Privacy Policy

1.Who We Are

The data controller responsible for your personal data is:

Nuvaro AG decides why and how your personal data is processed. If you have any questions about this Policy or about how your data is handled, please contact us at privacy@nuvaro.ch.

Representative in the European Union

Nuvaro AG is established in Switzerland and has no establishment in the European Union. Our representative in the Union under Article 27 GDPR, whom clients in the EU and the EEA and supervisory authorities may contact on all questions relating to the processing of their personal data, is:

Contacting our representative does not affect your right to contact us directly at privacy@nuvaro.ch, or to lodge a complaint with the supervisory authority in your country.

2.What Data We Collect and Why

2.1Account data

When you create a Nuvaro account, we collect:

• your name;
• your email address;
• your subscription status and, for a paid subscription, its duration;
• the date your account was created.

We use this data to create and manage your account, to communicate with you about your subscription, and to send you session summaries and other outputs from your use of Nuvaro.

2.2Conversation data

When you use Nuvaro, the content of your coaching conversations — what you write and what Nuvaro responds — is processed in order to provide the service. This data is also retained, as described in Section 4.

We do not use your conversation content to train AI models. Your conversations are processed solely to deliver the coaching service to you.

Your coaching conversations are sealed: nobody at Nuvaro AG or HypeDigitaly can read them unless you choose to share one. If you share a conversation, it can be read by one person at Nuvaro AG, to review the quality of the coaching, and by one person at HypeDigitaly s.r.o., to resolve technical faults. Nobody else.

Nuvaro may write to you by e-mail on his own initiative — for example to ask how something you committed to has gone. Such an e-mail can contain your own words from a conversation, and nothing else from it. You can switch these e-mails off at any time.

Where a conversation touches on health-related information, Nuvaro treats it separately. It is used within the live session to deliver your coaching, but it is not carried into Nuvaro’s memory between sessions unless you have explicitly agreed. See Section 3.

2.3Stakeholder data

On every subscription, including the free Discover month, you may build stakeholder profiles — structured understandings of people in your professional environment. The data in these profiles is information you provide about third parties. You are responsible for ensuring you have the right to share this information (see also the Acknowledgement of Terms and Limitations, Section 9).

Stakeholder profiles are retained and deleted on the same schedule as your conversation data (see Section 4).

2.4Uploaded documents

You may upload documents for Nuvaro to read and work with. Uploaded documents are processed to deliver the service and are retained on the same schedule as your other data (see Section 4).

Nuvaro screens uploaded documents for sensitive personal data as defined by applicable data protection law. Uploads containing such data will be declined. See the Acknowledgement of Terms and Limitations, Section 8, for further detail.

2.5Payment data

Subscriptions are sold through Stripe (Link), which acts as the seller: it takes your payment, sends you the receipt and the invoice, and charges and pays the VAT. Nuvaro AG does not see or store your card number or full payment details. We receive only a payment confirmation and the information needed to manage your subscription (name, billing address, subscription duration, renewal dates).

Stripe’s own privacy policy applies to the processing of your payment data. It is available at stripe.com/privacy.

2.6Technical and usage data

We may collect limited technical data about your use of the platform, including:

• device type and operating system;
• browser type;
• general location data (country level, for geofencing purposes);
• access timestamps and session duration.

This data is used to operate and improve the platform, to enforce geofencing restrictions, and for security purposes. It is not used to profile you for marketing.

We also record an internal usage cost for each message you send, for billing and fair-use purposes (see the Nuvaro Terms of Use, Section 3.5). It is not displayed while you work, and it is deleted together with your account.

2.7Knowledge-gap topics

When Nuvaro is asked about a topic that no part of its coaching knowledge base directly covers, Nuvaro generates a short, generic description of that topic — for example, “cross-border negotiation, Japanese counterparty.” This description excludes names, dates, figures, and any other detail that could identify you or a third party.

This description is stored separately from your conversation history, is not linked to your account or any specific session, and is used only to help Nuvaro AG decide what new coaching knowledge to build. It does not form part of your conversation record and is not covered by the retention schedule in Section 4, since it is not linked to you.

This applies to every account, including the free Discover month.

2.8Keeping the free month fair

To keep the free Discover month fair, we store a one-way cryptographic code derived from your email address — not the address itself — so that repeat sign-ups for the free month can be detected. We do not accept temporary or disposable email addresses. This code is retained even after your Discover data is deleted; it cannot be turned back into your email address.

This processing rests on our legitimate interest in preventing abuse of the free month (see Section 3).

3.Legal Basis for Processing

Under the revDSG and, where applicable, the GDPR, we process your personal data on the following legal bases:

Contract performance

Processing your account data, conversation data, stakeholder data, and uploaded documents is necessary to provide the Nuvaro service you have subscribed to.

