Legal

Privacy Policy

Last updated: 24 July 2026

This Privacy Policy explains how Nuira ("Nuira", "we", "us", or "our") collects, uses, discloses, and protects personal data when you use the Nuira service (the "Service") and the website at nuira.ai (the "Site"). Nuira is the decision layer for ecommerce: it connects to the tools a brand already runs and produces profit-aware paid-media recommendations. Nuira is recommend-only and does not execute changes on your behalf.

For the purposes of the EU General Data Protection Regulation (GDPR) and Spanish data-protection law, Nuira acts as the data controller for personal data processed about its account holders, and as a processor for the business data you connect to the Service. If you have any questions, contact us at privacy@nuira.ai.

1. Data we collect

Account and contact data

When you create an account or request access, we collect your name, email address, the organization you represent, and authentication data managed through our identity provider.

Data from connected platforms

With your explicit authorization (via OAuth or API keys), Nuira accesses data from the third-party platforms you choose to connect, strictly to generate your recommendations:

• Shopify: orders, products, costs and margin (COGS), and related store data.
• Meta: advertising spend and campaign performance metrics for the ad accounts you connect.
• Google: advertising spend and campaign performance metrics for the Google Ads accounts you connect.
• Klaviyo: email and retention metrics (where this integration is enabled).

We request the minimum scopes necessary and only access data for accounts you have explicitly connected. You can disconnect any platform at any time.

Technical data

Our hosting and infrastructure providers process limited technical data (such as IP address and request logs) as needed to operate and secure the Service. The marketing Site (nuira.ai) does not use advertising cookies or third-party tracking. The application may use essential cookies solely to keep you signed in.

2. How we use data

• To provide the Service, which builds a live understanding of your business and generates ranked, confidence-scored recommendations.
• To create, secure, and support your account.
• To maintain, improve, and troubleshoot the Service.
• To communicate with you about the Service, including early-access updates.
• To comply with legal obligations.

We do not sell your personal data, and we do not use data accessed from connected platforms for advertising or to train generalized AI models.

3. Legal bases (GDPR)

• Performance of a contract: to provide the Service you request.
• Consent: to connect third-party platforms and access their data; you may withdraw consent at any time.
• Legitimate interests: to secure, operate, and improve the Service, balanced against your rights.
• Legal obligation: where processing is required by law.

4. Google user data

Nuira's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google (such as Google Ads spend and campaign metrics) is used only to provide and improve user-facing features within Nuira, is not sold, is not used for advertising, and is not transferred to third parties except as necessary to provide the Service, comply with applicable law, or as part of a merger or acquisition. Nuira does not use Google user data to develop, improve, or train generalized AI or machine-learning models.

5. Meta and Shopify data

Data accessed through the Meta and Shopify platforms is likewise used only to operate the features you enable within Nuira, in accordance with the Meta Platform Terms and the Shopify API License and Terms of Use. We access this data solely on your authorization and for your organization's benefit.

6. Sharing and sub-processors

We share data only with service providers that help us operate the Service, under appropriate data-processing agreements. These include:

• Vercel: hosting of the web application and this Site.
• Fly.io: hosting of our backend service.
• Supabase: database and authentication (hosted Postgres).
• OpenRouter: optional language-model processing used only to refine the presentation of recommendations; the Service functions without it.

We may also disclose data where required by law, to protect our rights, or in connection with a corporate transaction.

7. International transfers

Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. Data retention

We retain personal data for as long as your account is active or as needed to provide the Service, and thereafter only as required to comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion at any time.

9. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and strict tenant isolation so that each organization's data is kept separate. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. To exercise these rights, contact privacy@nuira.ai. You also have the right to lodge a complaint with your supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD).

11. Children

The Service is intended for businesses and is not directed to individuals under 18. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, where appropriate, notify you of material changes.

13. Contact

Questions or requests regarding this Privacy Policy can be sent to privacy@nuira.ai.