Privacy Policy

Nur7 | 1000946657 ONTARIO INC. Version 2.2 | 14 September 2026

1. Scope and contact

1000946657 ONTARIO INC., operating Nur7, is based in Ontario, Canada. This policy explains information handling for our website, business onboarding, account connections, Instagram publishing, keyword-based product-link replies and subscription administration. Contact n@nur7.ai, for the attention of the person responsible for privacy, with questions, requests or complaints. Our merchant and business contact details are also provided with the applicable checkout disclosures.

The connected business determines the purposes of its product marketing and customer interactions. We process relevant shopper information on its behalf under the customer agreement and applicable law. We separately handle necessary account, billing, security and compliance information for our own administration. Instagram/Meta, payment providers and other services may also process information independently under their own notices; this policy does not describe or control every independent activity of those providers.

2. Information and purposes

Onboarding and support. We handle the country, website, Instagram connection, billing contact and other information you actually submit, together with relevant technical and support records. We use it to prepare the connection, configure and administer service, communicate, troubleshoot and meet applicable obligations. Country selection can begin technical profile preparation before payment checkout. It is not itself agreement acceptance, permission to read shopper conversations or authorization to charge. Connecting Instagram requests the permissions and account checks disclosed in that connection process. The service agreement and necessary processing authority must be in place before entrusted processing where law requires them. We do not represent that every customer's complete legal identity, province/state, business authority or tax status has been independently verified.

Billing. Stripe processes payment details through its interface. Nur7 handles associated customer, subscription, trial, invoice, payment-status, cancellation and refund information and records of accepted terms, including version and time. These support the selected price and currency, recurring authorization, customer service and lawful records. Do not send full card credentials by email or Instagram message. A price listed in our agreement is not a statement that every checkout currently offers that currency.

Instagram publishing and keyword replies. Authorized integration access can include account/profile identifiers, connection credentials, post and product mappings, comment or DM events, usernames and identifiers, message text, timestamps and response/delivery information. We use relevant data to match configured product keywords, send the associated product link, publish authorized content, troubleshoot and secure those functions. This is not a general conversational AI inbox. Comment triggers cover the latest 49 posts under the standard workflow, subject to provider limits; DM keywords operate during an active subscription and connection. The service does not include unsolicited follow-up campaigns or a general marketing suppression database. A keyword match does not override an effective refusal or legal restriction on messaging.

Product content and AI. We retrieve product descriptions, pictures, links and other authorized website materials to generate carousels and captions, using OpenAI API services in that workflow. Product materials may contain incidental personal information, including names or faces. They may also be retained in generation records, stored API responses and service artifacts. The standard keyword-reply workflow does not send shopper conversations to Nur7's own carousel-generation AI workflow. This statement is not a claim about every independent process operated by Meta or an integration provider, and it is not a zero-retention representation.

Website and security. Cloudflare hosting, storage and security services, including Turnstile where used, may handle IP addresses, browser/device information, request metadata, security events and browser storage needed to operate or protect the service. Nur7 uses necessary technical information for availability, troubleshooting and abuse prevention. Any additional non-essential tracking or new purpose requiring notice or consent must be disclosed and authorized where required before use.

3. Use restrictions and choices

We do not sell personal information or use entrusted shopper information for cross-context behavioural advertising, unrelated Nur7 marketing, another customer's campaign or unrelated profiling. We do not use entrusted personal information to train general-purpose AI models or authorize our AI processors to do so. Relevant provider terms and settings must support those restrictions. Necessary processing or security retention is different from model training.

A request for one product link is not consent to a later promotional sequence. Business-account notices are not consent to unrelated promotional email. Automated replies may use a fixed product-link template without an automation label on every message; legally required disclosures and recipient rights still apply. Contact the store or n@nur7.ai about an unwanted interaction. Neither that contact route nor a template limitation eliminates a legal duty to stop an unauthorized message.

Do not submit unnecessary sensitive information, payment credentials, health records, government identifiers or children's information. The service is not intended for child-directed interactions or decisions about significant individual interests. Unnecessary sensitive information received incidentally must be restricted and handled as applicable law requires. We do not treat the store's acceptance of our agreement as consent on behalf of every shopper for every possible use.

