Privacy Policy

This policy explains how Nuculair ("Nuculair", "we", "us") handles personal information. It covers two groups of people: people who visit our website or use Nuculair, and people whose information may appear in an investigation that one of our customers runs.

We are based in British Columbia, Canada. We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (PIPA), and, where they apply, other privacy laws such as the EU and UK GDPR.

#Who is responsible

Nuculair is responsible for personal information under its control. Our privacy officer can be reached at info@nuculair.com. Our postal address is [registered business address].

#Information we collect

#When you visit our website

• What you send us. If you fill in the request form or email us, we receive what you provide: your name, work email, organization, team and a description of the cases you run.
• Technical information. Our hosting provider records standard server logs, such as IP address, browser type and the pages requested, to keep the site running and secure.
• Your theme preference. If you switch between light and dark mode, that choice is stored in your own browser (local storage). It is not sent to us.

#Access requests

When you send the "Request access" form, we store what you enter (name, work email, organization, team, the optional note and your acceptable-use confirmation), the page you sent it from, your browser's user-agent string, and a salted one-way hash of your IP address. We never store the IP address itself; the hash is used only to limit repeated submissions and investigate abuse. The form uses Cloudflare Turnstile to check that a person, not a bot, is sending it; Cloudflare processes technical signals from your browser for that check under its Turnstile privacy addendum. We use your request only to reply to you and set up access. Requests are stored with Cloudflare (in North America) and deleted within 24 months if they don't lead to an account. To see or delete your request at any time, email info@nuculair.com.

#When you use Nuculair

• Account information. Name, work email, organization, role and login details.
• Billing information. Plan, invoices and payment status. Card details are handled by our payment processor; we don't store full card numbers.
• Case information. The inputs you start a case from (for example a name, email address, username, phone number, photo or domain), the findings the engine collects, your confirm and reject decisions, and the reports you export.
• Usage information. How the product is used, so we can secure it, prevent abuse and improve it.

#About people who are the subject of an investigation

When a customer runs a case, Nuculair collects information about the subject from public sources, breach indexes and, only where the customer enables it, dark-web indexes. This can include names, usernames, email addresses, phone numbers, photos, employers, locations and online accounts. We collect it at the customer's direction and for the customer's stated purpose.

#How we use information

• To provide, maintain and secure the service, and to run the investigations customers request.
• To respond to enquiries and manage customer accounts and billing.
• To detect and prevent misuse, enforce our Acceptable Use Policy and meet legal obligations.
• To improve the product, using de-identified or aggregated information wherever possible.

We do not sell personal information, and we do not use the information in a customer's cases to market to anyone.

#Our role in investigations

For information collected in a customer's case, the customer decides why and how it is used. Customers must have a lawful, legitimate purpose for every case and must comply with the privacy laws that apply to them. Nuculair acts on their behalf to collect and organize the information, and does not use it for any other purpose.

Nuculair may not be used for employment, credit, tenant screening or insurance decisions, or any purpose covered by the U.S. Fair Credit Reporting Act. We do not infer politics, religion, sexuality or health without strong grounding and a human check.

#Consent and legal grounds

We collect, use and disclose personal information with consent, or where the law permits or requires us to do so without consent. If you are in the EU or UK, the legal grounds we rely on are performance of a contract, our legitimate interests (for example securing the service and preventing abuse), compliance with legal obligations and, where needed, consent.

You can withdraw consent at any time, subject to legal and contractual limits. If you do, we'll tell you what that means for the service.

#Sharing

We share personal information only:

• with service providers who host, operate or support Nuculair (for example cloud hosting, email and payment processing), under contracts that require them to protect it;
• with the customer who ran the case, for information collected in that case;
• when the law requires it, or to protect the rights, safety or property of Nuculair, our customers or others;
• as part of a merger, acquisition or sale of assets, with notice to you.

#Where information is stored

Our service providers may store or process information outside Canada, including in the United States. When that happens, the information may be accessible to authorities there under local law. We use contractual and technical safeguards to protect it.

#How long we keep it

We keep personal information only as long as we need it for the purposes above or as the law requires. Customers control how long their cases are kept and can delete them. Enquiries that don't lead to an account are deleted within 24 months.

#How we protect it

We use administrative, technical and physical safeguards suited to the sensitivity of the information, including access controls, encryption in transit and audit logging. Customers can choose a privacy tier for each case; in strict mode, lookups use hashes so identifying details don't leave the customer's environment. Enterprise customers can run Nuculair on their own infrastructure.

No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected people and the regulators as the law requires.

#Your rights

Depending on where you live, you can ask us to:

• tell you whether we hold personal information about you, and give you access to it;
• correct information that is inaccurate or incomplete;
• delete information, or stop or restrict how we use it;
• give you a copy of information you provided, in a portable format.

To make a request, email info@nuculair.com. We'll respond within 30 days, may need to confirm your identity first, and won't charge for a reasonable request.

#If you were the subject of an investigation

You can contact us directly. We'll tell you whether information about you is held in Nuculair, help you request correction or removal, and pass your request to the customer who ran the case where they are responsible for it.

#Complaints

If you're not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia. If you are in the EU or UK, you can contact your local data protection authority.

#Cookies and tracking

Our website doesn't use advertising or analytics cookies. The only thing it stores in your browser is your light or dark mode choice. Some images on our blog load from Unsplash, which receives your IP address when the image is requested.

#Children

Nuculair is a professional tool and isn't directed at children. We don't knowingly collect information from children through our website, and our Acceptable Use Policy prohibits investigating minors except in narrow, lawful safeguarding work.

#Changes to this policy

We'll post any changes here and update the date at the top. If a change is significant, we'll tell customers by email before it takes effect.

#Contact

Questions about this policy or your information: info@nuculair.com.