Privacy Policy

1. Who is responsible for your data

nurulu operates nurulu.com and the nurulu student portal. We are a private, for-profit online professional training provider based in Florida, United States. For any privacy question or request, email hello@nurulu.com.

2. Information we collect

Information you give us

• Contact form: your full name, email address, phone number (optional), the program you are interested in and your message.
• Enrollment and checkout: your full name, email address, phone number, billing address, the program you purchase, and your confirmation that you are 18 or older and accept our terms.
• Student portal: assignment submissions, questions you send to instructors or support, and any profile details you update.

Payment information

Payments are handled by Stripe. Your card number, expiration date and security code are entered on Stripe's secure checkout page and go directly to Stripe. We do not receive or store full card numbers. We receive from Stripe a payment confirmation, the last four digits and brand of the card, the billing name and address, and the amount paid, so we can issue receipts, handle refunds and keep accounting records.

Information collected automatically

• Course access and progress logs: when you sign in, open a program, view a lesson or mark a lesson complete, we record the event with the date and time, your IP address and your browser's user agent. We keep these records as proof that the program was delivered and to calculate refund eligibility.
• Terms acceptance: the date, time, IP address, user agent and agreement version recorded when you accept the terms at checkout.
• Technical data: standard server logs (IP address, pages requested, browser type, referring page) used for security and to keep the site running.
• Referral attribution: if you arrive through a link that includes an advisor code, we store that code in a cookie so the advisor who helped you can be credited if you enroll.

We do not collect Social Security numbers, government ID numbers or financial account numbers.

3. How we use your information

• to respond to your contact request and have an advisor follow up with you;
• to process your enrollment, create your student account and give you access to the program;
• to send receipts, sign-in links, program updates and support replies;
• to keep proof of delivery: which lessons were opened and completed, when, and from where;
• to decide refund requests according to our Refund & Cancellation Policy;
• to issue and verify your Certificate of Completion;
• to credit the advisor who referred you;
• to prevent fraud, abuse and account sharing, and to secure our systems;
• to comply with tax, accounting and other legal obligations; and
• with your consent, to send occasional emails about new programs. You can opt out at any time.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

4. Who we share information with

We share personal information only with the service providers that help us run nurulu:

• Stripe (payment processing, receipts, refunds and, where enabled, sales tax calculation);
• Resend (our email delivery provider, used to send transactional emails such as receipts and sign-in links);
• Vercel (website hosting and server logs);
• Supabase (database, authentication and file storage for the student portal); and
• Upstash (rate limiting, which processes IP addresses briefly to block abuse).

These providers process data on our behalf under their own security and privacy commitments. We may also disclose information when required by law, to respond to a lawful request, to enforce our terms, to protect the rights or safety of nurulu, our students or others, or as part of a merger, acquisition or sale of assets (in which case this policy continues to apply to your data).

Advisors who work with nurulu can see the contact details of the leads assigned to them and the orders attributed to them, so they can follow up with you. They are bound by confidentiality obligations.

5. Cookies

We use a small number of cookies and do not use advertising or cross-site tracking cookies.

• Session cookies: set when you sign in to the student portal to keep you signed in. They are required for the portal to work and are removed when you sign out or when the session expires.
• Attribution cookie (nu_ref): set when you arrive through a link with an advisor code. It stores only that code, lasts 30 days, and is used to credit the advisor if you enroll.

You can block or delete cookies in your browser settings. If you block session cookies, you will not be able to sign in to the portal.

6. How long we keep information

• Contact form leads: up to 24 months after the last contact, unless you enroll or ask us to delete them sooner.
• Student accounts, enrollments and progress logs: for as long as your account is active and for 7 years after your last enrollment ends, because these records are our proof of delivery and support certificate verification.
• Orders, receipts and refund records: 7 years, to meet tax and accounting requirements.
• Terms acceptance records: as long as the related order record is kept.
• Server and security logs: typically 90 days.

7. Security

We protect your information with encryption in transit (HTTPS), encrypted storage at our providers, role-based access controls in our database, sign-in links and passwords handled by our authentication provider, and rate limiting on public forms. Access to student and customer data is limited to staff and advisors who need it. No system is completely secure, so we cannot promise that unauthorized access will never happen. If we learn of a breach affecting your personal information, we will notify you as required by law.

8. Your rights and choices

Depending on where you live, you may have the right to:

• ask what personal information we hold about you and receive a copy;
• correct information that is inaccurate;
• ask us to delete your personal information;
• object to or limit certain uses; and
• opt out of marketing emails.

To exercise any of these rights, email hello@nurulu.com from the address associated with your account with the subject "Privacy request". We will verify your identity and respond within 30 days. We will not treat you differently for exercising your rights.

Deletion requests: we delete or anonymize your data unless we must keep it. Records we are required to keep (orders, receipts, refund records and proof-of-delivery logs tied to a paid enrollment) are retained for the periods above and then deleted. Deleting your account ends your access to any active program.

You can update your name, email and phone number in the student portal at any time. Marketing emails include an unsubscribe link; transactional emails (receipts, sign-in links, program notices) are sent as long as you have an account.

9. Children

nurulu programs are for adults. The website and the portal are not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

10. Where data is processed

We serve customers in the United States and our providers store data in the United States. If you access the site from elsewhere, your information will be transferred to and processed in the United States.

11. Changes to this policy

We may update this policy from time to time. The date at the top shows the latest revision. If we make a material change in how we use your information, we will post a notice on the website or email enrolled students before the change takes effect.

12. Contact

Privacy questions and requests: hello@nurulu.com. See also our Terms of Service and Refund & Cancellation Policy.