Legal

Nuzori Privacy Policy

Document status: Draft v0.1
Draft date: 17 October 2026
Effective date: 17 October 2026

1. Who we are and what this policy covers

Nuzori Inc., trading as Nuzori, is responsible for the personal information described in this policy. Where applicable law uses those terms, we are the data controller or responsible party. Contact our privacy team at privacy@nuzori.app.

Nuzori helps eligible adults, including local residents and travellers, discover consensual, non-transactional social and casual connections. This policy covers our website, mobile web application, waitlist, verification, member features, payments, and communications.

This policy explains collection, use, disclosure, retention, and your choices. Additional notices appear where particular explanation or permission is needed. Our Terms of Use govern participation. Accepting them does not give consent to every use of personal information.

Payment services and external websites have their own privacy notices for activities they independently perform.

2. Our privacy approach and adult eligibility

Nuzori uses private profiles and aliases. Profiles are not a public directory and are not made available for public search indexing. We do not sell personal information or share it for cross-context behavioural advertising. We do not give advertising platforms member profiles, connection preferences, trip details, identity documents, messages, or safety reports.

An alias limits what members see; you are not anonymous to Nuzori. Other members may recognise your photographs or information you share.

You must be at least 18, or meet a higher minimum age that applies to you. Verification must be completed before access to member profiles, matching, or chat. Waitlist self-attestation is not identity or age verification.

If we reasonably suspect an underage account, we restrict access and investigate proportionately. We delete information collected from an ineligible child, subject only to legally permitted or required preservation for a specific safety or legal purpose. Report suspected underage use to hello@nuzori.app. Do not send suspected illegal imagery by ordinary email.

3. Information we collect and where it comes from

Information comes from you, service activity, payment providers, safety reporters, and legally authorised sources. Required and optional fields are identified when requested. Declining essential information may prevent the relevant function from operating.

We do not upload address books, synchronise contacts, or collect flight bookings, hotel bookings, room numbers, or precise itineraries. A manual invitation code does not require access to your contacts.

Minimise information about other people. A safety report may require relevant details; ordinary profile or chat use does not authorise disclosure of someone else's identity documents or private information.

4. Identity verification and the separate identity vault

Our verification process checks eligibility using identity documents, selfies or liveness captures, automated assistance, and authorised human review. Automated assistance can extract document text, assess document consistency, check liveness, and compare a submitted face with a document photograph. The notice shown before capture identifies the checks used and any biometric processing.

Nuzori manages verification decisions. We do not send verification submissions to an external identity-verification company to decide whether you pass. Infrastructure providers may nevertheless store or process information for us under instructions, as described in section 14. Self-managed verification does not mean that no service provider supports our systems.

Raw identity material is held in a separate, access-restricted identity vault. The member application receives only the eligibility result, required review status, and permitted age display. Raw document images, legal names, full dates of birth, and biometric templates are not supplied to discovery, matching, or ordinary member-profile storage. Authorised verification staff may inspect the underlying material to resolve a check or appeal. Access is limited and recorded.

We may request reverification after a material change, security concern, suspected impersonation, expiry, or legal requirement. We explain why and offer review. A badge records completed checks; it does not guarantee identity accuracy, intentions, conduct, or safety.

Appendix A contains the biometric notice. We request affirmative consent before biometric collection where consent is required. You may request a human or non-biometric route. We assess whether one is lawful and workable for the check; we cannot promise that every alternative is available in every location or that requesting one establishes eligibility.

5. Sensitive information and your choices

Sensitive information includes sexual orientation, preferences revealing sex life, biometrics, government identifiers, and private communications. A city, photograph, or association with this service may also create privacy risks without being legally defined as sensitive.

We ask for specific, affirmative permission for sensitive preference processing and biometric checks where required. These choices are separate from accepting our Terms and from marketing choices. The notice explains the information, purpose, and consequence of declining. We do not treat a preselected box, silence, or continued browsing as this permission.

