Privacy policy

Who we are

Nuromi (Nuromi Pty Ltd) is a software service operated from Queensland, Australia. Nuromi generates a business dashboard from data you upload (spreadsheets, PDFs, business plans) or connect (accounting, payroll, and similar systems). This policy explains what data we collect, why we collect it, where it is stored, who processes it, and the rights you have over it.

What we collect

• Account details. Your name, email address, and business name. Magic-link sign-in is the default, so most accounts never have a password. If you choose to add a passkey or set an optional password in Settings, it is stored only as a salted hash by our authentication provider, Supabase Auth, never by us.
• Business data you choose to provide. Files you upload (spreadsheets, PDFs, business plans) and data from systems you choose to connect, such as accounting or payroll platforms. You control what is uploaded or connected, and you can remove it.
• Usage data. How you use the product, such as pages viewed and features used, so we can fix problems and improve the service. This includes technical details sent by your browser, such as your IP address, browser type, and the time of each request. Your IP address is recorded against your sign-in sessions and against error reports, both as a security measure. Audit logs also record access to your data as a security measure.
• Billing information. Payments are processed by Stripe. Your card details go directly to Stripe and never touch Nuromi's systems. We hold only your subscription status and billing history.

Why we collect it

We collect and process your data for one purpose: to provide the service. That means generating your dashboard and insights from the data you give us, keeping your account secure, billing your subscription, sending you transactional emails (like sign-in links and receipts), and supporting you when something goes wrong. We do not sell your account or business data, and we do not use it for advertising. See "Cookies and advertising" below for the separate, opt-in cookies used on our public marketing website.

Cookies and advertising

Our public marketing website (the pages you can read without signing in, such as this one) shows a cookie banner on your first visit, with two choices: Accept, or Options. Necessary cookies (the ones that keep the site working and remember this choice) are always set and are never optional. Everything else is off by default and grouped into two categories you control separately from the Options screen:

• Analytics. Google Analytics, so we can see in aggregate which pages get read and where visitors come from.
• Advertising. Meta (Facebook and Instagram) and LinkedIn, so we can show you relevant ads about Nuromi on those platforms and measure how our advertising performs.

You can turn either category on or off, or choose "Don't allow cookies" to leave both off, from the Options screen or at any time afterwards using the "Cookie settings" link in the site footer. This is entirely separate from, and does not affect, the account and business data covered by the rest of this policy: it applies only to your browser on the public marketing site, never to data you upload or connect once you have an account, and it is never shared with or used by any of Nuromi's own AI features.

Where your data is stored

For Australian customers, data is hosted in Australia by default: our database runs on Supabase in the Sydney region (AWS ap-southeast-2), and the application is served through Vercel. Some of the service providers listed below process data outside Australia or in a region we have not yet confirmed. Other hosting regions are available on request for customers outside Australia. Data is encrypted with TLS 1.3 in transit and AES-256 at rest. Row-level security and workspace-scoped queries keep every customer's data isolated from every other customer's. For systems you sign in to through Nango, our connector provider, the sign-in tokens are held by Nango, and calls to those systems go through Nango, which attaches the token. Deputy connects to Nuromi directly, so its sign-in tokens are stored in Nuromi's own database, as are any API keys you provide and the tokens Nuromi obtains with them; they are readable only by Nuromi's servers and used only to fetch your data.

Who processes your data

We use a small set of subprocessors to run Nuromi. Each one only receives what it needs to do its job:

• Supabase hosts our database and authentication (Sydney region for Australian customers).
• Vercel hosts the application itself.
• Stripe processes payments. Card details never touch Nuromi.
• Resend sends transactional emails such as sign-in links and receipts.
• Nango manages the secure connections to accounting, payroll, and similar systems you choose to link.
• OpenRouter routes our AI requests to US-headquartered model hosts that do not train on prompts, with zero data retention requested on every call. Mistral AI extracts the text from PDF documents you upload to be read, a step the zero-data-retention request does not cover. Deepgram provides voice-note transcription, only when you have voice notes enabled, within the limits described below; every request is opted out of Deepgram's model-improvement programme, so audio is kept only for as long as it takes to process it.
• Inngest runs our background jobs, such as scheduled data syncs, digest generation and report building. It receives the instructions and identifiers needed to run that work and keeps the result of each job step, which for a generated report is the report file itself. We have not yet confirmed the region Inngest stores that data in.
• Sentry collects error diagnostics so we can fix faults. Before a report is sent, request bodies, cookies and recognised identifiers and secrets are removed, though the text of an error message itself is kept, and we do not send performance traces. Sentry may record the IP address a report is sent from. We have not yet confirmed the region Sentry stores error reports in.

How AI analysis works

For structured data (spreadsheets and connected systems), we aggregate your data on our servers first, and only the aggregated figures are sent to an AI model. Raw records, such as individual transactions or employee rows, are not sent. There is one exception: documents you upload to be read as documents (for example PDFs and business plans) are processed by our AI provider, only on model hosts that do not train on prompts, and every model call requests zero data retention. The text of a PDF is first extracted by Mistral AI, which that request does not cover. Nuromi does not store the uploaded file itself once its contents have been extracted. In all cases, your data is not used to train AI models by Nuromi, and our agreements with AI providers reflect that.

Retention and deletion

Your dashboard shows your historical business data (the figures Nuromi analyses and reports on) on a rolling window sized to your plan: 3 months on Starter, 12 months on Growth, and 36 months on Command. Moving to a higher plan makes more of those business figures visible immediately, because they were never deleted, only outside your plan's query window. Assistant chat history is the exception: those conversations are deleted on the same schedule rather than hidden, so a higher plan does not bring an old chat back. Your account records, such as your login and billing details, are kept for as long as you hold an account, because the service is built from them. You can export your data at any time in CSV or PDF format, and you can request deletion of your data or your whole account by emailing us. When you request deletion, we remove your data from our systems and instruct our subprocessors to do the same, except where we are legally required to retain certain records (for example, billing records for tax purposes).

Your rights

We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). You have the right to access the personal information we hold about you, to ask us to correct it if it is wrong, and to complain to us (and to the Office of the Australian Information Commissioner) if you believe we have mishandled it. To exercise any of these rights, email us at support@nuromi.ai and we will respond within a reasonable time.

For customers outside Australia, including those in the European Union and the United Kingdom, we apply GDPR-aligned handling to your personal data, including rights of access, correction, portability, and erasure.

Data breaches

If a breach affects your account details, such as your name, email, or billing information, Nuromi holds that data directly and is responsible for it: we assess the breach and, where the law requires it, notify you, affected individuals, and the Office of the Australian Information Commissioner as soon as practicable. If a breach affects business data you have uploaded or connected, Nuromi, as your processor, notifies you as soon as practicable with what happened, what data was involved, and what we changed, and you, as controller of that data, decide on and make any notification to affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. Where GDPR applies, the supervisory authority is notified within 72 hours.

Changes to this policy

We may update this policy as the product and the law change. When we make a material change, we will update the date at the top of this page and let you know by email or inside the product. Your continued use of Nuromi after a change takes effect means you accept the updated policy.

Contact us

Questions about privacy, your data, or this policy: email support@nuromi.ai.