Consent

Coaching conversations sometimes touch on health-related information — for example sleep, energy, stress, or mood. That information is sensitive personal data under the revDSG and special-category data under the GDPR. Nuvaro never asks you for it. Where it arises of your own accord, it is used within the live session to deliver the coaching you have asked for, but it is not carried into Nuvaro’s memory between sessions unless you have explicitly told Nuvaro to keep it.

Exclusion is the default. Before your first conversation, Nuvaro explains this and offers you the choice; if you make no choice, health-related content is not retained. You can change your decision at any time, in conversation or in Account settings, or by contacting privacy@nuvaro.ch. Declining or withdrawing does not restrict your use of Nuvaro — your coaching continues, and that content is simply not retained. Withdrawal does not affect processing carried out before you withdrew. This applies to every account, including the free Discover month.

Legitimate interests

Processing limited technical and usage data, and generating de-identified knowledge-gap descriptions (Section 2.7), is necessary for the security, operation, and improvement of the platform, including deciding what new coaching knowledge to build. These interests do not override your rights.

Legal obligation

We may process and retain data where required to do so by Swiss law.

4.How Long We Keep Your Data

Nuvaro retains your data on one schedule, whatever your subscription duration, including the free Discover month.

Discover (free month)

The free Discover month runs for 30 days from your first message. If you create an account but never send a message, the free month does not begin, and we keep your account data (name, email address, and your sign-in details) until you close the account or ask us to delete it.

While you are subscribed

Conversation history, session summaries, stakeholder profiles, generated documents, and uploaded documents are retained for the duration of your subscription, including the free Discover month. No deletion clock runs while you have an active subscription. During an active subscription, dialogue history older than two years is compacted, that is, summarised and condensed into a structured record, to manage context efficiently. The detail of older sessions is replaced by this summary. Compacting is not deletion; the summary is retained on the standard schedule.

After your subscription or free month ends

A twelve-month window begins. Your data is retained for twelve months from the end of your most recent subscription, and the free Discover month counts as a subscription for this purpose. If you subscribe again within that window, everything is restored as you left it, and a fresh twelve months begins when the new subscription ends. If you do not, your coaching data is permanently deleted when the window closes. We remind you by email one month before that happens.

During the twelve-month window

You can still sign in, view what Nuvaro remembers about you, ask us for a copy of your data, and delete your account. Only the coaching conversation itself is unavailable without an active subscription.

Two exceptions apply. Health-related content that you have asked Nuvaro to keep is deleted when your access ends. And accounts whose free month had already fully expired before this version of this Policy took effect are deleted on the schedule stated in the version that applied to them.

Your account itself

The schedules above cover your coaching data. If you only used the free Discover month, your account record (your name and email address) is deleted together with your coaching data when the window closes. After a paid subscription, your account record is kept so that you can return and pick up where you left off, until you close your account or ask us to delete it. You can do that at any time, and we act on it as described below.

A copy of your data

While your access runs, you can ask Nuvaro to summarise anything you have worked on and send it to you as a document. Until your data is deleted, twelve months after your access ends, you can ask us for a copy of it at any time. After that, nothing is left to copy.

Deletion on request

You may request the deletion of all personal data held about you at any time by contacting privacy@nuvaro.ch. We will action this request without friction and within 30 days, or within the shorter period required by applicable law.

When data is erased, copies in our short-term backups can persist for a limited time before they expire as well. This applies to every account and to every kind of erasure described in this section.

5.Who We Share Your Data With

Nuvaro AG does not sell your personal data. We do not share it with advertisers or use it for any purpose other than providing the service to you. We work with a small number of service providers who process data on our behalf, described below.

AI models

Nuvaro uses large language models that run through Amazon Web Services (AWS) Bedrock in the EU, so conversation text is processed inside the EU. The providers of these models do not receive your conversation content and do not use it to train their models. The data processing agreement that covers this processing is with AWS, as described below.

Hetzner Online GmbH and Amazon Web Services (infrastructure)

Nuvaro’s database and primary storage are hosted on Hetzner Online GmbH infrastructure in Germany (EU), with an hourly backup copy on a separate Hetzner server in Finland (EU). AI inference runs through Amazon Web Services (AWS) Bedrock with an EU geographic inference profile, meaning conversation text is processed inside the EU. Observability and technical tracing (Langfuse) is also hosted on EU infrastructure. Nuvaro AG has entered into Data Processing Agreements with both Hetzner and AWS covering EU-based processing under standard contractual clauses.

