Privacy
Policy

Nurvai (“Nurvai,” “we,” “us,” or “our”) develops and operates the Nurvai mobile application (package com.nurvai.collector, the “App”), together with related services for the collection, processing, storage, and supply of data for robotics and artificial intelligence. This Privacy Policy explains how we collect, use, share, retain, and protect personal data when you use the App or interact with our services.

Nurvai is a data collection company. The App is primarily used by authorized operators to capture video, audio, and sensor data from real-world activities. That data may include images or voices of individuals and is used to create datasets, annotate and process them, and train, test, or evaluate artificial intelligence models for humanoid robots and other physical AI applications.

If you do not agree with this Policy, do not use the App or our services.

1. Data Controller

The data controller is:

Nurvai
1309 Coffeen Avenue STE 1200
Sheridan, Wyoming 82801
United States
Email: contact@nurvai.ai

When Nurvai collects data on behalf of an enterprise customer, that customer may be the controller and Nurvai may act as a processor. In those cases, the customer’s privacy policy may also apply. This Policy describes the processing Nurvai carries out for its own purposes and, in general terms, how we handle data in the App.

2. Scope

This Policy applies to:

• The Nurvai Android App.
• The accounts, dashboards, and upload and processing services associated with the App.
• Nurvai websites that link to this Policy.

It does not apply to third-party websites, applications, or services that have their own privacy policies.

3. Data We Collect

3.1 Account and Access Data

When an account is created or used, we may collect:

• Name, username, email address, and password (stored in encrypted or hashed form).
• Role, company, partner, customer, site, station, operator, and assigned project.
• Account and organization identifiers.
• Authentication tokens and login records.
• Account and language preferences.
• Information you provide when requesting support.

3.2 Video, Audio, and Sensor Data

When you use the recording features, the App may capture and upload:

• Video and images from cameras, including stereo, depth, fisheye, or multiple cameras when the equipment supports it.
• Microphone audio, when included in the recording.
• Sensor and telemetry data, such as IMU, pose, orientation, movement, calibration, timestamps, and device status.
• Recording metadata: project name, task, site, station, operator, partner, duration, date, labels, quality, and upload status.
• Derived files, annotations, labels, indexes, thumbnails, transcripts, and processing results.

This data may contain personal information about you, other people who appear or speak in the recording, and people present in the work environment. It may also reveal information about the workplace, tools, products, processes, and environmental conditions.

The App is not designed to perform facial recognition or biometric identification of individuals. We do not use the App to identify individuals through facial recognition or voiceprints. If we add such a feature in the future, we will update this Policy and obtain the required consents.

3.3 Technical and Usage Data

We may automatically collect:

• Device model, manufacturer, operating system, and version.
• App version and installation identifiers.
• IP address, connection type, and approximate network data.
• Error, failure, performance, and diagnostic logs.
• App usage events, screens visited, and actions taken in the App.
• Upload records: size, duration, status, retries, checksums, and errors.
• Access date and time.

We do not use this data for behavioral advertising or to track you across third-party apps or sites.

3.4 Communications and Support

If you contact us, we may collect your name, email address, company, message content, attachments, and conversation history to respond and follow up.

3.5 Data We Do Not Request

We do not request health data, racial or ethnic origin, religion, political opinions, sexual orientation, sex life, trade union membership, or biometric data to identify you. If any such data appears incidentally in a recording, we will treat it as sensitive information and apply appropriate safeguards and legal bases.

4. How We Use Data

We use data to:

• Create and manage accounts, authenticate users, and control access.
• Enable the recording, upload, resumption, and verification of videos and sensor data.
• Organize, label, annotate, curate, and quality-control data.
• Create datasets for robotics and artificial intelligence.
• Train, fine-tune, validate, test, and evaluate AI models, including models for humanoid robots and other physical AI applications.
• Generate derived data, metrics, indexes, embeddings, annotations, and dataset versions.
• Provide services to enterprise customers and partners that commission the collection or processing of data.
• Operate, maintain, diagnose, and improve the App and our services.
• Detect fraud, abuse, unauthorized access, and security issues.
• Comply with legal, contractual, and audit obligations.
• Respond to rights requests, support requests, and complaints.
• Send operational, security, or service-related communications.
• Send marketing communications where permitted by law and, where required, with your consent.

We do not sell personal data. We do not use App data for third-party advertising.

5. Legal Bases for Processing

Where applicable law requires it, we process data on the following legal bases:

• Performance of a contract: to create your account, provide the App, and perform the services you have engaged.
• Legitimate interests: to operate, protect, and improve our services, prevent fraud, and exercise or defend legal rights.
• Consent: where required by law, for example for certain uses of sensitive data, marketing communications, or non-essential cookies. You may withdraw your consent at any time.
• Legal obligation: to comply with laws, requests from authorities, and retention obligations.
• Vital interests or protection of rights: where necessary to protect an individual.

