This policy explains what Nuurq (the "Service") does with personal information. It is written for two audiences: the businesses that subscribe to the Service ("you", a "Business"), and the people who talk to a Business through it ("Visitors"). It is short on purpose. If anything is unclear, ask us.
1. What the Service does
Nuurq is an AI customer-service agent. A Business uploads documents it wants the agent to know, connects channels (its website, Facebook Messenger, WhatsApp, a phone number), and the agent answers Visitors on those channels, records the conversations, and captures orders, bookings and enquiries into the Business's dashboard.
2. Information we process
Account information. When a Business creates an account: name, email address, a password (stored only as a hash), the business name, plan and billing status, and the names and email addresses of team members the Business invites.
Business content. The documents a Business uploads (menus, price lists, policies, product data, images), its configuration (persona, opening hours, services, notification settings), and the channel credentials and API keys it provides. API keys and channel secrets are encrypted at rest and are never displayed again after they are saved.
Conversation information. What Visitors write or say to the agent, the agent's replies, the transcript and outcome of each conversation, orders, bookings and enquiries captured during it, and — where a channel provides it — the Visitor's phone number, WhatsApp number, Messenger identifier or name. On telephone channels, call metadata (numbers, duration) and, where the Business enables it and the law allows it, a recording of the call.
Technical information. IP addresses, browser and device type, request logs, timestamps and error reports, used for security, rate limiting, abuse prevention and keeping the Service running.
"Try it on your website" demos. When a visitor to this site enters a website address, we fetch the public pages of that site, create a temporary demo that answers from them, and delete that copy when the demo expires. Conversations held with a demo are processed like any other conversation and are deleted with the demo.
3. Who is responsible for what
For account information and for this website, we decide why and how information is processed. For conversation information and Business content, the Business decides: it chooses what the agent is told, which channels are connected, what it captures from Visitors and how long transcripts are kept. We process that information on the Business's behalf and on its instructions. Visitors who have questions about a conversation they had with a Business should contact that Business first; we will help the Business respond.
4. How we use information
- To provide the Service: generate replies, keep transcripts, deliver orders, bookings and notifications to the Business, and show the Business its dashboard.
- To keep the Service safe: detect abuse, enforce rate limits and plan limits, investigate incidents and keep audit records.
- To run the subscription: trials, invoices, payment status and support.
- To improve the Service, using aggregate information that does not identify anyone.
We do not sell personal information, and we do not use conversation information to advertise to anyone.
5. AI processing and sub-processors
The agent's replies are generated by Anthropic's Claude models. To generate a reply, the relevant parts of the conversation and of the Business's documents are sent to Anthropic. Each Business uses its own Anthropic API key, so that processing happens under the Business's own agreement with Anthropic and is billed to the Business directly. The demo on this website runs on the key of the operator of this deployment.
Other providers are involved only for the channels and features a Business switches on, for example Meta Platforms for Facebook Messenger and WhatsApp, a telephony and speech provider for phone calls, a payment processor when card payments are enabled, and an email provider for notifications. Each of them receives only what is needed to deliver that channel or feature. We will tell you which providers are active on this deployment on request.
6. Cookies and browser storage
This website sets no cookies and runs no advertising or third-party analytics. The dashboard keeps a sign-in token in your browser so you stay signed in. The chat widget keeps a conversation identifier in the browser's session storage so a conversation continues across page loads; it is cleared when the browser tab closes. The widget stores nothing else, and nothing from the widget is shared with advertisers.
7. How long we keep information
- Account information: for as long as the account exists, and for a limited period afterwards for billing and legal records.
- Business content and conversation information: for as long as the Business keeps them. A Business can delete documents, conversations and captured orders from its dashboard; when an account is closed, its content is deleted within a reasonable period, except where the law requires us to keep it.
- Demo information: deleted when the demo expires, normally after two hours.
- Technical logs: for a limited period, long enough to investigate security incidents.
Backups are kept for disaster recovery and are overwritten on a rolling basis.
8. Security
Information is encrypted in transit. API keys and channel secrets are encrypted at rest. Access to systems is restricted and logged. The agent itself is built to resist manipulation: content from documents and Visitors is treated as data, not as instructions, and every reply is checked before it is sent. No method of storage or transmission is completely secure, so we cannot promise absolute security; if we learn of a breach affecting your information we will inform you without undue delay.
9. Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to have it deleted, to receive a copy of it, to object to or restrict certain processing, and to complain to a supervisory authority. To exercise these rights, contact us. If your request concerns a conversation you had with a Business, we will pass it to that Business and help it respond. We will never ask you to pay to exercise a right.
10. Where information is processed
Information is processed where this deployment of the Service is hosted and where the providers in section 5 operate, which may be outside the country you live in. Where the law requires safeguards for such transfers, we rely on the safeguards available under that law. We will tell you where this deployment is hosted on request.
11. Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16; if you believe a child has provided information through the Service, contact us and we will delete it.
12. Changes to this policy
When we change this policy we will publish the new version here with a new date at the top. If a change materially affects how we use information about you, we will tell Businesses by email before it takes effect.
13. Contact
Questions, requests and complaints about privacy go to the operator of this deployment of Nuurq, through the contact details shown in your dashboard.