Stripe (sale and payment)

Stripe (Link) sells the subscription to you and processes your payment. For this it acts under its own responsibility and its own privacy policy. Nuvaro AG shares with Stripe only what is needed to manage your subscription.

Google Workspace (email)

Nuvaro AG uses Google Workspace for business email. When we communicate with you by email, that communication passes through Google’s infrastructure. Google processes email data as a data processor under a Data Processing Agreement with Nuvaro AG.

HypeDigitaly (technical development)

The Nuvaro platform is developed and maintained by HypeDigitaly s.r.o. (Czech Republic). Development team members may access platform infrastructure for maintenance, debugging, and development purposes, subject to confidentiality obligations and access controls that limit exposure to user data. They cannot read your coaching conversations unless you share one, as described in Section 2.2.

Langfuse / ClickHouse (technical observability)

Nuvaro uses a self-hosted instance of Langfuse, running on EU infrastructure (Hetzner), to record technical traces of AI activity for debugging and quality purposes. These traces are deliberately minimised: they carry identifiers, labels, timings and counts only — never the text of your coaching conversations. They are not used for any purpose beyond operating and improving the platform.

We will disclose your personal data to third parties outside the above if required to do so by law, or to protect the rights, property, or safety of Nuvaro AG, its users, or others.

6.Where Your Data Is Stored

Your personal data is stored on Hetzner infrastructure in Germany (EU), with an hourly backup copy in Finland (EU). AI inference runs through AWS Bedrock with an EU geographic inference profile — conversation text is processed inside the EU and does not cross the EU border as part of coaching. Technical tracing (Langfuse) is also hosted on EU infrastructure (Hetzner). Two transfers outside the EU occur, both governed by standard contractual clauses: (a) payment processing by Stripe; and (b) Google account login, where you choose to sign in with Google.

For questions about how individual processors handle data, their Data Processing Agreements and standard contractual clauses are available on request at privacy@nuvaro.ch.

7.Cookies and Tracking

Nuvaro sets only the cookies that are strictly necessary to run the service. There are no advertising cookies, no third-party analytics, and no cross-site tracking of any kind. The public pages of nuvaro.ch run no scripts at all.

The necessary cookies we set are:

• a sign-in cookie that keeps you signed in to your account;
• a security cookie that protects your session against cross-site request forgery;
• a short-lived cookie that carries the state of a Google sign-in while it is in progress.

All of these are restricted to nuvaro.ch, are sent only over an encrypted connection, and cannot be read by scripts in your browser. They are deleted when you sign out or when they expire.

Separately, the application stores a few small settings in your own browser — whether you use the light or dark appearance, whether the conversation list and the workspace panel are open, which page to return you to after a security re-check, and a note of when the service last became unreachable so the app can tell you it is offline. On the separate administration console, the browser also remembers the identifier an administrator last signed in with. These stay on your device, are never used to identify or track you, and are cleared when you clear your browser data.

Because we set no non-essential cookies, no cookie consent banner is required. If you block or delete the necessary cookies, signing in will not work.

8.Your Rights

Under the revDSG, you have the following rights in relation to your personal data:

Right of access

You have the right to ask us what personal data we hold about you and to receive a copy of it.

Right to rectification

You have the right to ask us to correct personal data that is inaccurate or incomplete.

Right to erasure

You have the right to ask us to delete your personal data. We will action this request without friction. See also Section 4 above.

Right to data portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another service.

Right to withdraw consent

Where we process your data on the basis of your consent — see Section 3 — you have the right to withdraw that consent at any time, in Account settings or by contacting privacy@nuvaro.ch. Withdrawing is as straightforward as giving consent, and does not affect the lawfulness of processing carried out beforehand.

Right to object

You have the right to object to processing of your personal data where that processing is based on our legitimate interests.

Right to restriction

You have the right to ask us to restrict the processing of your personal data in certain circumstances — for example, while a dispute about accuracy is being resolved.

How to exercise your rights

To exercise any of the above rights, contact us at privacy@nuvaro.ch. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

9.Children’s Data

Nuvaro is intended for adults aged 18 and over, using the platform in a professional or leadership context. We do not knowingly collect personal data from anyone under the age of 18.

If you believe that a minor has provided personal data through Nuvaro, please contact us at privacy@nuvaro.ch and we will delete it promptly.

10.Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email at least 30 days before the new Policy takes effect. The version number and date at the top of this document indicate when it was last updated.

Your continued use of Nuvaro after a new Policy takes effect constitutes your acceptance of the revised terms. If you do not accept the changes, you may close your account before the new Policy comes into force.

11.Contact

For all privacy-related questions, requests, or complaints:

For complaints that are not resolved to your satisfaction, you may contact the Federal Data Protection and Information Commissioner (FDPIC):