When Nurvai processes data on behalf of an enterprise customer, the applicable legal bases and notices may be the responsibility of that customer. Nurvai may process the data in accordance with the customer’s instructions and the applicable contract.

6. Sensitive Data and People Appearing in Recordings

Videos and audio may include faces, voices, uniforms, documents, screens, locations, and conversations. They may also include sensitive information incidentally.

Nurvai takes steps to limit the capture of people who are not participating in the collection. Where required, operators must:

• Inform people present about the recording.
• Obtain the necessary consents.
• Avoid recording private areas or people outside the project.
• Follow the customer’s and the site’s instructions.

If you appear in a recording and want to exercise your rights, contact us at contact@nurvai.ai or use the form identified in section 12.

6.1 Face Blurring in Post-Processing

As a data minimization measure, Nurvai applies post-processing to reduce the presence of personal data that is not necessary for the project. Where the contract, the project, and applicable law permit, the faces of people outside the project and minors are blurred, redacted, or cropped before the material is used for training, annotation, or shared with a customer.

Face detection is used only to locate and blur those faces; it is not used to identify people or create biometric templates. Blurring may be performed using automated tools and reviewed by authorized personnel where necessary.

Where a face cannot be blurred due to technical limitations, the material will be subject to restricted access controls and applicable contractual limitations. If the processing cannot be performed appropriately, Nurvai may delete the recording or refrain from using it for purposes that require that information.

Blurring does not automatically make all video anonymous. Data that is not necessary for a specific purpose is deleted, restricted, or retained only in accordance with this Policy and the applicable contract.

7. How We Share Data

We may share personal data with the following categories of recipients:

• Nurvai enterprise customers and partners that commission the collection, processing, or supply of data. These customers may use the data to train, test, or evaluate their own AI models, subject to the applicable contract.
• Service providers that help us operate the App and our infrastructure, including hosting, cloud storage, databases, authentication, email, support, failure analytics, security, and video processing. These may include providers such as Backblaze B2, Hetzner, and Google Firebase.
• Nurvai affiliates, where necessary to provide the service and subject to the same safeguards.
• Professional advisers, such as lawyers, auditors, and accountants, subject to confidentiality.
• Authorities and third parties where required by law, a court order, a security investigation, or the protection of rights.
• Successors in the event of a merger, acquisition, reorganization, or sale of assets, subject to applicable safeguards.

We do not sell personal data or share it for third-party behavioral advertising.

When we share data with providers, we require contractual confidentiality, security, and limited-use measures. Some providers may be located in the United States or other countries. Where necessary, we will apply safeguards such as standard contractual clauses.

8. Data Retention

We retain data for as long as necessary for the purposes described in this Policy and in accordance with our contracts:

• Account and access data: while the account is active and, afterward, for as long as necessary to meet legal obligations, resolve disputes, and prevent fraud. This is normally up to 24 months after closure, unless the law requires a different period.
• Videos, sensor data, and datasets: according to the customer contract and the project lifecycle. If no specific period exists, we retain them while necessary for collection, annotation, training, validation, or maintenance of the models and services, and then delete or anonymize them when no longer needed.
• Data used to train models: may be retained for the life of the relevant model or service, or for the period agreed with the customer, because it forms part of the model’s development and traceability.
• Support and communications: normally up to 24 months.
• Security and upload records: normally up to 12 months, unless required for investigations or legal obligations.
• Backups: may be retained for up to 90 additional days before deletion or rotation.
• Aggregated or anonymized data: may be retained indefinitely, provided it does not identify an individual.

If you request deletion, we will delete or anonymize the data we are required to delete. We may retain data that we must keep for legal, contractual, security, or defense-of-rights reasons, and we will inform you where appropriate. Data belonging to an enterprise customer may be subject to that customer’s instructions and contract.

9. Security

We apply reasonable technical and organizational measures to protect data, including:

• Encryption in transit using HTTPS/TLS.
• Access controls, authentication, and role-based permissions.
• Storage separation by customer, project, or business unit.
• Audit logs and access monitoring.
• Backups and recovery procedures.
• Access restrictions for employees and providers.
• Security reviews and App updates.

No system is completely secure. We cannot guarantee absolute security of information. If an incident affects personal data, we will notify individuals and authorities where required by law.

10. Your Rights

Depending on your country, you may have the right to:

• Access your personal data.
• Correct inaccurate or incomplete data.
• Request deletion of your data.
• Request restriction of processing.
• Object to certain processing.
• Request portability of your data.
• Withdraw your consent.
• File a complaint with a data protection authority.

To exercise these rights, contact us at contact@nurvai.ai or use the request form identified in section 12. We may ask for reasonable information to verify your identity. We will respond within the applicable legal deadlines.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you may also file a complaint with the data protection authority in your country.

