Privacy Policy

1. What We Collect

Account data. Name, work email, company name, role, and authentication credentials when you or your organization signs up.

Connected source data. During early access, supported connectors include Slack, Gmail, Google Drive, Notion and GitHub. Nura may add other connectors over time. When your organization connects an approved source, Nura ingests content and metadata from that source to build your organization's company memory. This may include content authored by your employees, contractors, and anyone who communicates with them through connected channels.

Usage data. Queries submitted to Nura, API/MCP calls, timestamps, IP addresses, device and browser information, and logs of feature usage.

Payment data. If you’re on a paid plan, our payment processor handles card data; we don’t store full card numbers.

2. Why We Process It

To operate the Service: index connected sources, answer queries, detect contradictions, generate provenance (“who decided, when, why”), and serve context to your AI agents over MCP.

To maintain and secure the Service, including abuse prevention and debugging.

To communicate with you about the Service, including onboarding and support.

To improve the Service, including model and retrieval quality, using aggregated or de-identified data where possible.

We do not sell your data, and we do not use your organization’s connected-source content to train models for other customers.

3. Legal Basis (EEA/UK Users)

Where GDPR applies, we process customer account data under contract (Art. 6(1)(b)) and connected-source content as a processor on your organization’s instructions, under the data processing terms in your agreement with us.

4. Who We Share It With

Subprocessors: cloud hosting, AI model providers, and infrastructure vendors that process data on our behalf, under contract, solely to provide the Service.

Your organization's own tools: during public early access, Nura reads from approved connected sources and does not write summaries or other content back into those tools unless a future feature is separately enabled and authorized by your organization.

Legal requirements: if required by law, subpoena, or to protect rights, safety, or property.

Business transfers: in a merger, acquisition, or asset sale, subject to this policy or a materially similar one.

We do not share customer connected-source data across organizations. Your organization’s Nura instance is scoped to your organization’s connected sources.

5. Data Retention

We retain data for as long as your account is active. Upon termination, we delete or return your organization’s data within 60 days, except where retention is required by law or for legitimate backup purposes (deleted within a further 30 days).

6. Your Rights

Depending on your location, you may have rights to access, correct, delete, or export your personal data, or to object to or restrict processing. For data connected through your employer’s Nura workspace, requests should generally go through your organization’s admin; individual requests can be sent to privacy@asknura.io and we’ll route or respond as appropriate.

California residents have rights under the CCPA/CPRA, including the right to know, delete, and opt out of sale (we don’t sell data).

7. Security

We use encryption in transit and at rest, access controls, and monitoring. No system is perfectly secure; we’ll notify affected customers of any breach as required by law and contract.

8. International Transfers

Data may be processed in the United States and other countries. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for transfers out of the EEA/UK.

9. Children

The Service is not directed to anyone under 18. We don’t knowingly collect data from children.

10. Changes

We’ll update the effective date above when this policy changes and notify customers of material changes.

11. Contact

[privacy@asknura.io] · Nura, 29C, Lane 1, Ittehad Commercial, Phase 6, DHA, Karachi, Pakistan