NUURUZ AI — Privacy Policy
1–2. Introduction and Privacy Principles
This Policy explains how NUURUZ AI and Nzinga Digital Group collect, use, store, protect and disclose personal information across websites, apps, AI conversations, voice, accounts, memory, paid services and linked services. NUURUZ follows data minimization, purpose limitation, security, transparency, user control and respect for individuals and communities. Additional rights under applicable local law remain available.
3–6. Information You Provide
Depending on use, information may include name, email, username, authentication information, profile, preferred language, country/region, preferences, prompts, conversations, uploaded text/documents/images/audio, feedback and support communications. Account records may include identifiers, registration date, status and legal-document acceptance. Uploaded content is processed to perform requested tasks. Users must have appropriate rights to provide third-party information.
7. Voice Information
Voice input may be transmitted and processed to recognize speech, understand requests, generate responses, provide speech output, reliability and security. Raw voice recordings must not be described as permanently retained unless that is actually implemented and disclosed.
8. Memory and Personalization
Where enabled, NUURUZ may retain selected information from interactions to improve continuity and personalization. Memory may include preferences, instructions and relevant previous information. Available controls may allow users to view, change or remove memory. Conversation deletion and separately stored memory may be different operations where applicable.
9–12. Technical Data, Location, Cookies and Analytics
NUURUZ may process IP address, browser/device/OS/app version, approximate network-derived location, language, timestamps, feature usage, sessions, diagnostics, crashes, security events and referrals. Precise device location should only be collected when required by a feature with appropriate permission. Cookies/local storage may support authentication, sessions, security, preferences, functionality, analytics and performance. Non-essential analytics or cookies require consent where applicable law requires it.
13–14. Payments and Third Parties
Payment providers may process transactions. NUURUZ may receive payment status, transaction ID, amount, currency, purchase/subscription status, billing country, limited payment-method details and information needed for refunds, fraud prevention or accounting. Integrated authentication, infrastructure, security, analytics and other providers may provide information permitted by the user and provider.
15–18. How Information Is Used
Information may be processed to provide AI responses, accounts, authentication, history, memory, voice, uploads, paid functionality, payments, support, fraud/abuse prevention, Terms enforcement, security, troubleshooting, reliability, lawful improvement, legal compliance and incident response. AI processing may involve NUURUZ-operated systems and contracted providers subject to appropriate safeguards. Private conversations must not be claimed as automatically used for model training unless that processing is implemented and properly disclosed. Automated systems and authorized personnel/providers may process information for safety and abuse detection where necessary.
19. Legal Bases
Where required by laws such as UK GDPR, EU GDPR or comparable legislation, processing may rely on contract, valid consent, legitimate interests balanced against individual rights, legal obligation or, in limited circumstances, vital interests.
20. Sensitive Personal Information
Conversations may contain health, racial/ethnic origin, religion, political opinions, sexual orientation/sex life, biometric/genetic or other protected information. Users should provide sensitive information only when necessary. Additional safeguards apply where required. Sensitive conversation information is not permission for unrelated advertising or discriminatory use.
21. Children and Young People
NUURUZ must publish applicable minimum account ages and implement parental/guardian consent where legally required. It does not knowingly permit child sexual exploitation or abuse. Information collected from a child contrary to applicable requirements should be appropriately restricted or deleted.
22–23. Advertising and Sale of Information
NUURUZ does not sell personal conversations to advertisers. If advertising or sponsored services are introduced, this Policy must explain data use, third parties and user choices. If any future practice legally constitutes a sale or sharing of personal information, required notices and choices must be provided.
24. When Information May Be Shared
Limited information may be shared with contracted service providers supporting hosting, databases, authentication, payments, security, communications, analytics or AI processing; with authorities when required by valid law/process; where legally permitted and necessary for serious safety/security matters; or as part of a lawful merger, acquisition, restructuring, financing or sale subject to applicable safeguards.
25–28. International Transfers and Regional Rights
Serving Africa and the global diaspora may involve processing across countries. Legally required transfer safeguards may include adequacy decisions, contractual safeguards or other permitted mechanisms. Applicable African national privacy laws remain controlling where relevant. UK/EU users may, subject to legal conditions, have rights of access, correction, deletion, restriction, objection, portability, consent withdrawal and regulator complaint. Users elsewhere retain rights granted by their local law.
