Privacy Policy

NIMAI Labs — Privacy Policy

Last updated: October 16, 2026

1. Introduction

This Privacy Policy explains how NIMAI Labs ("NIMAI", "we", "us", "our") collects, uses, stores, and protects your personal data when you use the NIMAI Labs platform ("Platform"), including the website at nimailabs.com and the NIMAI Labs mobile application.

NIMAI Labs is the data controller for your personal data. We are committed to protecting your privacy in compliance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) and the Dutch Implementation Act (Uitvoeringswet AVG).

This Privacy Policy is drafted in English, which is the legally binding version.

2. Data Controller

• Business name: NIMAI Labs
• Legal form: Sole proprietorship (eenmanszaak), Netherlands
• KvK number: 42014971
• VAT number (BTW): NL005433822B68
• Address: Geurdeland 17G, 6673 DR Andelst, The Netherlands
• Contact: contact@nimailabs.com

3. What Data We Collect

3.1 Account Data

When you create an account, we collect:

• Name — Your display name or artist name
• Email address — For account access, notifications, and communication
• Profile photo — If you choose to upload one
• Country/location — If you choose to provide it
• Authentication data — Managed by our authentication provider (Clerk), including login method and session tokens

3.2 Profile and Preference Data

As you use the Platform, you may provide:

• Artist name, bio, genres, artistic level, and main goals
• Social media links (Spotify, Instagram, TikTok, etc.)
• Language preference and theme preference
• Notification preferences (email, push)

3.3 Content Data

Content you create or upload on the Platform:

• Music projects (names, descriptions, settings)
• Audio files (tracks, memos, beat uploads)
• Video files (Discovery submissions)
• Images (cover art, portfolio items, profile photos)
• Text (lyrics, notes, ideas, decisions, annotations)
• Split sheet data (collaborator names, roles, ownership percentages)
• Marketing content (smart links, EPK data)

3.4 Usage Data

We automatically collect:

• Pages and features you access on the Platform
• Interactions with the AI assistant (messages sent and context provided)
• Project activity (track phase changes, check-ins, actions completed)
• Discovery engagement (clips viewed, fires given)
• Device type and browser information (via Vercel Analytics — no personal identifiers)
• Approximate location (country-level, derived from IP address for analytics only)

3.4.1 Internal Product Records

To measure how NIMAI is adopted and used, we keep an internal record of milestones and the PRO plan lifecycle. It is kept for every account, including if you decline PostHog analytics, and it never leaves NIMAI without that separate consent.

It contains internal identifiers of your account, of the project owner where relevant and of the source event; the event type and time; and, depending on the event, plan, language, signup method, roles, project type, whether whoever added the audio owns the project, an approximate duration range and PRO lifecycle details, including amounts, currencies and original invoice or transaction references. Platform and app version are recorded only if you accepted analytics. We also record track creation, phase changes and audio replacements. We do not record names, emails, audio, lyrics or project titles.

These records are linked to your account; they are not anonymous. Deleting a track or project does not delete its historical milestones; deleting your account deletes the records linked to it. We keep each record for 25 months from the event, then delete it. You can object at any time without giving a reason (see 7.1); we then stop recording your usage and delete what we recorded for this purpose.

3.5 Payment Data

When you subscribe or make purchases:

• Payment processing is handled entirely by Stripe
• We do NOT store your credit card numbers, bank account details, or full payment card information
• We receive from Stripe: transaction IDs, payment status, subscription status, and billing country
• Stripe's handling of your payment data is governed by Stripe's Privacy Policy

3.6 Communication Data

• Messages sent to other users through the Platform's messaging system
• Emails sent to you by the Platform (notifications, digests, marketing)
• Feedback and support requests submitted through the Platform

4. Why We Process Your Data (Legal Bases)

Under the GDPR, we process your data based on the following legal bases:

5. Data Processors (Third-Party Services)

We share your data with the following third-party services ("data processors") that help us operate the Platform. Each processor only accesses the data necessary for their specific function.

We have Data Processing Agreements (DPAs) or equivalent contractual safeguards with each processor.

For transfers to the United States, our processors participate in the EU-US Data Privacy Framework or we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission.

