Privacy Policy

1. Who we are

NuuStudio is made by Nuulab Systems LLC, Texas, USA ("Nuulab", "we", "us"). We are the controller of the personal data described here. Contact us at hello@nuulab.com.

2. What this covers

This policy covers the nuu.studio website, your dashboard and account, checkout, support, the cloud library, our package registry, and the requests the NuuStudio plugin makes to us (license checks, cloud library, updates and sample images). It doesn't cover the websites you build with NuuStudio; see section 12.

3. What we collect

You give us

• Account details: your email address and, if you add it, your name.
• Billing details: the company name, billing email, address, phone and tax ID you enter, plus your purchase history. Card details go straight to Stripe.
• Your sites: the domains you add or activate, with the names, notes and groups you give them.
• Cloud library items: layouts, pages, themes and templates you save, with their screenshots and thumbnails.
• Support conversations: your messages and any images or videos you attach.
• Team details: the email addresses of people you invite, and their roles.

Collected automatically

• License checks: when the plugin activates or checks a license, it sends the license key, the site's domain and the plugin version. We record the domain, version and when it last checked in.
• Sign-in: a session cookie, the time you signed in, and a session reference from WorkOS so signing out ends both sessions.
• Technical data: your IP address and browser details are used briefly to protect sign-in and limit abuse, and may appear in our hosting provider's short-lived server logs. We don't store them in your account.

From others

• WorkOS tells us your verified email address and name when you sign in.
• Stripe tells us whether a payment succeeded, failed or was refunded, and gives us links to your receipts.

4. How we use it

• To create and secure your account, and let you sign in.
• To sell, deliver, renew and validate licenses, and deliver plugin updates.
• To process payments, send receipts and invoices, and keep the records the law requires.
• To run the cloud library and agency teams.
• To answer support requests.
• To send essential messages about your account, licenses, security or these policies. We don't send marketing emails without your consent.
• To prevent fraud and abuse, and to protect NuuStudio and our customers.

We don't sell or rent personal data, we don't use it for advertising, and we don't use your content to train AI models.

5. Legal bases

If you're in the EEA, the UK or Switzerland, we rely on:

• Contract: to provide the plan and account you asked for.
• Legal obligation: to keep tax and accounting records.
• Legitimate interests: to keep NuuStudio secure, prevent abuse and improve the product, balanced against your rights.
• Consent: where we ask for it, which you can withdraw at any time.

6. Who we share it with

We share personal data only with providers that help us run NuuStudio, under contracts that limit how they can use it:

We may also share data if the law requires it, to protect rights and safety, or as part of a merger or sale of the business, in which case this policy continues to apply. Teammates on an Agency team can see the team's member list, sites and cloud library according to their role.

7. Cookies and storage

nuu.studio uses only what it needs to work. There are no advertising or analytics cookies, and our fonts and videos are served from our own domain.

Checkout runs on Stripe's site and sign-in on WorkOS's hosted page; their own cookies are covered by their privacy policies.

8. How long we keep it

• Account, site, team and support data: while your account is open. When you ask us to close it, we delete or anonymize this data within 30 days.
• Cloud library items: while your plan is active, and at least 90 days after it ends so you can renew. You can delete items at any time.
• Billing and purchase records: as long as tax and accounting laws require, usually 7 years.
• Sign-in sessions: up to 30 days. Attachments uploaded to support but never sent: 1 day.
• Backups roll over on our hosting provider's schedule.

9. Where it's stored

We're based in the United States, and our providers store data in the United States and other countries. When we transfer personal data from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the provider's certification under the Data Privacy Framework.

10. Security

All traffic is encrypted with TLS. Session tokens are stored hashed, license tokens are cryptographically signed, and sign-in supports passkeys and two-factor authentication. Only staff who need access to help you can see account data. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you, and get a copy in a portable format;
• correct it. You can update most details yourself under Account in your dashboard;
• delete it, subject to records we must keep by law;
• object to or restrict certain uses, and withdraw consent;
• complain to your local data protection authority.

California residents: we don't sell or share personal information for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics. You have the right to know, delete and correct, and we won't discriminate against you for using these rights.

To use any of these rights, email hello@nuulab.com. We'll confirm your identity and reply within 30 days.

12. Data on your own sites

NuuStudio runs inside your EmDash site. Form entries, analytics, split-test results and cookie-consent choices it collects from your visitors are stored in your own site's database and are never sent to us. For that data, you are the controller and responsible for your own privacy notice. If you use AI features, your content goes directly from your site to the AI provider whose key you added. If we ever need to access one of your sites (for example, if you give support access to fix a problem), we'll only use the data to help you.

13. Children

NuuStudio is a professional tool and isn't directed at children under 16. We don't knowingly collect their personal data.

14. Changes

If we change this policy in a way that matters, we'll email you or show a notice in your dashboard before it takes effect. The date at the top shows the latest version.

15. Contact

Nuulab Systems LLC · Texas, USA · hello@nuulab.com · nuulab.com