Privacy policy

Who we are

Nuromi (Nuromi Pty Ltd) is a software service operated from Queensland, Australia. Nuromi generates a business dashboard from data you upload (spreadsheets, PDFs, business plans) or connect (accounting, payroll, and similar systems). This policy explains what data we collect, why we collect it, where it is stored, who processes it, and the rights you have over it.

What we collect

• Account details. Your name, email address, and business name. Magic-link sign-in is the default, so most accounts never have a password. If you choose to add a passkey or set an optional password in Settings, it is stored only as a salted hash by our authentication provider, Supabase Auth, never by us.
• Business data you choose to provide. Files you upload (spreadsheets, PDFs, business plans) and data from systems you choose to connect, such as accounting or payroll platforms. You control what is uploaded or connected, and you can remove it.
• Usage data. How you use the product, such as pages viewed and features used, so we can fix problems and improve the service. This includes technical details sent by your browser, such as your IP address, browser type, and the time of each request. Your IP address is recorded against your sign-in sessions and against error reports, both as a security measure. Audit logs also record access to your data as a security measure.
• Billing information. Payments are processed by Stripe. Your card details go directly to Stripe and never touch Nuromi's systems. We hold only your subscription status and billing history.

Why we collect it

We collect and process your data for one purpose: to provide the service. That means generating your dashboard and insights from the data you give us, keeping your account secure, billing your subscription, sending you transactional emails (like sign-in links and receipts), and supporting you when something goes wrong. We do not sell your data, and we do not use it for advertising.

Where your data is stored

For Australian customers, data is hosted in Australia by default: our database runs on Supabase in the Sydney region (AWS ap-southeast-2), and the application is served through Vercel. Other hosting regions are available on request for customers outside Australia. Data is encrypted with TLS 1.3 in transit and AES-256 at rest. Row-level security keeps every customer's data isolated from every other customer's. Credentials for systems you connect (OAuth tokens) are held encrypted by Nango, our connector provider, and are never stored in Nuromi's own database. Calls to your connected systems are proxied through Nango, which attaches the token.

Who processes your data

We use a small set of subprocessors to run Nuromi. Each one only receives what it needs to do its job:

• Supabase hosts our database and authentication (Sydney region for Australian customers).
• Vercel hosts the application itself.
• Stripe processes payments. Card details never touch Nuromi.
• Resend sends transactional emails such as sign-in links and receipts.
• Nango manages the secure connections to accounting, payroll, and similar systems you choose to link.
• Anthropic (Claude) provides the AI models used for analysis, with zero data retention requested on every call. Deepgram provides voice-note transcription, also with zero data retention, only when you have voice notes enabled, within the limits described below.
• Inngest runs our background jobs, such as scheduled data syncs and digest generation. It receives the job instructions and identifiers needed to run that work.
• Sentry collects error diagnostics so we can fix faults. Error reports are stripped of personal and business data before they are sent, and we do not send performance traces. Sentry records the originating IP address of the request that failed.

How AI analysis works

For structured data (spreadsheets and connected systems), we aggregate your data on our servers first, and only the aggregated figures are sent to an AI model. Raw records, such as individual transactions or employee rows, are not sent. There is one exception: documents you upload to be read as documents (for example PDFs and business plans) are processed by our AI provider, Anthropic Claude, which does not train on customer data, and every call requests zero data retention, so their contents can be extracted and understood without being kept. In all cases, your data is not used to train AI models by Nuromi, and our agreements with AI providers reflect that.

Retention and deletion

We keep your data for as long as you have an account, because the service is built from it. You can export your data at any time in CSV or PDF format, and you can request deletion of your data or your whole account by emailing us. When you request deletion, we remove your data from our systems and instruct our subprocessors to do the same, except where we are legally required to retain certain records (for example, billing records for tax purposes).

Your rights

We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). You have the right to access the personal information we hold about you, to ask us to correct it if it is wrong, and to complain to us (and to the Office of the Australian Information Commissioner) if you believe we have mishandled it. To exercise any of these rights, email us at hello@nuromi.ai and we will respond within a reasonable time.

For customers outside Australia, including those in the European Union and the United Kingdom, we apply GDPR-aligned handling to your personal data, including rights of access, correction, portability, and erasure.

Data breaches

If a data breach occurs that is likely to result in serious harm, we will notify affected customers and the Office of the Australian Information Commissioner without undue delay, in line with the Notifiable Data Breaches scheme. We will tell you what happened, what data was involved, and what we are doing about it.

Changes to this policy

We may update this policy as the product and the law change. When we make a material change, we will update the date at the top of this page and let you know by email or inside the product. Your continued use of Nuromi after a change takes effect means you accept the updated policy.

Contact us

Questions about privacy, your data, or this policy: email hello@nuromi.ai.