Niki
Book a callTry Niki

Privacy Policy

Last updated: 17 October 2026

This notice explains how personal data is processed when you register for and use Niki, including the web, desktop, iOS and Android apps. The mobile apps provide access for existing customers and do not offer registration or purchases. This notice also explains how to contact us and exercise your rights.

The operator responsible for Niki account, subscription and support data is Xaver Drabik, Malfattigasse 1–5/4/10, 1120 Vienna, Austria. You can reach us at [email protected]. If your employer or another organisation provides your workspace, that organisation determines the purposes of processing workspace content; Niki processes that content on its behalf. Contact your workspace administrator about your organisation’s own privacy rules.

Registration collects your name, email address and password, which is stored as a password hash. We process verification and session information, organisation memberships, roles, workspace settings, subscription and payment references, usage totals and support correspondence. When you use the workspace, we process the conversations, instructions, files, saved memories, search indexes and results you create, upload or ask Niki to retrieve. Connected services may supply emails, calendar entries, documents or other content within the permissions you grant. Technical processing includes IP addresses, browser/device information, request metadata and security events. Computer-use features also process the remote desktop content and screenshots needed for your tasks.

We process account and service data to create and authenticate accounts, provide workspaces, carry out requested tasks, manage subscriptions and answer support requests. Where you are our contracting customer, this is necessary to perform the contract or take requested steps before entering it (Article 6(1)(b) GDPR). For users of an organisation’s subscription, account administration and reliable service delivery serve our and the organisation’s legitimate interests (Article 6(1)(f)). Security, abuse prevention, troubleshooting and the establishment or defence of legal claims also serve legitimate interests in protecting users and the service. Records required for accounting or other legal duties are processed under Article 6(1)(c). Where a separate optional purpose relies on consent, we request that consent separately (Article 6(1)(a)). The registration checkbox acknowledges this notice; it does not provide blanket consent for optional processing. Your organisation is responsible for the lawful basis of content it asks Niki to process.

Your name, email address and password are required to create an account; without them we cannot complete registration. Subscription and billing details are needed when purchasing a paid service. Uploading files, connecting third-party services, enabling notifications and using computer features depend on your choices and workspace permissions. Only provide third-party personal data that you are authorised to process, and avoid submitting sensitive information unless your organisation has established the necessary safeguards and legal basis.

Authorised personnel and service providers may process data as needed to operate and support Niki. The hosted service uses Cloudflare for frontend delivery and network services, Google Workspace for transactional email and correspondence, and Polar for checkout and subscription payments. AI tasks send the relevant instructions, conversation context, files or retrieved content to the configured AI service through Orq and the selected model provider. Optional remote desktops use Exoscale. Infrastructure, storage, backup and support providers may also receive data. Connected services and websites receive the requests you authorise; search providers receive search queries. Your workspace administrators manage accounts and access, and content you share becomes available to the recipients you select. We may disclose data where legally required or necessary to establish or defend legal claims. Ask us for the provider and recipient details applicable to your workspace before submitting information that has specific processing restrictions.

A dedicated workspace does not mean that all processing occurs on its host: AI services, email, payments, connected services and websites can process data elsewhere. The locations depend on the providers and features used. Transfers outside the European Economic Area require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses and any necessary supplementary measures. Contact us for the destinations, applicable safeguards and a copy of the relevant safeguards for your workspace. This notice does not promise that all data remains in Austria or the EU.

Account and workspace information is retained while needed to provide the service. The hosted workspace lifecycle provides a 30-day online retention period after paid access and any applicable grace period end, followed by scheduled workspace deletion. Closing a tab or disconnecting a service does not by itself delete previously imported content. Billing, security and support records can be retained separately for applicable legal obligations, security investigations or legal claims. Backup and external-provider deletion follow their applicable retention arrangements, so removal from the live workspace does not imply immediate removal from every backup or recipient. Contact us for the retention criteria and deletion arrangements applicable to a particular category of data or to request erasure.

Niki uses authentication cookies and browser storage for sign-in, security, language preferences, workspace selection and application functionality. The desktop app also retains local application data needed to run. If you enable push notifications, the relevant push service processes the subscription and notification delivery data. You can clear local storage, manage browser permissions and disable notifications in your device settings; clearing authentication data signs you out. Acknowledging this notice does not authorise optional advertising or analytics tracking.

Subject to the GDPR’s conditions, you can request access, correction, erasure, restriction and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation, and to direct marketing at any time. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing. Send requests to [email protected]; we may ask for information needed to verify your identity. For organisation-controlled workspace content, we may direct the request to your organisation or assist it in responding. You can complain to a supervisory authority, including the authority where you live or work or where the alleged infringement occurred. In Austria, this is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, [email protected].

Niki uses AI to generate responses, retrieve information and perform requested tasks. Outputs may contain errors and should be reviewed before use. Niki’s workspace assistance is not intended to make decisions about you that produce legal or similarly significant effects solely through automated processing. If an organisation uses the output in a decision about a person, that organisation is responsible for explaining that use and providing the required safeguards.

The iOS and Android apps use your existing Niki account and authorised workspace. Photos and files are optional: the app processes the items you select through the system picker when you choose to attach them. Before new AI requests, the app asks whether you allow sharing with the AI services configured for the selected workspace and names the configured AI gateway recipients. The disclosure covers your messages, relevant conversation history, agent instructions, selected photos and files, and relevant workspace or tool content used for answers, file analysis and search. Permission applies to that workspace and its current AI configuration. You can decline or withdraw it in Settings → AI and privacy. Withdrawal stops new AI calls; calls already in progress may finish, and withdrawal does not erase data already sent. Saved chats, reporting, account settings and sign-out remain available without this permission. If you choose Report response, Niki stores the saved AI response, limited to 24,000 characters, your reason, optional details limited to 2,000 characters, your account and message references, and review information in your workspace. Authenticated, active workspace administrators can review these reports; reporting is not a message to the AI provider. You can initiate permanent account deletion directly in Settings → Security using your current Niki account password and explicit confirmation. Niki stores a durable request with a reference and processing status. A named operator reviews and verifies fulfillment, including shared-workspace ownership, personal data, active work and sessions, connected grants, and provider or backup retention. Receipt is not immediate erasure or subscription cancellation. Niki aims to respond to your account email within 30 days and explains any required ownership steps and retained data. You can check the request status in the app while your account remains available; final account erasure revokes access. Privacy requests can also be sent to [email protected].

We update this notice when the service or its processing changes. The date above identifies this version. Material changes will be brought to your attention through the service or an appropriate account communication. Any optional processing that requires consent will have its own consent request.