5.1 AI Data Processing — Special Notice

When you use AI-powered features (project assistant, copywriter, daily digest), a summary of your project context is sent to OpenAI or Google AI to generate a response. This context may include:

• Your artist name and project names
• Track names and their current phases
• Recent notes, ideas, and feedback summaries
• Your artistic tone and language preference

We do not send your actual audio files, video files, or full lyrics to AI providers. AI providers process this data under their data processing agreements and do not use it to train their models.

6. Data Retention

7. Your Rights Under the GDPR

As a data subject, you have the following rights:

• Right of access (Art. 15) — Request a copy of all personal data we hold about you
• Right to rectification (Art. 16) — Correct inaccurate or incomplete data
• Right to erasure (Art. 17) — Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing (Art. 18) — Limit how we process your data
• Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format
• Right to object (Art. 21) — Object to processing based on legitimate interest
• Right to withdraw consent (Art. 7) — Withdraw consent at any time for processing based on consent

7.1 Your Right to Object to Usage Analytics

We measure how NIMAI is used — for example, when a project is created or a track gets its audio — to understand adoption and improve the Platform. We do this on the basis of our legitimate interest. The record stays inside NIMAI, is linked to your account and is kept for 25 months from each event.

You can object at any time, and you do not have to give a reason. Write to contact@nimailabs.com from the email address of your account. From then on you are left out of every usage report, including the ones already built from past activity, and the internal product records about you (3.4.1) are deleted. Your own activity history in your dashboard is part of the service and stays available to you.

How to Exercise Your Rights

Contact us at contact@nimailabs.com with your request. We will respond within 30 days as required by the GDPR.

For account-level actions, you can:

• Correct your details — Edit your name, artist name, bio, country, links and profile photo at any time in your Profile. No request is needed; the change takes effect immediately
• Export your data — Use the built-in data export tool in your account Settings. The file is JSON, a structured and machine-readable format, and covers your profile, your projects and everything inside them (tracks, actions, decisions, ideas, notes, visuals and marketing) together with the feedback you have given
• Delete your account — Available in your account Settings
• Manage notifications — In Settings you can turn off email and push notifications, the daily digest, and marketing. Marketing is off unless you turn it on: we do not send promotional email to anyone who has not opted in
• Withdraw Discovery consent — Cancel your Discovery submission at any time

Complaints

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with the Dutch Data Protection Authority:

• Autoriteit Persoonsgegevens
• Website: https://autoriteitpersoonsgegevens.nl
• Phone: +31 (0)70 888 8500

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• All data transmitted between your device and our servers is encrypted using TLS/HTTPS
• Authentication is managed by Clerk with industry-standard security practices
• Payment processing is handled by Stripe (PCI DSS Level 1 compliant)
• File storage uses Cloudflare R2 with access-controlled URLs
• Database access is restricted and encrypted at rest
• Rate limiting protects against abuse and unauthorized access
• We regularly review and update our security practices

Despite these measures, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please contact us immediately at contact@nimailabs.com.

8.1 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of the breach, as required by GDPR Art. 33
• Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms (GDPR Art. 34)
• Breach notifications to users will describe the nature of the breach, the data affected, the likely consequences, and the measures we are taking to address it

9. International Data Transfers

Your data may be processed in countries outside the European Economic Area (EEA), particularly the United States (via Clerk, Stripe, OpenAI, Google AI, Firebase, RevenueCat, Resend).

For these transfers, we ensure adequate protection through:

• The EU-US Data Privacy Framework (where applicable)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all processors

10. Children's Privacy

The Platform is not intended for users under 16 years of age. We do not knowingly collect personal data from children under 16.

If we discover that we have inadvertently collected data from a user under 16, we will:

• Terminate the account
• Delete all associated personal data
• Notify the user (or their parent/guardian if identifiable) of the deletion

If you believe a child under 16 has created an account, please contact us at contact@nimailabs.com.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or the Platform's features.

When we make material changes:

• We will notify you via email or in-platform notification
• The updated policy will be posted with a new "Last updated" date
• We will provide at least 30 days' notice for material changes

12. Contact

For any privacy-related questions or requests:

• Email: contact@nimailabs.com
• Address: Geurdeland 17G, 6673 DR Andelst, The Netherlands