California Residents

If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, access, correct, delete, limit the use of sensitive information, and not be discriminated against for exercising your rights. We do not sell personal information or share it for cross-context behavioral advertising. To exercise your rights, use the contact details in this Policy.

11. Minors

The App is not directed to minors under 18 and is not designed for use by minors. We do not knowingly collect personal data from minors through the App. If you are a parent or guardian and believe that a minor provided data to us, contact us to request its deletion. Operators must avoid recording minors unless valid authorization exists. When a minor appears incidentally in a recording, their face will be blurred or the recording will be deleted during post-processing, unless valid authorization and a specific need for the project exist.

12. Account Deletion and Privacy Requests

You may request deletion of your account and associated data through:

• The Delete Account button in the App’s profile section, which opens our request form.
• The form: https://docs.google.com/forms/d/e/1FAIpQLScSsn9F9k08VouztD3U-QFAuXHKnS4bIXgYQDZqGG3A7N4gIQ/viewform
• Email: contact@nurvai.ai

Include the email address or username for the account and, if possible, the project or company name. We may ask you to verify your identity. If your account is linked to an enterprise customer, we may refer the request to that customer or act on its instructions.

Deleting your account does not necessarily mean the immediate deletion of all videos or datasets that must be retained for legal, contractual, security, or model-traceability obligations. In those cases, we will delete or anonymize data that is no longer necessary and retain only what is permitted.

13. App Permissions

The App may request camera, microphone, storage, network, and notification permissions. These permissions are necessary to record, save, upload, and monitor the status of recordings. You may deny or revoke permissions in Android settings, but some features may become unavailable.

14. Cookies and Similar Technologies

The App does not use cookies for advertising. Our websites may use necessary, analytics, or preference cookies. Where required by law, we will display a notice and request consent for non-essential cookies. You can manage cookies in your browser.

15. International Transfers

Nurvai operates from the United States and may use providers in other countries. When we transfer personal data outside the European Economic Area, the United Kingdom, or Switzerland, we apply appropriate legal mechanisms, such as standard contractual clauses, and additional measures where necessary.

16. Changes to This Policy

We may update this Policy to reflect changes to the App, our services, or the law. We will publish the updated version on this page and indicate the last updated date. If changes are material, we may notify you in the App or by email. Continued use of the App after the effective date means you accept the updated Policy to the extent permitted by law.

17. Contact

For questions, requests, or complaints regarding this Policy:

Nurvai — Privacy
1309 Coffeen Avenue STE 1200
Sheridan, Wyoming 82801
United States
Email: contact@nurvai.ai

If your request concerns data that an enterprise customer has asked us to process, you may also contact that customer directly.

Annex A. Processing of Video, Faces, and Minors

This Annex forms part of the Privacy Policy and specifically explains the processing of video, images, audio, and sensor data captured through the App.

A.1. Purpose of Processing

Videos and sensor data are used to create, annotate, validate, and supply datasets, and to train, test, and evaluate artificial intelligence models for robotics and other physical AI applications. Processing is carried out in accordance with the enterprise customer contract, the authorized project, and applicable law.

A.2. Blurring of Third Parties and Minors

During post-processing, Nurvai applies measures to minimize the capture of people who are not necessary for the project:

• The faces of people outside the project are blurred, redacted, or cropped where the contract and the purpose permit.
• The faces of minors are blurred or the recording is deleted, unless valid authorization and a specific need for the project exist.
• Face detection is used only to locate and blur faces; it is not used to identify people or create biometric templates.
• Blurring may be automated and reviewed by authorized personnel.
• If blurring is not technically possible, restricted access controls and contractual limitations apply; if individuals still cannot be adequately protected, the recording is not used for that purpose.

A.3. Raw Data and Restricted Access

Original files may contain faces or other personal data before post-processing. Access to those files is limited to authorized personnel and the systems necessary for collection, quality control, annotation, and processing. Nurvai applies access controls, audit logs, and security measures in accordance with section 9.

A.4. Enterprise Contracts and Customer Responsibilities

The App is intended for authorized operators and enterprises, not the general public. When Nurvai processes data on behalf of an enterprise customer, that customer may be the controller and must:

• Inform people present about the recording.
• Obtain the necessary authorizations and consents.
• Avoid unnecessary capture of third parties and minors.
• Instruct Nurvai in writing regarding the scope, retention, and permitted use of the data.

Contracts do not replace legal obligations toward the people who appear in recordings. Nurvai may refuse to process or share material where there is no sufficient legal or contractual basis.

A.5. Requests and Deletion

People who appear in a recording may request access, correction, deletion, or objection through the channels in section 12. Nurvai will evaluate the request with the enterprise customer where appropriate and will delete or anonymize data that is no longer necessary, unless a legal or contractual obligation requires retention.