Privacy Policy

Your privacy matters. This policy explains what personal data NurYzo collects, how we use it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and equivalent regulations.

1. Data controller

The data controller is NurYzo, S.L., registered at España under protected trademark registered with the EUIPO. You can contact us at contact@nuryzo.com.

2. What we collect

Account data: email, name, hashed password, plan, referral code.
Profile data: business plan, industries, country, city, language preference.
Geolocation: (opt-in only) latitude/longitude when you enable the Radar. You can revoke this at any time from your browser settings.
Uploaded documents: files you attach to your Digital Suitcase.
Usage logs: API calls, feature engagement, IP address (retained for 30 days for security).
Payment metadata: last-4 digits of card, subscription status — handled by Stripe. We do NOT store full card numbers.
AI content: text of your prompts and returned answers, for quality debugging (retained 90 days).

3. Why we process it (legal basis)

Contract: provide the Service you signed up for.
Consent: geolocation, marketing emails, non-essential cookies.
Legitimate interest: fraud prevention, security logging, service improvement.
Legal obligation: tax records, subpoena responses.

4. Sub-processors

We share data with a small set of trusted infrastructure providers strictly to run the Service:

Cloud database hosting.
Application hosting on our production platform.
Payment processing (Stripe).
LLM inference for the AI advisors. Providers do not train on our API traffic.
Live web search infrastructure powering the Radar and Success Map.
Transactional email delivery.
Address resolution when the Radar is used.

5. International transfers

Some sub-processors are US-based. We rely on Standard Contractual Clauses and, where available, EU-US Data Privacy Framework certifications to protect your data.

6. Retention

Account data — kept while your account is active + 90 days after deletion.
Uploaded documents — deleted with your account or on demand.
AI prompts/answers — 90 days.
Usage logs — 30 days.
Payment records — 10 years (tax law).

7. Your rights

Under GDPR you have the right to:

Access your data (via Settings → Export).
Rectify or update your data (from your profile page).
Erase your data (Settings → Delete account).
Restrict or object to processing.
Data portability (a JSON export is provided).
Lodge a complaint with your local supervisory authority (in Spain, the Agencia Española de Protección de Datos — AEPD).

8. Cookies

See our Cookie Policy for the full list of cookies we use and how to control them. Non-essential cookies (analytics) are only enabled when you accept them in the consent banner.

9. Security

All traffic is served over HTTPS. Passwords are hashed with bcrypt. Payments are handled by Stripe (PCI-DSS Level 1). We routinely audit our access logs and rotate secrets.

10. Changes

We will notify you by email and post a notice inside the app at least 14 days before material changes take effect.

11. Contact

Any privacy question? Reach us at contact@nuryzo.com.