Privacy Policy
This policy explains what personal data Nurvel Networks ("Nurvel Networks", "we", "us") collects, why we collect it, how we use it, and the rights you have over it. We have written it in plain language deliberately — if anything here is unclear, contact us and we will explain it directly.
The short version: we collect the minimum we need to deliver our services, we never sell your data, we never resell your proxy usage logs, and you can request deletion at any time.
1. Who we are
Nurvel Networks provides proxy infrastructure, data intelligence, and software development services to business customers globally. For the purposes of the UK/EU GDPR, we act as a data controller for our own customer records, and as a data processor where we handle data on behalf of a client under contract.
Contact for privacy matters: salmanbinazeem321@gmail.com
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Identity & contact | Name, work email, phone, company | Account creation, support, billing |
| Billing | Billing address, payment reference, invoices | Processing payment, tax compliance |
| Technical | IP address, browser type, device, timestamps | Security, fraud prevention, service delivery |
| Usage | Bandwidth consumed, endpoints called, session counts | Billing accuracy, capacity planning, abuse detection |
| Communications | Support tickets, emails, chat transcripts | Resolving your requests, quality assurance |
| Marketing | Newsletter subscription status, preferences | Sending only what you asked for |
We do not collect special category data (health, biometrics, political opinions, religious beliefs) about our own customers, and we do not knowingly collect data from anyone under 18.
3. Lawful basis for processing
- Contract — processing necessary to provide the service you purchased, including account management and billing.
- Legitimate interests — security monitoring, abuse prevention, service improvement, and B2B marketing to business contacts. We conduct and document a balancing test for each such use.
- Legal obligation — retaining financial records for tax and accounting requirements.
- Consent — non-essential cookies and marketing communications. Consent can be withdrawn at any time without affecting service.
4. Proxy traffic and usage logs
This deserves its own section because it is the question customers ask most.
- We log connection metadata (timestamp, bytes transferred, target host, exit region) strictly for billing accuracy, abuse prevention, and network health.
- We do not inspect, store, or analyze the content of traffic routed through our proxies.
- We do not sell, share, license, or otherwise disclose usage data to advertisers, data brokers, or any third party for commercial purposes. This is a contractual commitment, not just a policy statement.
- Connection metadata is retained for 30 days, then automatically purged, except where a specific abuse investigation or legal hold requires longer retention.
5. Data we process on behalf of clients
When we deliver datasets or run data mining engagements, we act as a processor. In those cases we process data strictly on documented instructions from the client, we do not use it for our own purposes, and our obligations are governed by a Data Processing Agreement. We maintain a full provenance audit trail for every dataset we deliver, and we will produce it on request.
6. Sharing and sub-processors
We share personal data only with:
- Infrastructure providers hosting our platform, under contractual confidentiality and security obligations.
- Payment processors who handle card details directly — we never store full card numbers on our systems.
- Professional advisers such as auditors and legal counsel, where necessary and confidential.
- Authorities, where we are legally compelled. We assess every request for validity and notify the affected customer unless legally prohibited from doing so.
A current list of sub-processors is available on request. We give notice before adding a new sub-processor that handles customer personal data.
7. International transfers
We operate infrastructure across multiple regions. Where personal data is transferred outside the UK/EEA, we rely on adequacy decisions where available, and otherwise on Standard Contractual Clauses together with a transfer risk assessment. Regional data residency controls are available on request for customers who need processing confined to a specific jurisdiction.
8. Retention
| Data | Retention period |
|---|---|
| Account records | Duration of relationship, plus 12 months |
| Financial and invoice records | 7 years (statutory requirement) |
| Connection metadata | 30 days |
| Support correspondence | 24 months |
| Marketing preferences | Until you unsubscribe, plus suppression record |
9. Your rights
Depending on your jurisdiction you may have the right to: access your data; correct inaccuracies; request erasure; restrict or object to processing; receive your data in portable form; and withdraw consent. Under CCPA/CPRA, California residents additionally have the right to know, delete, correct, and to opt out of sale or sharing — we do not sell or share personal information as those terms are defined.
To exercise any right, email salmanbinazeem321@gmail.com. We respond within 30 days and do not charge a fee for reasonable requests. You may also lodge a complaint with your local supervisory authority.
10. Security
We are ISO 27001 certified and SOC 2 Type II audited. Controls include encryption in transit and at rest, role-based access control with least privilege, mandatory multi-factor authentication for staff, credential rotation across our gateway fleet, continuous monitoring, and documented incident response. No system is perfectly secure, but we will notify affected customers and regulators within 72 hours of confirming any breach involving personal data.
11. Cookies
Cookie usage is described in detail in our Cookies Policy. Non-essential cookies are only set after you consent, and you may change your preferences at any time.
12. Changes to this policy
We may update this policy to reflect changes in law or our practices. Material changes will be communicated by email to account holders at least 14 days before taking effect. The "last updated" date at the top always reflects the current version.