Privacy policy

NubryxAI is operated as a sole proprietorship trading under the name NubryxAI, based in San Fernando, Trinidad and Tobago ("NubryxAI", "we", "us"). We are the controller of the personal data described in this policy. For any privacy question or request, contact support@nubryx.app.

For information you enter about your own customers, you are the controller of that information and we act as your processor, handling it on your instructions so that the service can function.

When you register we collect your email address, an authentication credential (your password is stored only as a salted hash, never in readable form), and your full name if you provide one. We also record account timestamps such as when your account was created, when you last signed in and when your email address was confirmed.

We use this information to create and secure your account, to verify your email address, to let you reset your password, and to contact you about your account.

To brand your quotes, you provide business details such as company name, business email, phone number, postal address, website, and an optional logo image. You also set defaults including currency, tax rate, quote validity period, payment terms, footer text and quote number prefix.

This information is used to render your quotes, your PDF documents and the emails sent on your behalf. Logos are stored in access-controlled file storage and are visible to recipients of the quotes you send.

NubryxAI stores the customer records you create: business name, contact name, email address, phone number, postal address and any notes you add. This is personal information about third parties, and you decide what to enter.

You are responsible for having a lawful basis to store and use your customers' details, and for making sure the information you enter is accurate and relevant. We use it only to operate the service for you, namely to display your customer list, to populate quotes, and to deliver quote emails to the addresses you specify. We do not sell it, rent it, or use it to market to your customers.

Quotes you create are stored with their line-item descriptions, quantities, unit prices, tax rates, totals, dates, notes, payment terms, footer text, status and status timestamps. Each quote also has a long, randomly generated share token.

When you send a quote, the recipient can open a page at that token's address. Anyone holding the link can view that single quote and accept or decline it, so treat quote links as confidential. We record when a quote link was first opened and when a response was submitted, and we show that to you as the quote's status. We do not build profiles of your recipients and we do not use quote contents for advertising.

Sign-in is handled by our managed authentication provider. Sessions are maintained with tokens stored in your browser so you stay signed in between visits. In the course of providing and protecting the service, our infrastructure providers process technical data such as IP address, browser user agent, request timestamps and error logs. These records are used to keep accounts secure, to detect abuse and to diagnose faults.

We send email only where it is necessary to operate the service:

• Account emails, such as email confirmation and password reset.
• Quote emails sent to the recipient address you choose, containing your message, quote summary and secure quote link.
• Service and billing notices, such as changes to these policies, trial and renewal reminders and payment problems.

These are not marketing messages and are required for the service to work, so they cannot be unsubscribed from while your account is active. Our email provider processes the recipient address, subject and message content in order to deliver them, and records delivery outcomes such as bounces.

Subscription payments are processed by Paddle, which acts as Merchant of Record for NubryxAI. Paddle collects and processes your payment details (card or other payment method, billing name, billing address and tax identifiers) directly. Card numbers and equivalent payment credentials are never sent to, seen by, or stored on NubryxAI systems.

We receive from Paddle only what we need to run your subscription: a customer and subscription identifier, plan, subscription status, currency, period dates and payment outcome. Paddle's handling of your payment data is governed by Paddle's own privacy policy and terms.

We share information with a small number of providers who process it strictly on our instructions and only to make the service work:

• Cloud hosting, managed database, file storage and authentication, which store your account, business, customer and quote data.
• Our transactional email provider, which delivers account and quote emails.
• Paddle, our Merchant of Record, which handles subscription payments, tax and invoicing.
• Error monitoring and operational logging used to detect and fix faults.

We do not sell personal information, we do not share it with advertising networks, and we do not use it to train machine-learning models. We may also disclose information where we are legally required to do so, or to establish, exercise or defend legal claims.

Traffic between your browser and NubryxAI is encrypted in transit with TLS, and data is encrypted at rest by our hosting provider. Every private record is tied to the owning account and protected by database-level row security, so one account cannot read another's customers or quotes. Passwords are stored only as hashes. Public quote links use long, cryptographically random tokens that cannot practically be guessed, and grant access to that single quote only. Uploaded logos are checked for file type and size.

We also apply a content security policy and strict transport security to the site, send requests for private data through server-side checks rather than trusting the browser, throttle repeated requests to sensitive endpoints, and record security and billing events on your account so unusual activity is visible to you in Settings.

NubryxAI never sees or stores your customers' card details. Card entry, storage and processing are handled entirely by Paddle as merchant of record; we store only the subscription status and identifiers needed to give you access.

No online service can promise absolute security, and nothing here is a certification or a guarantee. Please use a strong, unique password, keep your sign-in details private, and tell us at support@nubryx.app if you believe your account has been accessed without your permission.

We keep your account, business settings, customers and quotes for as long as your account exists, because they are the records you rely on. Ending a subscription does not delete your business data.

Some data is retired on a fixed schedule to limit unnecessary exposure. Public quote links stop working six months after the quote was answered or expired; the quote itself stays in your account. Security and billing activity records are deleted after six months.

When you ask us to delete your account, we delete or irreversibly anonymise your account, business profile, customers, quotes and quote items, and remove uploaded logos. Backups are retained on a rolling schedule and expire in the ordinary course, so residual copies may persist for a limited period after deletion. We keep billing and tax records for as long as applicable law requires.

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, restrict or object to certain processing, receive a portable copy, and withdraw consent where processing relies on consent.

Two of those rights are built into the app and need no request. In Settings, Account you can download a complete, machine-readable copy of everything stored on your account, and you can permanently delete your account and its data. You can also review and change most account, business and customer information directly in the app at any time.

For anything else, email support@nubryx.app from the address on your account. We will verify your identity and respond within the period required by applicable law. If you are unhappy with our response you may complain to your local data protection authority.

If you are the customer of a NubryxAI user and want your details corrected or removed, please contact that business directly, as they control their own customer records. If you contact us, we will pass your request on to them.

NubryxAI is delivered from cloud infrastructure that may be located in, and accessed from, countries other than yours, including the United States and the European Union. Our payment, email and hosting providers may also process data internationally. Where personal information is transferred out of a region with data-transfer restrictions, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

NubryxAI is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with information, contact us and we will delete it.

We use only the storage that is necessary to run the service: session and authentication tokens that keep you signed in, and preferences you set in the app. We do not use advertising cookies or cross-site tracking.

We may update this policy as the product changes or the law requires. When changes are material we will notify account holders by email or in the app before they take effect, and update the effective date above.

NubryxAI, a sole proprietorship of San Fernando, Trinidad and Tobago. support@nubryx.app. See also our terms of service and refund policy.