Privacy Policy

• Providing and maintaining our platform services
• Processing your data and business workflows
• Authenticating users and managing accounts
• Enabling collaboration features

• Responding to your inquiries and support requests
• Troubleshooting technical issues
• Providing training and onboarding assistance

• Analyzing usage patterns to improve our services
• Developing new features and functionality
• Conducting research and analytics
• Performance monitoring and optimization

• Detecting and preventing fraud and abuse
• Ensuring platform security and integrity
• Complying with legal obligations
• Protecting our rights and those of our users

Google Calendar

Scopes Requested

• https://www.googleapis.com/auth/calendar.readonly
• https://www.googleapis.com/auth/calendar.events
• https://www.googleapis.com/auth/userinfo.email
• openid

We request read access to display your calendars and write access only when you choose to create, update, or delete synced Google Calendar events from Nixa.

Personal Data Processed (Read‑Only)

Calendar metadata and event details needed to run the integration: calendar ID, summary/title, color, primary flag; and for events: ID, title/summary, description, start/end, all-day status, status, location, attendees (names/emails), organizer/creator emails, meeting links, HTML link, created/updated timestamps, recurrence data, and visibility. Selected calendar IDs, sync status, and imported event records may be stored in your personal calendar entity to support sync, search, recurring-event management, and notifications.

Use of Personal Data

• Display and organize your calendars and events inside Nixa.
• Create, update, RSVP to, and delete Google-synced events when you ask Nixa to do so.
• Maintain change notifications and repair sync issues between Google Calendar and Nixa.

Storage and Security

• OAuth tokens (access/refresh) are encrypted at rest (AES-256-GCM).
• Selected calendar IDs, calendar metadata, sync state, and imported event records may be retained in your personal calendar entity to power the integration.
• Operational sync logs and webhook identifiers may be retained for reliability and troubleshooting.

Data Sharing

We do not sell or share Google Calendar data with third parties. Data is transmitted to Google only to provide this integration and the write actions you request. We do not use Google user data for advertising or marketing.

Retention and Deletion

• Tokens and selected calendar settings are retained while the integration is active.
• Disconnecting removes stored tokens and stops future sync. Previously imported event records may remain in your Nixa calendar until you edit or delete them.
• Operational logs may be retained for up to 12 months for security and troubleshooting, then deleted.

Controls and Revocation

• In‑app: Settings → Integrations → Google Calendar → Disconnect.
• Google Account: Revoke access in your Google Account permissions (Third‑party access).

International Transfers for this Integration

Customer production workspace data is hosted in Canada by default. Connecting Google Calendar necessarily involves transmitting relevant calendar data to and from Google systems, which may process data outside Canada.

Google Meet

• Personal data processed: meeting link/URI, participant display names, and counts; user email (for DWD impersonation); OAuth tokens (if per-user).
• Use: create meetings you request and display live status. No modification of personal content.
• Storage: tokens/credentials stored encrypted; operational logs retained for reliability.
• Controls: disconnect in app or revoke access in your Google Account.

Email Delivery (Mailgun/SMTP)

• Personal data processed: recipient email, name (if provided), delivery events (opened, clicked, bounced, unsubscribed).
• Use: send account and service emails; honor unsubscribes and suppressions.
• Storage: event logs and suppression lists retained to prevent unwanted emails.
• Controls: unsubscribe links in marketing emails; contact us for removal.

AI Features (OpenAI)

• Personal data processed: prompts, instructions, files, metadata, outputs, transcripts, embeddings, and content you provide to AI features.
• Use: generate responses, summaries, classifications, automations, transcriptions, embeddings, and insights you request.
• Model training: Customer Data, prompts, and outputs are not used by Nixa to train foundation models, and Nixa does not authorize third-party AI providers to train foundation models on that content unless you expressly opt in.
• Storage: Nixa may retain AI conversation context, prompts, outputs, transcripts, embeddings, agent run records, tool results, and metadata to provide continuity, auditability, retrieval, security, support, and product functionality. OpenAI/provider-side retention depends on the applicable provider terms, endpoint, configuration, and deletion controls.
• Controls: do not submit sensitive or regulated data to AI features unless your subscription and written agreement permit it; request deletion or access through the privacy contact.

Maps & Geocoding (Google)

• Personal data processed: addresses or place queries you type; device IP (by Google) for service delivery.
• Use: autocomplete and converting addresses to coordinates.
• Storage: cached geocoding results; no persistent storage of your raw queries beyond logs.
• Controls: do not enable address features if you prefer not to use Maps/Geocoding.

Service Providers

We may share data with trusted third-party service providers and subprocessors who help us operate, secure, support, and improve Nixa. These providers are bound by confidentiality, security, and data protection obligations and are only authorized to use your information as necessary to provide services to us.

Material Subprocessors

Our current material subprocessors and provider categories include:

• Canadian infrastructure hosting, database, cache, storage, backup, monitoring, and security providers for core production services. Customer production workspace data is hosted in Canada by default; Europe hosting is available when expressly selected.
• OpenAI and its affiliates for managed AI model, embedding, transcription, realtime transcription, image, and related AI processing.
• Google and its affiliates for optional Google Calendar, Google Meet, Google OAuth, Maps, geocoding, and Google Workspace integrations enabled by you.
• Mailgun, SMTP, or other email delivery providers for service, account, transactional, and customer-enabled communications.
• Stripe or other payment processors when paid billing, checkout, invoicing, or payment-card processing is enabled.
• Customer-configured third-party integration providers, APIs, data sources, identity providers, MCP-connected tools, or external services enabled by you or your users.

We may provide additional provider names, functions, regions, and material-change notices through the Services, account documentation, a data processing addendum, or on request.

Legal Requirements

We may disclose your information when required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, property, or safety, or that of our users or the public.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change in ownership or control of your personal information.

You have the right to request access to the personal information we hold about you, including the purposes for processing and the categories of data.

You have the right to request correction of inaccurate or incomplete personal information.

You have the right to request deletion of your personal information, subject to certain legal obligations and legitimate business interests.

You have the right to receive your personal information in a structured, commonly used, and machine-readable format.

You have the right to object to the processing of your personal information for direct marketing purposes or based on legitimate interests.

Account Data

We retain your account information for the duration of your active subscription plus 90 days after account closure, unless you request immediate deletion.

Business Data

Your business data (documents, records, workflows) is retained according to your subscription terms and can be deleted upon request or account closure.

AI Prompts, Outputs, and Agent Runs

Prompts, outputs, AI conversation messages, agent run records, tool results, transcripts, embeddings, and related metadata may be retained while your account or workspace remains active and as needed for product functionality, auditability, security, support, legal compliance, backup, dispute preservation, or abuse prevention.

Support Communications

Support tickets and communications are retained for 3 years for quality assurance and training purposes.

Legal Requirements

Some information may be retained longer to comply with legal obligations, resolve disputes, or enforce our agreements.

Data Protection Manager

David Kristensen, CTO
Email: head@nixa.ca

Company Address

Nixa
460 Rue St Gabriel, 3rd floor
Montréal, QC H2Y 2Z9
Canada

General Contact

For general inquiries: Contact Form
For support: Available through our platform