You can remove optional preferences and withdraw relevant consent through your settings or by emailing privacy@nuzori.app. We stop the consent-based use and delete or restrict affected information as applicable. Withdrawal does not make earlier lawful processing unlawful. If the information is necessary to a particular function, withdrawing it may make that function unavailable. We explain any effect on verification or continued eligibility and consider an available alternative.

Do not include medical records or unnecessary health, religious, political, or third-party intimate details in profiles or messages. If you choose to include sensitive information, the protections in this policy still apply. Providing it does not give us unrestricted permission to reuse it. Where a feature requires additional consent for such processing, we obtain it before enabling the relevant use.

Exceptional safety, legal-claims, or legally required sensitive processing needs an applicable legal condition. A general business interest does not supply that permission.

6. Profiles discovery and what members can see

Verified members see fields you make visible: alias, permitted age display, photographs, selected city, biography, preferences, and verification status. Your email and verification records are not profile fields.

Mutual interest is required before messaging. Profile visibility does not give another person access to your private photographs or identity documents. Private-photo access follows the permissions described in section 8.

Changing visibility affects future access according to the feature's explanation. It does not erase information someone has already seen, remembered, or captured. Blocking restricts the interactions identified in the interface; it cannot prevent recognition outside Nuzori or another person's misuse of a separate account.

There are no public member-search pages or profile-sharing links. Access controls cannot prevent every unauthorised copy. Report scraping, exposure, or misuse to hello@nuzori.app.

7. Manual city selection and Trip Mode

Discovery uses a city you select manually. The current Service does not request device GPS coordinates. An IP address can indicate a broad location; we use that information separately for security, abuse prevention, and necessary service operation. It is not a public live-location feed.

Trip Mode lets you specify a destination city and dates for prospective discovery. Trip information is hidden until you choose to make the relevant information visible. Before publishing, the interface explains what eligible members will see. A selected city or planned date is your declaration, not confirmation that you are physically present or will travel.

When a trip expires, it stops creating new discovery exposure through that trip. Existing matches and conversations do not automatically disappear. Removing or hiding a trip likewise does not retract information previously shared with another member.

We do not need flights, hotels, rooms, or street addresses for Trip Mode. Avoid adding them to free text. Trip records are retained under section 16; leaving a trip in an internal record does not make it eligible for continued public or member discovery.

8. Messages and non-explicit private photographs

We process messages and permitted non-explicit media to transmit them, display them to authorised recipients, manage access, investigate reports, and protect the service. Messaging is encrypted in transit and at rest. It is not end-to-end encrypted in this version: our systems can process readable content, and authorised staff can access it when needed for the specific purposes described here.

Private-photograph sharing requires the relevant access permission. Revoking permission removes further authorised access through our servers. It cannot retract content already delivered to another device, screenshots, downloads obtained outside permitted controls, independently retained copies, or evidence already preserved for a justified safety or legal purpose.

We do not use private conversations to build advertising audiences or give marketing staff access to private messages. Safety review may involve content relevant to a report or a credible abuse signal. Access is restricted to staff handling the issue and recorded.

Sexually explicit media is prohibited. Report prohibited or potentially unlawful material through the safety route, following its evidence instructions. Do not repost it. Evidence is restricted and handled under applicable preservation and reporting requirements.

9. Why we use information and our legal grounds

Where a law requires a lawful basis, we use the basis appropriate to the particular activity. Ordinary information necessary to provide an agreed feature may be processed to perform our contract. Optional sensitive processing requires a separate condition and, where required, explicit consent.

When relying on legitimate interests, we assess necessity, reasonable expectations, sensitivity, and potential harm. We minimise the information and consider safeguards and alternatives. You can object as described in section 17. We do not use contractual wording to turn optional advertising, model training, or unrelated research into an essential service purpose.

