This policy explains what data NUppel may process, why it is used, which providers may receive limited access, and what choices may be available to you.
Account, project, content, analytics, lead, appointment, and support-related data may be processed.
We use data for accounts, publishing, AI features, security, billing, support, and product improvement.
Limited sharing may involve Supabase, Stripe, Vercel, OpenAI, Google AI, Google OAuth, Pexels, and domain services.
You may have rights to access, correct, delete, object to, port, or manage certain communications.
Quick overview
scope
This privacy policy is a general explanation of how NUppel handles personal data across its website and product surfaces.
It applies to nuppel.com, account creation and sign-in flows, the AI website builder, editor, studio, blog tools, appointments, leads, analytics, hosting, and custom domain features.
Some features or integrations may also have supplemental checkout notices, disclosures, or contract terms that work alongside this policy.
who-it-applies-to
NUppel works with more than one kind of user, and this policy is written to reflect that.
roles
In some contexts NUppel acts directly for its own platform operations, while in others it provides infrastructure for customer websites.
For account, subscription, security, analytics, and support operations, NUppel may act as a controller, operator, or similar decision-maker.
When customers collect form, lead, booking, or appointment information through websites built on NUppel, NUppel may in some situations act more like a service provider or processor-like infrastructure layer.
Important
Site owners may also need to provide their own privacy notice and legal disclosures to their visitors.
data-we-collect
The categories of data we process depend on the features used and the type of interaction involved.
sources
Data can come from multiple sources and is not collected in exactly the same way in every scenario.
purposes
We use personal data as reasonably needed to operate, secure, support, and improve the service.
ai-processing
When you use AI features, prompts and related project context may be processed by model providers.
NUppel may send prompts and selected context to AI providers in order to generate website copy, blog drafts, creative suggestions, or similar outputs.
We recommend that you avoid placing unnecessary sensitive or special-category data into AI prompts.
Help assistant (Nu): what you write to the assistant is sent to OpenAI to produce the answer; if OpenAI is unavailable it may go to Anthropic or Google as a backup. ID, IBAN, card and passport numbers are hidden before sending. NUppel does not keep the conversation text; only technical records such as time, model, token count and cost are kept.
OpenAI is asked not to store request content as application data. OpenAI may keep logs for up to 30 days for abuse monitoring, and the cache of repeated fixed text may last up to 24 hours.
Our AI providers (OpenAI, Anthropic, Google) are in the United States, so what you write to AI features is transferred outside your country.
AI notice
Processing with OpenAI, Google AI, or similar providers may vary based on the active infrastructure and the rules of those services.
cookies-and-analytics
We may rely on storage, session, and analytics technologies to keep the product working and measure performance.
sharing
Rather than framing this as data sale, we rely on a limited set of service providers and integrations to deliver the service.
Domain / third party
Some sharing happens because you initiate domain, payment, or integration steps that need third-party completion.
international-processing
Because NUppel depends on global SaaS infrastructure, data may be processed outside your country.
Depending on the hosting, deployment, and AI providers we use, personal data may be stored or processed on servers located in other regions.
We do not assume that every country provides the same legal framework and may rely on technical, administrative, or contractual safeguards where appropriate.
International processing
Cross-border processing patterns may change as providers or deployment regions evolve.
retention
We do not apply one fixed schedule to all data; retention depends on business need, legal obligations, and technical reality.
security
We do not promise absolute security, but we aim to use reasonable technical and organizational safeguards.
These may include access controls, encryption in transit, provider-level security measures, and role-based restrictions.
Payment card details are handled by Stripe or comparable payment providers rather than being stored in full by NUppel.
rights
Depending on applicable law, you may have certain rights over personal data related to you.
Not every right applies in every jurisdiction or every scenario; identity verification, security review, and legal exceptions may affect the response.
children
The service is not designed for children and we do not aim to knowingly collect personal data from them.
Depending on applicable law, the service may not be intended for users under 13 or under 16.
If we learn that data from a child has been collected inappropriately, we may review and take reasonable steps to restrict or remove it.
customer-sites
Sites built on NUppel may create separate obligations for the site owner toward their own visitors.
If a customer enables forms, bookings, appointments, or lead capture on a NUppel-built site, that customer should assess what notices and legal text must be shown to their own visitors.
NUppel may provide the infrastructure for those flows, but that does not automatically make NUppel solely responsible for every statement or legal notice on the customer site.
Customer site responsibility
If your site collects forms, leads, or booking data, you may also need your own privacy notice and related legal disclosures.
support
When you write to us through the support chat, the contact form or e-mail, we keep the conversation to help you.
changes
We may update this policy over time, and the latest version may become effective when published.
contact
You can contact us in writing with privacy questions, data requests, or concerns about this policy.
Use the contact details below for access, correction, deletion, or general privacy requests.
Data controller: Birds Agent Co (United States).
Company legal name, postal address, or jurisdiction-specific details may be added once the final business structure is confirmed.
Privacy contact
Reach out here for privacy questions, data requests, or concerns about how NUppel processes personal data.
social-connections
16. Instagram and TikTok connections
If you connect an Instagram professional account or a TikTok account in Studio, NUppel publishes the posts you choose on your behalf.