4. Providers and disclosures

Providers identified for the current service include the following. Access is limited to the relevant function; being listed does not mean every provider receives shopper conversations.

Necessary email, support and professional-service providers may receive the information needed to deliver correspondence or perform the relevant function. Information about actual relevant providers, purposes, processing countries and applicable safeguards is available from n@nur7.ai and must be supplied before processing where law requires it. This policy is not a representation that a separate exhaustive public provider register exists. The identity and location information needed for a legally required assessment or notice cannot be withheld merely because it is not displayed in this table.

Providers acting on our behalf must be subject to the applicable contractual or other legally permitted protections. Their standard accepted terms can supply those protections when their scope covers the relevant service, information and law; a provider's name or headquarters alone does not establish compliance. We remain responsible for duties that applicable law assigns to us. Disclosures required by law, necessary to protect lawful rights or made in a genuine business transfer remain limited by applicable legal and confidentiality obligations.

5. Processing outside your location

Nur7 operates from Ontario, and necessary providers may process information outside your province or country, including in the United States. This service does not promise Canadian-only storage or a particular provider data region. An organization's headquarters is not a complete statement of where its data is processed. Actual relevant countries and safeguards must be confirmed for the processing and supplied where required; contact n@nur7.ai for that information.

Information processed abroad may be subject to lawful access by authorities in that jurisdiction. Applicable transfer safeguards, prior assessments and notices remain necessary. Where Quebec or another applicable law requires an assessment or specific protection before information is entrusted outside the jurisdiction, acceptance of our documents does not complete that assessment. The affected processing must not begin before its mandatory prerequisites are met.

6. Retention and deletion

Cancellation stops service but does not automatically erase or export every application record, stored API response, provider copy or backup. We do not promise a uniform 30-day active-system or 90-day backup deletion schedule. We remain responsible for retaining personal information only while it is necessary for a specified lawful purpose and for applying a workable disposal process when that purpose ends or deletion is otherwise required.

Account and service information may be needed during setup and the subscription and for a limited, justified close-out or support purpose. Transaction, tax, consent, security and dispute records have separate retention needs governed by applicable legal periods and the actual continuing purpose. Those needs do not justify keeping all shopper conversations or unused connection credentials indefinitely. A customer or individual can request applicable access, return, correction or deletion through n@nur7.ai; a request is not the only event that can require disposal.

Backups and provider-held copies remain protected and subject to applicable restrictions and deadlines. Valid deletion obligations must also be respected after a restoration. Where a law requires end-of-mandate deletion or another shorter period, including applicable Quebec entrusted-processing requirements, that requirement controls over a general retention practice. Posts or messages independently retained in Instagram, the store's account or a recipient's account are subject to those parties' own controls and legal duties; Nur7 remains responsible for copies under its control.

7. Safeguards, requests and incidents

We are responsible for security measures appropriate to the information and risk, including protection against unauthorized access, use, disclosure and loss. People with authorized access must have an appropriate confidentiality obligation. This policy does not claim a particular certification, universal account-MFA setting, zero risk or a security architecture that has not been established. Provider features must be used appropriately; a contract statement does not replace the safeguards themselves.

Contact n@nur7.ai to exercise a privacy right available under applicable law, ask about our practices or submit a complaint or appeal. We may request proportionate verification. For a shopper interaction, contacting the relevant store is often the direct route; Nur7 will assist or respond as its own legal role requires. Required response periods and permitted exceptions apply. You do not need to buy another service or waive rights to make a valid request. You may complain to the relevant privacy regulator.

We must respond to security incidents, keep records and provide notifications or assistance as applicable law and our processing obligations require. This includes any applicable Quebec confidentiality-violation and attempted-violation duties. An incident-response process need not be a product feature, but it must work when needed. Removing an Instagram connection or making a privacy request does not by itself cancel billing; use the online cancellation control or contact us with a clear cancellation request.

8. Updates

We will publish changes to this policy and provide advance or additional notice or obtain consent when applicable law requires. New wording does not retrospectively authorize an undisclosed data use or remove an accrued right. The policy version and date identify the text in effect; applicable accepted customer-agreement protections continue unless lawfully changed.

1000946657 ONTARIO INC., operating Nur7 Ontario, Canada n@nur7.ai - privacy, support and cancellation assistance