Privacy Policy

Effective: September 16, 2026

1. Introduction

Nimvox ("we," "us," or "our") operates the nimvox.dev website and provides Kubevox, Buildvox, Jobvox, Markvox, and Scoutvox (collectively, the "Services"). This Privacy Policy describes how we collect, use, store, and protect your information when you use our Services.

We are committed to protecting your privacy. We collect only the data necessary to provide our Services, we never sell your data, and we never use it for advertising.

2. Information We Collect

2.1 Account Information

When you create an account or make a purchase, we collect your email address and, for purchases, your name. For OAuth sign-in (Google or GitHub), we receive your email address and basic profile information from the provider.

2.2 Payment Information

Payments are processed by Stripe and PayPal. Nimvox never receives, stores, or has access to your credit card numbers or bank account details. We receive only transaction confirmations (amount, date, status) from these processors.

2.3 Product-Specific Data

2.4 Automatically Collected Information

When you visit nimvox.dev, our hosting provider records your IP address, browser type and the pages you visited, through Cloudflare Web Analytics. It sets no cookies and does not track you across sites. It is inserted at the edge and runs on every page, so it is not something we ask you to accept — what it does and does not see is described in Section 7.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services
• Process payments and deliver purchased products
• Send transactional communications (account verification, password resets, payment confirmations)
• Generate aggregate, anonymized analytics to improve the user experience

We do not:

• Sell your data to third parties
• Use your data for advertising or marketing profiles
• Share your data with data brokers

4. Sub-processors (Third-Party Services)

A sub-processor is a third party that processes your data on our behalf so that Nimvox can operate. The tables below are the complete, current list: each one’s name, what we use it for, what it receives, and where it processes it. Each has its own privacy policy, and we encourage you to review them.

Changes. By using Nimvox you provide general authorisation for us to engage the sub-processors listed below. We will publish any addition to this list at least 30 days before the new sub-processor begins processing your data, so that you have an opportunity to object. If you object and we cannot offer a reasonable alternative, you may terminate the affected service.

4.1 Infrastructure and delivery

4.2 Payments

4.3 AI providers

These are used only when you invoke an AI feature. Nothing is sent to an AI provider in the background, and no AI provider receives your account or billing data. The features that use them are Jobvox’s job analysis, resume optimisation suggestions and cover-letter generation; Markvox’s brand name suggestions, logo drafts and brand-guide assistance; and Scoutvox’s job-listing rewrite suggestions.

Which of the two handles a given request depends on the feature and may change between them. Adding any other AI provider is an addition to this list and carries the 30 days’ notice described above.

Training. Both providers’ commercial API terms provide that content submitted through the API is not used to train their models, and we use both only through their APIs.

Retention. A provider may retain input for a limited period for its own abuse monitoring, separately from training. For OpenAI this is currently up to 30 days. For Anthropic it is governed by that provider’s standard commercial terms.

For a data processing agreement, a security review, or to object to a sub-processor, contact [email protected].

5. Data Storage and Security

We implement industry-standard security measures to protect your data:

• Encryption at rest: Sensitive data (resumes in Jobvox, cluster configs in Kubevox) is encrypted using AES symmetric encryption
• Password hashing: Passwords are hashed with bcrypt (cost factor 12) or argon2 and are never stored in plaintext
• Transport security: All connections use HTTPS/TLS encryption
• Session security: Authentication tokens are stored in httpOnly, Secure, SameSite cookies
• Access controls: Database access is restricted to the application layer
• Infrastructure locations: Primary infrastructure is hosted in the United States (Virginia). Additional processing infrastructure is located in Finland (Helsinki). Email delivery operates across US and EU infrastructure with US-based failover

6. Data Retention

You may request complete deletion of your data at any time by contacting us at [email protected].

7. Cookies and Analytics

We use no advertising, marketing or cross-site tracking cookies of any kind, and we sell nothing to anyone.

Cloudflare Web Analytics runs on every page our hosting provider serves for us. It is inserted at the edge rather than by our own code, it sets no cookies, it builds no profile across websites, and it starts before any page of ours has run — so there is nothing to consent to and we ask you nothing. It does see the network address the request came from, as any provider serving a page must.

This site and each product also count their own page views. When you open a page, it records that the page was opened, which page it was, and the address of the page that sent you. On this site it also records which product or pricing card you clicked — the name we gave that card, never the words printed on it and never anything you typed. To count one visit rather than many, your browser keeps a random session number for as long as the tab is open; closing the tab discards it. Nothing counted here is linked to a person or an account, because this site has no accounts. Records are deleted after 90 days. Products that link their own records to a signed-in account say so on their own privacy page.

You can switch that counting off, and the switch for this site is just below. Each product carries its own switch on its own privacy page — reachable from that product’s footer — because a browser stores such a preference separately for every website, so the switch below cannot reach markvox.dev and a switch there could not reach this site. A single control claiming to cover all of them would be telling you it worked when it had not. We also honour your browser’s Do Not Track and Global Privacy Control settings without being asked.

8. Your Privacy Rights

8.1 All Users

Regardless of your location, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Export your data in a portable format

8.2 European Economic Area (GDPR)

If you are located in the EU or EEA, you have additional rights under the General Data Protection Regulation:

• Right of access (Article 15) — obtain a copy of your personal data
• Right to rectification (Article 16) — correct inaccurate data
• Right to erasure (Article 17) — request deletion of your data
• Right to restrict processing (Article 18) — limit how we use your data
• Right to data portability (Article 20) — receive your data in a structured format
• Right to object (Article 21) — object to processing based on legitimate interest

8.3 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Right to know — what personal information we collect, use, and disclose
• Right to delete — request deletion of your personal information
• Right to opt-out of sale — we do not sell personal information
• Right to non-discrimination — equal service regardless of privacy choices

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. International Data Transfers

Your data is stored on infrastructure located in the United States (Virginia). Some processing and network transit also takes place on infrastructure located in Finland (Helsinki), where no customer content is retained. If you are located outside these regions, your data will be transferred to one or both locations for storage or processing. For transfers from the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to provide appropriate safeguards for your data.

10. Children's Privacy

Our Services are not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If we discover that we have inadvertently collected data from a child, we will promptly delete it. If you believe a child has provided us with personal information, please contact us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice by posting the updated policy on our website and updating the effective date at the top of this page. Your continued use of our Services after the effective date constitutes acceptance of the updated policy.

12. Contact

If you have questions about this Privacy Policy or how we handle your data, please contact us at [email protected].

Nimvox LLC, 4037 Via Marina, H-203, Marina Del Rey, CA 90292