK, contact the Information Commissioner's Office (www.ico.org.uk; tel. +44 303 123 1113).
Transfers. See Section 15. You can ask for a copy of the safeguards we use by emailing support@nvestiv.ai.
22. Additional information for US residents
This section applies to residents of US states whose privacy laws apply to us ("State Privacy Laws"). Not every right applies in every state.
Your rights. Depending on your state, you may have the right to:
- know the categories of personal information we collect, the sources, the purposes, and the categories of third parties we disclose it to;
- access a copy of your personal information;
- correct inaccurate personal information;
- delete personal information we collected from you;
- opt out of the sale or sharing of personal information, targeted advertising, and certain profiling; and
- not be discriminated against for using these rights.
No sale or sharing. We do not sell personal information, and we do not share personal information for cross-context behavioral (targeted) advertising, as those terms are defined in State Privacy Laws.
Categories. In the past 12 months we collected the categories in Section 4, from the sources in Section 5, for the purposes in Section 6, and disclosed them to the categories of recipients in Section 11. Under the California Consumer Privacy Act, these include identifiers, customer records, commercial information, internet or other electronic network activity, approximate geolocation, audio and electronic information, professional or employment-related information, and inferences. Some information that customers upload may contain other categories.
Sensitive personal information. Customer Content may contain sensitive personal information, such as financial account details. We use it only as this Policy describes.
How to make a request. Email support@nvestiv.ai. Section 17.3 describes verification and authorized agents. We may need to confirm your state of residence.
Appeals. If we deny your request, you can appeal. Reply to our decision, or email support@nvestiv.ai with "Appeal" in the subject line. We will respond within the time your state's law requires and explain our decision. If we deny your appeal, you can contact your state Attorney General.
De-identified information. We do not try to re-identify de-identified information, except to test that our de-identification works as the law requires.
23. Changes to this Policy
We may change this Policy at any time. A change takes effect when we post it, and the "Last Updated" date at the top shows the current version. If you use the Services after a change, you accept it.
24. Contact us
For questions about this Policy or our privacy practices:
Privacy Officer: Saad Hassan
Nvestiv Capital Corporation
80 Atlantic Ave, 4th Floor
Toronto, Ontario, Canada M6K 1X9
- Privacy questions: support@nvestiv.ai
- Deletion and privacy-rights requests: support@nvestiv.ai
- Billing questions: support@nvestiv.ai
- Phone: 1 (888) 831-9886