10. Recommendations automated assistance and human review

Discovery uses chosen city, age and connection preferences, trip settings, mutual-interest signals, eligibility, blocking rules, and recent activity to respect visibility and suggest relevant profiles. Recommendations do not establish compatibility or consent.

We do not derive a hidden sexual-preference or health profile from the meaning of private messages. Product measurement may count events such as whether a conversation receives reciprocal messages without analysing the conversation's semantic content for growth purposes.

Automated systems assist with verification, suspected abuse, security, and content restrictions. They can make mistakes. A restriction may be applied promptly to prevent harm while review takes place. You can contest a verification outcome or meaningful account restriction and request human review through hello@nuzori.app or the relevant appeal route. We consider your explanation and correct inaccurate information where appropriate, subject to necessary protections for reporters and investigations.

We do not use member photographs, conversations, identity documents, or biometric templates to train or fine-tune general-purpose AI or biometric-recognition models, or authorise providers to do so. Running an internally hosted model to perform a disclosed check is different from using your material to train it. Model evaluation uses separately authorised test data and does not create a general permission to reuse member material.

11. Waitlist invitations and marketing

Before launch, the waitlist collects only the email, city, local/traveller interest, adult self-attestation, and communication choices identified in section 3. We ask separately whether you want launch notifications and promotional messages. Neither consent option is preselected. Joining a waitlist does not create a discoverable member profile.

Invitation codes can be entered manually. We may record the code for campaign administration, but we do not notify an inviter that you joined, passed verification, became active, matched, or paid. We do not award or display referral outcomes in a way that exposes your acceptance or membership. We do not access the inviter's or recipient's address book.

Marketing staff receive only information needed for permitted communications and aggregate reporting. They do not receive private profiles, sensitive intentions, trips, identity material, safety cases, or messages. We suppress small reporting groups where an individual could reasonably be identified.

Unsubscribe through a message link or privacy@nuzori.app. Necessary account, purchase, security, rights-request, and legal communications continue. Discreet wording cannot prevent your email provider, device, shared account, or notification settings from revealing communications.

12. Cookies browser storage and analytics

We use necessary cookies or browser storage for authentication, security, and functions you request. A preference or measurement technology is not treated as necessary merely because it is useful to us. Blocking necessary technologies can affect the relevant functions. Where non-essential technologies require permission, they remain disabled until you choose them, and you can change that choice at any time. The current inventory, including purposes, providers, and lifetimes, is available on request at privacy@nuzori.app.

Our private member journey does not contain advertising pixels, advertising SDKs, or session-replay tools. We do not send member-level events to targeted-advertising platforms. First-party measurement is limited to service operation, errors, feature use, and suitably aggregated outcomes. Event records exclude raw identity documents, message text, private photographs, and sensitive free-text content.

Aggregation must prevent reasonable identification and meet applicable standards. Replacing a name with an identifier does not create anonymity. We prohibit reidentification of information represented as deidentified.

Browser privacy signals do not reduce access to our basic privacy controls. Where applicable law requires recognition of an opt-out signal, including Global Privacy Control, we honour it for covered processing. Our no-sale and no-cross-context-advertising-sharing commitments apply regardless of whether a signal is sent.

The older Do Not Track browser setting does not change our collection of information needed to operate and secure the Service. We do not use it to enable tracking that this policy otherwise prohibits. Do Not Track and legally recognised opt-out preference signals are different mechanisms.

13. Purchases and payment information

Payment providers process payment credentials through their own interfaces. Nuzori receives transaction tokens or references, payment status, amount, currency, purchased service, renewal information where relevant, and refund or dispute records. We do not receive or store full payment-card numbers or security codes through those interfaces.

We use purchase information to provide paid access, administer billing, prevent payment abuse, answer requests, and meet applicable financial-record obligations. A payment provider may independently require identity or fraud checks and has its own notice. That is separate from Nuzori's member-verification process.