29–35. User Rights
Where applicable, users may request access, correction, deletion, export/portability, restriction or objection, and may withdraw consent where processing depends on consent. Identity verification may be required. Some information may need retention for security, fraud prevention, legal obligations, financial records, disputes, backup integrity or enforcement. NUURUZ should not make legally significant decisions solely through automated processing where applicable law prohibits it.
36–37. Retention, Deletion and Backups
Personal information should be retained only as long as reasonably necessary for service provision, security, fraud prevention and legal compliance. NUURUZ must maintain documented retention periods for accounts, conversations, deleted conversations, uploads, voice recordings if retained, memories, security logs, analytics, support, payments and backups. Deleted active data may remain temporarily in secure backups until expiry/overwrite and should not ordinarily return to active use except for legitimate recovery, security or legal purposes.
38–40. Security and Incidents
NUURUZ should maintain reasonable safeguards such as encrypted network communications, secure password handling, authentication/access controls, monitoring, database protections, backups, abuse detection, vulnerability management, logging, incident response and restricted administration. No internet service can guarantee absolute security. Personal-data breaches will be investigated and notifications made where legally required. Users are responsible for protecting credentials and reporting suspected compromise.
41–42. Third-Party Services and Government Requests
Independent linked services may have their own privacy policies. Government and law-enforcement requests will be assessed under applicable law; where legally permitted, only information reasonably required by a valid request should be disclosed, and invalid or excessive requests may be challenged where appropriate.
NUURUZ Personal Assistant (NIA) — Private Personal Vault
NIA is an optional Personal Assistant feature available worldwide. If a user activates NIA, the user may choose to provide personal information such as name, birthday, family and relationship information, location, work, routines, preferences, goals, important dates, personal history, beliefs or other information the user wants NIA to remember. NIA Personal memory is stored in the user's protected Personal Vault and is used only to provide the Personal Assistant functions the user enables and permits.
Private-by-design administrator boundary: NUURUZ administrators, including the operator/owner, are not provided an interface or permission to browse or read the contents of a user's NIA Personal Vault. The administration system may receive operational metadata needed to run and secure the service, such as whether NIA is enabled, aggregate counts, service health, delivery status, security events and other non-content telemetry, but it must not expose the user's Personal memory content through the admin cockpit.
NIA Personal information is not to be sold, used as advertising inventory, or treated as operator-owned content. Access by NIA's reasoning systems is mediated by the Personal Governor and limited to context the user has permitted. Users can disable NIA, disable categories, delete individual Personal memories, or delete their NIA Personal data using available controls. Deletion is intended to remove Personal Vault content from active Personal storage; NUURUZ does not promise that data can be restored after deletion. Any technically unavoidable backup, security, fraud-prevention, accounting or legal retention, if applicable, remains governed by applicable law and this Policy rather than being available for ordinary administrator browsing.
NIA may offer optional proactive features such as Care Check-ins, reminders and alarms. Care Check-ins are off by default and require user choice. Users may turn them off. NIA must not infer that a period of inactivity is itself an emergency.
43–46. Changes, Terms, Contact and Controller
This Policy may change as NUURUZ, its data practices or law changes. Material changes will receive notice where required and new uses requiring consent will request it. This Policy should be read with the Terms of Use. Users must have a clear Contact Us route for privacy requests. The production service must identify the verified legal controller and any legally required DPO/representative details; such details must not be invented.
Registration Privacy Acceptance
Users must be able to read this Policy before registration. The acceptance control must not be pre-selected. Mandatory Terms acceptance and Privacy Policy acknowledgement must remain separate from optional marketing consent. NUURUZ should record the account identifier, applicable Terms version, Privacy Policy version, timestamp and relevant consent status.
Privacy Commitment
NUURUZ is built primarily for Africa and the global African diaspora. Personal information entrusted to NUURUZ should be collected for legitimate purposes, protected appropriately, used transparently and never treated as permission to exploit the people or communities NUURUZ was created to serve.