Legal

Privacy Policy

Last updated: 20 October 2026

This Privacy Policy explains how Nuira (“Nuira”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal data when you use the Nuira service (the “Service”) and the website at nuira.ai (the “Site”). Nuira is the decision layer for ecommerce: it connects to the tools a brand already runs and produces profit-aware paid-media recommendations. Nuira is recommend-only and does not execute changes on your behalf.

Nuira is a trading name of Marc Vergara Ferrer, established in Spain. For the purposes of the EU General Data Protection Regulation (GDPR) and Spanish data-protection law, that individual is the data controller for personal data processed about account holders, and a processor for the business data you connect to the Service. If you have any questions, or wish to exercise any of the rights in section 10, contact privacy@nuira.ai.

1. Data we collect

Account and contact data

When you create an account or request access, we collect your name, email address, the organization you represent, and authentication data managed through our identity provider.

Data from connected platforms

With your explicit authorization (via OAuth or API keys), Nuira accesses data from the third-party platforms you choose to connect, strictly to generate your recommendations:

Shopify: orders, products, costs and margin (COGS), and related store data.
Meta: advertising spend and campaign performance metrics for the ad accounts you connect.
Google: advertising spend and campaign performance metrics for the Google Ads accounts you connect.
Klaviyo: email and retention metrics (where this integration is enabled).
Google Analytics 4 and Google Merchant Center: website traffic and conversion metrics, and product-feed status, for the properties and accounts you connect.
PrestaShop and Mirakl marketplaces: orders, products and related store data.
Gorgias: support-ticket activity and metrics.

We request the minimum scopes necessary and only access data for accounts you have explicitly connected. You can disconnect any platform at any time.

Technical data

Our hosting and infrastructure providers process limited technical data (such as IP address and request logs) as needed to operate and secure the Service.

The marketing Site (nuira.ai) uses Google Analytics 4 to measure aggregate visits, the pages that are read, and how visitors arrive. It sets Google’s analytics cookies in your browser and shares the resulting identifiers and usage data with Google. We do not use advertising cookies, and we do not use this data to build advertising audiences or to identify you personally. You can opt out for every site with Google’s browser add-on.

The application (app.nuira.ai) uses PostHog for product analytics and session replay, to understand which features are used and where people get stuck. Session replay records your screen as you use the application, which includes the business figures shown to you there — such as revenue, costs, advertising spend and order counts. What you type into forms is not recorded: fields such as passwords and the credentials used to connect your platforms are masked in your browser and never transmitted. We identify you to PostHog by your account identifier only, never your email address. These recordings are processed and stored in the European Union, are accessible only to Nuira staff, and are retained for a limited period. The application also uses essential cookies to keep you signed in.

AI assistants you connect

You can connect an AI assistant, such as ChatGPT or Claude, to Nuira. When you approve the connection you choose one project, and the assistant can then read that project’s figures (revenue, margins, advertising spend, product and stock figures, recommendations and insights) when you ask it a question. It cannot change anything in Nuira, your store or your advertising accounts, and it does not receive individual customers’ contact details.

The figures it reads are sent to that assistant’s provider (for example OpenAI or Anthropic), which processes them under its own terms and privacy policy. That provider is a recipient you choose, not a Nuira sub-processor. We record each request the assistant makes (which tool, whether it succeeded and how long it took), not your conversation. You can revoke a connection at any time in Settings → AI assistants, and access stops at the assistant’s next request.

2. How we use data

To provide the Service, which builds a live understanding of your business and generates ranked, confidence-scored recommendations.
To create, secure, and support your account.
To answer the questions you ask Nuira’s in-app assistant, or an AI assistant you have connected.
To maintain, improve, and troubleshoot the Service.
To communicate with you about the Service, including early-access updates.
To comply with legal obligations.

We do not sell your personal data, and we do not use data accessed from connected platforms for advertising or to train generalized AI models.

Performance of a contract: to provide the Service you request.
Consent: to connect third-party platforms and access their data; you may withdraw consent at any time.
Legitimate interests: to secure, operate, and improve the Service, balanced against your rights.
Legal obligation: where processing is required by law.

4. Google user data

Nuira’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google (such as Google Ads spend and campaign metrics) is used only to provide and improve user-facing features within Nuira, is not sold, is not used for advertising, and is not transferred to third parties except as necessary to provide the Service, comply with applicable law, or as part of a merger or acquisition. Nuira does not use Google user data to develop, improve, or train generalized AI or machine-learning models.

5. Meta and Shopify data

Data accessed through the Meta and Shopify platforms is likewise used only to operate the features you enable within Nuira, in accordance with the Meta Platform Terms and the Shopify API License and Terms of Use. We access this data solely on your authorization and for your organization’s benefit.

We share data only with service providers that help us operate the Service, under appropriate data-processing agreements. These are:

Hetzner: hosting of our database, on a server in Germany.
Supabase: authentication (your login and account identity).
Fly.io: hosting of our backend service.
Vercel: hosting of the web application and this Site.
Cloudflare: DNS, and object storage, in the European Union, for our encrypted off-site database backups. The backups are encrypted before upload with keys Cloudflare does not hold.
Inngest: background job and event orchestration.
Resend: transactional email, such as team invitations and notifications.
OpenRouter: language-model processing for Nuira’s in-app assistant and for the wording of recommendations and insights. It receives the business figures needed to answer a question; it is not used to train models on your data.
GitHub: source-code hosting and our deployment pipeline.
Sentry: error monitoring for the application and backend, hosted in the European Union. It receives technical details of errors, not the data from your connected platforms.
Novu: in-app and email notification delivery, hosted in the European Union.
Google Analytics: aggregate audience measurement on the marketing Site only; it never receives data from your connected platforms.
PostHog: product analytics and session replay for the application, hosted in the European Union. Recordings include the business figures displayed on screen; form fields, including credentials, are masked in your browser and never transmitted. It never receives data directly from your connected platforms.

Before we adopt any sub-processor we assess it for necessity and data minimisation, a GDPR Article 28 processing agreement with safeguards for any transfer outside the EEA, data residency, an independently attested security posture, breach-notification commitments, access control, encryption in transit and at rest, and a documented deletion path on exit. Each is re-assessed at least annually, and sooner on a notified incident or a material change to its terms, sub-processors, or data locations.

AI assistants you connect yourself (see section 1) receive the figures they read on your instruction. They are recipients you choose, not sub-processors acting for us.

We may also disclose data where required by law, to protect our rights, or in connection with a corporate transaction.

7. International transfers

Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

8. Data retention

We retain personal data for as long as your account is active or as needed to provide the Service, and thereafter only as required to comply with legal obligations, resolve disputes, and enforce our agreements. In particular:

Deletion on request: we complete a confirmed request to delete your account or organization within 30 days, as described on our account deletion page.
Backups: encrypted backups are purged on a rolling cycle, so a deleted record may persist in backup storage for a short period before it ages out.
Disconnecting Shopify: removing the Shopify connection deletes the store data Nuira synced from it.
AI assistant connections: revoking a connection ends the assistant’s access immediately. The record of its requests is kept with your account.
Session replays: kept for a limited period in PostHog’s European Union region.

You may request deletion at any time.

9. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and strict tenant isolation so that each organization’s data is kept separate. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. To exercise these rights, contact privacy@nuira.ai. You also have the right to lodge a complaint with your supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD).

11. Children

The Service is intended for businesses and is not directed to individuals under 18. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, where appropriate, notify you of material changes.

13. Contact

Questions or requests regarding this Privacy Policy can be sent to privacy@nuira.ai.