Cancelling renewal by itself does not delete an account. When you delete your account, or we permanently close it, we cancel future renewals under Nuzori's billing control. If a separately managed payment arrangement needs another provider action, we explain the required route and assist with it. The Terms and checkout explain cancellation and refund rights. Financial records retained after deletion are not used to keep a discoverable profile active.

14. Who receives information

Other members receive only information made available through permitted discovery, matching, messaging, or private-photo access. They do not receive the identity vault or private contact details through those functions.

Service providers may provide hosting, storage, communications, security, technical support, and payment processing. We limit access to what each service needs and use appropriate contractual restrictions, confidentiality obligations, security requirements, and deletion instructions. Providers acting on our behalf may not use the information for their own advertising or general AI training. You can request a current list of providers, their functions, and relevant locations at privacy@nuzori.app.

Authorised personnel and advisers receive information necessary for their duties. Identity review, safety handling, customer support, and marketing have different access needs. Advisers such as lawyers or accountants receive only the information necessary for the matter and appropriate confidentiality protections.

Legal and safety recipients may receive information when a valid legal obligation requires disclosure, or when a specific lawful basis permits a necessary and proportionate response to a serious safety issue, fraud, or legal claim. We assess the request, legal authority, scope, and applicable protections, particularly for identity, biometric, and intimate information. An allegation by another person does not automatically entitle them to your identity. We notify you where appropriate and lawful; notice may be restricted by law or a concrete risk to people or an investigation.

A business successor may receive necessary information during a proposed or completed merger, acquisition, restructuring, or transfer of Nuzori, subject to confidentiality and purpose restrictions. Sensitive member data is not made freely available to prospective buyers. A transaction does not remove your rights or permit incompatible uses without the steps applicable law requires.

We also disclose information at your specific direction after explaining the recipient and purpose. We do not disclose private membership information to an employer, family member, partner, or inviter merely because they ask for it.

15. Security and incident response

Safeguards include encryption in transit and at rest, a separate restricted identity vault, access logs, role-based permissions, and account-security controls. Authorised personnel have confidentiality obligations.

No internet service can guarantee that every misuse, device compromise, or unauthorised disclosure will be prevented. Privacy settings cannot control a recipient's conduct outside the service. Protect access to your email and device, and report suspected compromise promptly at hello@nuzori.app.

We investigate and contain suspected incidents, remedy them, and notify affected people and authorities within required times. Required notices explain the incident, protective steps, and contact details. Security disclaimers do not remove our legal responsibilities.

16. Retention deletion and legal preservation

We keep information only while it serves a necessary stated purpose and for any additional period that applicable law permits or requires for a specifically justified purpose. A maximum below is a ceiling, not a reason to keep information after its purpose ends. Shorter legal destruction requirements take priority. Retention runs from the trigger stated for that category.

Account deletion removes you from discovery while deletion is completed. Merely uninstalling a home-screen shortcut or stopping use does not request deletion. Deleting a profile or conversation does not necessarily erase a recipient's independently held copy or evidence already included in a lawful safety case.

A legal hold is limited to relevant information, recorded reasons, authorised access, and review. It is not permission for an indefinite fraud archive. It does not override a biometric destruction requirement or a law restricting post-termination retention. Where termination requires destruction and permits only mandatory legal retention, we apply that narrower rule instead of a general safety-retention period.

For example, where the US provider reporting duty in 18 USC section 2258A applies, apparent child-exploitation reports and the specifically required associated records are preserved securely for one year after the report, subject to any further specifically lawful requirement. This does not create a one-year retention rule for every member's messages or verification information.

Deleted backup data is not used for ordinary service activities. If a backup must be restored, deletion instructions are reapplied. Consent and rights-request evidence is retained only as needed to demonstrate the relevant choice or response under applicable requirements; it does not justify retaining the underlying identity captures or sensitive content.

17. Your privacy controls requests and appeals

All members can edit profiles, manage visibility, remove optional preferences, withdraw relevant consent, block interactions, and request deletion. These basic controls are available independently of a particular statute's coverage.

