Privacy Policy

NETTULTECH CORPORATION ("we", "us", "our") operates Nettulz AI™ at nettulzai.ai. This Privacy Policy applies to all users of our website, mobile applications, and related services worldwide — including but not limited to users in the United States, Canada, the European Union, United Kingdom, Brazil, India, South Africa, Nigeria, Kenya, Australia, Japan, South Korea, and all other jurisdictions.

This policy describes how we collect, use, share, and protect personal data. By using our services you agree to the practices described here. If you do not agree, please do not use our services.

Account Data: Name, email address, registration date, and authentication tokens.

Profile Data: Country, education level, income range, goals, skills, interests, focus areas, and language preference — all provided voluntarily by you.

Conversation Data: Your messages to AI agents and the AI-generated responses. This data drives personalization and quality improvement.

Usage & Device Data: IP address, browser type, device identifiers, pages visited, session duration, and interaction patterns.

Payment Data: Processed exclusively by Stripe. We do not store card numbers or full payment details.

Cookie & Tracking Data: See our Cookie Policy for details.

We use your data to: deliver and personalize our AI guidance services; process payments; communicate with you (transactional emails, security alerts); detect and prevent fraud and abuse; comply with legal obligations; and improve our AI models using anonymized and aggregated data.

We never sell your personal data to third parties.

Depending on your jurisdiction, we rely on one or more of the following legal bases:

• Consent — for cookies and marketing communications (GDPR Art. 6(1)(a); PIPEDA; PDPA).
• Contract Performance — to provide the service you signed up for (GDPR Art. 6(1)(b)).
• Legitimate Interests — for security, fraud prevention, and service improvement (GDPR Art. 6(1)(f)).
• Legal Obligation — to comply with applicable law (GDPR Art. 6(1)(c)).
• Vital Interests — in rare emergency situations (GDPR Art. 6(1)(d)).

For California residents: we act as a "business" under the CCPA/CPRA. For Brazilian users: processing is conducted in accordance with the LGPD. For South African users: processing complies with POPIA. For Australian users: we comply with the Privacy Act 1988.

Our platform uses large language model (LLM) AI to generate guidance in response to your inputs. This constitutes automated processing. Outputs are not reviewed by a human before delivery and should be treated as informational suggestions only — see our AI Disclaimer.

We do not use fully automated decision-making that produces legal or similarly significant effects on users. If you have concerns about a specific AI output, you may contact us to request human review.

Conversation data may be used in anonymized, aggregated form to retrain and improve AI quality. Identifiable data is never used for model training without explicit consent.

We share data only as necessary with trusted service providers operating under strict data processing agreements:

• AI Model Providers — to process your prompts and generate responses.
• Stripe — for payment processing (Stripe Privacy Policy applies).
• Email Service Providers — to send transactional emails.
• Analytics Providers — for aggregated usage analytics (only if you have consented).
• IP Geolocation (ipapi.co) — for regional pricing detection only; no personal data stored.

We may disclose data to law enforcement or government authorities when required by law, court order, or to protect the safety of users.

Our servers and service providers may be located outside your country. When transferring personal data internationally, we ensure appropriate safeguards are in place:

• EU/EEA/UK users: Standard Contractual Clauses (SCCs) and UK IDTA where applicable.
• Swiss users: Swiss Federal Act on Data Protection (nFADP) compliant mechanisms.
• Brazilian users: LGPD Art. 33 compatible transfer mechanisms.
• All others: We apply equivalent levels of protection regardless of jurisdiction.

We retain your personal data for as long as your account is active or as required to provide our services, comply with legal obligations, resolve disputes, and enforce agreements.

Upon account deletion request: all personal data (profile, conversations, goals, action plans) is permanently deleted within 30 days, except where retention is required by law.

You can delete your account at any time from your profile settings or by emailing support@nettulzai.ai.

Depending on your location, you may have the following rights. To exercise any of them, contact support@nettulzai.ai. We respond within 30 days (or shorter if required by law).

• Access — Obtain a copy of your personal data (GDPR, CCPA, LGPD, POPIA, PDPA, PIPEDA).
• Correction / Rectification — Fix inaccurate or incomplete data (GDPR, LGPD, POPIA, PDPA).
• Deletion / Erasure — Request deletion of your data ("right to be forgotten") (GDPR, CCPA, LGPD).
• Portability — Receive your data in a machine-readable format (GDPR, LGPD).
• Restriction of Processing — Limit how we use your data in certain circumstances (GDPR).
• Objection — Object to processing based on legitimate interests (GDPR).
• Opt-Out of Sale / Sharing — California residents may opt out of the "sale" or "sharing" of personal information under CCPA/CPRA. We do not sell data.
• Non-Discrimination — You will not be discriminated against for exercising your rights (CCPA).
• Withdraw Consent — Withdraw previously given consent at any time (GDPR, LGPD, PDPA).
• Lodge a Complaint — File a complaint with your local supervisory authority (e.g. ICO in the UK, DPA in the EU, FTC in the US, ANPD in Brazil, NIMC in Nigeria).

Nettulz AI is not directed to children under 13 years of age (or 16 in the EU/EEA). We do not knowingly collect personal data from children. If we discover that we have inadvertently collected such data, we will delete it immediately. If you believe a child has provided us with personal data, please contact support@nettulzai.ai.

We implement appropriate technical and organizational security measures including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. However, no system is completely secure. You are responsible for keeping your account credentials confidential.

In the event of a data breach that affects your rights and freedoms, we will notify you and relevant authorities as required by applicable law (within 72 hours under GDPR).

We may update this Privacy Policy from time to time. We will notify you of material changes via email or prominent in-app notice at least 14 days before they take effect. Your continued use of the service after changes take effect constitutes acceptance of the revised policy.

Data Controller: NETTULTECH CORPORATION

Email: legal@nettulzai.ai | General support: support@nettulzai.ai

If you are in the EU/EEA and believe we have violated your rights, you may also contact your local Data Protection Authority (DPA). A list of EU DPAs is available at edpb.europa.eu.