Depending on applicable law, you may also request access and a copy of your information, correction, deletion, a portable export, restriction, objection to particular processing, information about disclosures, or review of a decision with a significant effect. You may have rights concerning sensitive information, targeted advertising, sale or sharing, and authorised agents. We do not penalise you for exercising a protected privacy right.

Submit a request to privacy@nuzori.app. We use proportionate checks to confirm identity and authority without unnecessarily collecting more sensitive information. Do not email an unredacted ID or selfie to make a routine request. If additional verification is necessary, we explain why and provide an appropriate secure route. An authorised agent may need to show valid authority and satisfy applicable verification requirements.

We aim to respond within 30 days; shorter mandatory deadlines take priority. We explain any lawful extension before the relevant deadline. Requests are ordinarily free; we explain any legally permitted fee or refusal.

Access or export does not entitle someone to another person's private information, confidential reporter details, security secrets, or information lawfully withheld. If we cannot fully comply, we explain the applicable reason to the extent permitted and identify available review or complaint options.

To appeal a denied request or significant automated outcome, contact privacy@nuzori.app with “Privacy appeal” and the request reference. We arrange appropriate review and explain the outcome within the applicable period. You may also contact the relevant regulator without giving up other remedies.

18. International processing and transfers

Information may be processed outside your country. Providers and authorised personnel may access it from other locations, which we identify on request at privacy@nuzori.app. Processing abroad can be a transfer even if the original storage location does not change. Foreign laws and lawful government-access powers may differ from those in your country.

Before a restricted transfer, we use a legally available mechanism and appropriate safeguards. Depending on the applicable law, this may involve an adequacy determination, approved contractual protections, transfer-risk assessment, recipient security and confidentiality commitments, and restrictions on onward transfers. We do not claim that accepting this policy alone authorises every international transfer.

For sensitive personal data subject to Kenya's transfer requirements, we obtain explicit consent and confirmation of appropriate safeguards before the covered transfer. We explain the data, destination, purpose, and consequence of declining or withdrawing that consent. If a lawful alternative cannot support a required feature, we explain the limitation rather than proceed without the required protection.

For transfers governed by Nigeria's requirements, we identify the applicable protection and obtain any required separate consent, including where the operative rules require it for a destination without an NDPC adequacy decision. Any consent notice explains relevant transfer risks. We do not assume that a hosting country has been approved merely because it has its own privacy legislation.

Where EU or UK transfer rules apply, we use a valid mechanism under those rules and any required supplementary measures. You may request information about the safeguards through privacy@nuzori.app, subject to necessary redaction of confidential or security-sensitive material.

19. Regional information and California notice at collection

Applicable mandatory protections take priority over conflicting wording. Laws and feature availability vary by location. Our privacy contact receives requests for the relevant controller, responsible party, or privacy officer.

Nigeria. Applicable rights under the Nigeria Data Protection Act include the requests described in section 17, subject to statutory conditions. Complaints may be made to the Nigeria Data Protection Commission.

Kenya. Use our request channel for rights under the applicable Data Protection Act. Complaints may be made to the Office of the Data Protection Commissioner. Section 18 addresses sensitive-data transfers.

South Africa. For applicable POPIA rights, contact our Information Officer at privacy@nuzori.app. Complaints may be submitted to the Information Regulator. Applicable access-to-records procedures remain available.

United States. State privacy rights vary with the law, its coverage, and the processing involved. Where applicable, they include access, correction, deletion, portability, appeal, and opting out of sale, targeted advertising, or specified profiling. We do not sell personal information or share it for cross-context behavioural advertising. Additional biometric protections are addressed in Appendix A. If consumer-health law covers particular information or inferences, a required separate notice applies before that processing; this policy does not authorise undisclosed health profiling.

California notice at collection. The table identifies categories contemplated for this service, their purposes, and recipients. Sources are described in section 3. Retention criteria and maximum periods are in section 16. We collect no precise GPS location for discovery and do not sell or share these categories for cross-context behavioural advertising.

Where the CCPA applies to Nuzori and your information, you may have the rights described in section 17 and additional rights to know collection or disclosure details, limit certain sensitive-information uses, and opt out of covered sale or sharing. We do not use sensitive information for undisclosed secondary purposes. See the California Attorney General's CCPA information for statutory guidance. Requests use privacy@nuzori.app.

Canada, where applicable. Canadian privacy rights and our accountability for instructed providers remain applicable to covered processing. Contact privacy@nuzori.app or the competent federal or provincial privacy regulator.

EU/EEA or United Kingdom, where applicable. Relevant rights include those in section 17 and complaints to the competent supervisory authority. This provision does not announce a territorial launch.

20. Changes and how to contact us

Material prior versions of this policy are available on request at privacy@nuzori.app. We give appropriate advance notice of material changes and explain your choices. We obtain any required consent before new processing; continued use does not supply missing sensitive-data consent.

For privacy questions and rights requests, use privacy@nuzori.app. For account help, use hello@nuzori.app. For safety concerns, use hello@nuzori.app. These service channels are not emergency-response services.

Appendix A. Biometric Information Notice

Operator: Nuzori Inc.
Contact: privacy@nuzori.app

This notice explains biometric processing used for a Nuzori verification check. We show the relevant notice before capture and obtain specific affirmative consent where required. Accepting general Terms, uploading an ordinary profile photograph, or joining a waitlist does not automatically authorise biometric processing.

Information involved. Depending on the disclosed check, we capture a selfie, short video, or liveness information and derive measurements of facial characteristics or a comparison template. Such measurements may be biometric identifiers or biometric information under applicable law. A photograph, document image, or extracted text is a different record with its own protections and deletion rule, even when the photograph is the source of a biometric template.

Purpose. We use this information only to perform the explained liveness and face-comparison check, assess authenticity, and resolve a directly related review. A comparison can test whether the person making the submission appears to match the document photograph. It does not prove good intentions or predict behaviour. We do not infer ethnicity, health, emotional state, sexual orientation, or attractiveness from verification biometrics, or use them for advertising or general AI training.

Control and custody. Nuzori operates the verification decision process using internally hosted tools and restricted human review. We do not send submissions to an external identity-verification decision provider. Instructed infrastructure providers can process information to run or store the check under appropriate restrictions. We identify their functions and processing locations on request. Other members, marketers, and ordinary discovery features do not receive the raw captures or templates.

Consent and alternatives. Before the check, we identify the biometric processing, purpose, retention limit, and any relevant transfer. You can decline, stop an incomplete check, or withdraw consent by emailing privacy@nuzori.app. You may request a human or non-biometric review. We explain whether a lawful and workable alternative can establish eligibility; an alternative or a successful result is not guaranteed. Declining may prevent use of features that require a completed eligible verification, but it does not authorise collection anyway.

Retention and destruction. Derived measurements and templates are destroyed when their disclosed purpose is complete or applicable withdrawal/destruction rules require it, and no later than 24 hours after capture. Raw captures are deleted after the decision and necessary review, within 30 days after final decision. Unsuccessful, pending, or abandoned raw submissions are deleted within 30 days from collection; appeals do not restart this period. Shorter biometric limits take priority: templates do not become an unsuccessful-case archive. Raw captures and templates are excluded from routine backups. A legal hold cannot override mandatory biometric destruction. A minimal eligibility receipt may survive while needed without raw biometric material.

Protection and disclosure. We restrict and record access, use encryption in transit and at rest, and separate verification material from ordinary member data. We do not sell, lease, trade, or otherwise profit from biometric information. Disclosure is limited to an authorised service purpose, your specific valid direction, or a legally permitted or required circumstance with the applicable protections. You can request information, correction of inaccurate verification records, withdrawal, deletion, or review through the contact above. Applicable regional biometric rights remain available.