यह दस्तावेज़ अंग्रेज़ी में प्रदर्शित है। अनुवाद जारी है।

Privacy · v1.0

Privacy Policy

Effective Date: April 21, 2026 · Version v1.0

Tokra, LLC (Delaware Limited Liability Company) · 131 Continental Dr, Suite 305, Newark, DE 19713, United States

This Privacy Policy is Section 9 of our full Terms of Service & Privacy Policy. It describes what data we collect, how we use it, your rights, and our security measures.

Quick summary: We do not sell your data. We do not share it with advertisers. We do not use your prompts, files, or memory to train AI models. Your content is processed only to deliver the Service to you.

Section 4Artificial Intelligence Disclosure & Limitations

This Section is critical. Read it carefully.

4.1 You Are Interacting With AI. Pursuant to Article 50 of the European Union Artificial Intelligence Act (Regulation 2024/1689), California SB 1001, and equivalent transparency laws worldwide, we expressly inform you that all responses, outputs, advice, recommendations, content, and interactions provided by Nourva are generated by artificial intelligence systems, not by human beings. You are not communicating with a human professional, advisor, friend, or counselor.

4.2 AI Imperfection. AI systems are inherently imperfect. They can and do produce outputs that are: (a) factually incorrect ("hallucinations"); (b) outdated, biased, or contextually inappropriate; (c) misleading, incomplete, or contradictory; (d) offensive or unintended in tone; (e) inconsistent across sessions; (f) reflective of biases present in training data. You acknowledge and accept these limitations as inherent characteristics of AI technology.

4.3 Not Professional Advice. Nourva, including any specialist agent, persona, or feature within it (such as but not limited to LegalAgent, FinanceAgent, HealthAgent, BusinessStrategist, CareerConsultant, or any future specialist), provides general informational content only. Outputs from Nourva do not constitute and shall not be construed as: (a) Legal advice. Nourva is not a licensed attorney, law firm, or legal services provider in any jurisdiction. (b) Medical advice. Nourva is not a licensed physician, healthcare provider, medical device, or substitute for professional medical evaluation. (c) Financial, investment, tax, accounting, or insurance advice. Nourva is not a registered investment adviser under the U.S. Investment Advisers Act of 1940, a broker-dealer, a certified financial planner, a tax preparer, or a licensed financial professional in any jurisdiction. Nourva is not authorized by the U.S. Securities and Exchange Commission, the Saudi Capital Market Authority (CMA), the U.K. Financial Conduct Authority (FCA), the European Securities and Markets Authority (ESMA), or any equivalent regulator. (d) Psychological or mental health counseling. Nourva is not a licensed therapist, psychologist, psychiatrist, or counselor. (e) Engineering, architectural, scientific, or specialized technical advice requiring professional certification. You agree that you will consult a duly licensed professional in the relevant jurisdiction before making any decision in any of the foregoing domains, and you assume full responsibility for any decisions you make.

4.4 No Privileged Communication. Conversations, files, documents, and data exchanged with Nourva are not protected by attorney-client privilege, doctor-patient confidentiality, accountant-client privilege, clergy-penitent privilege, or any other legal privilege recognized in any jurisdiction. Such communications may be subject to subpoena, court order, regulatory request, or governmental demand. Do not share information with Nourva that you wish to keep legally privileged.

4.5 Critical Decisions Prohibition. Nourva must not be used as the sole decision-maker for: medical diagnoses, treatment, or emergency response; legal contracts or court filings; financial transactions involving material assets; hiring, firing, or compensation decisions; insurance underwriting; credit decisions; child custody or family law matters; criminal defense; tax filings; immigration applications; or any decision with significant legal, health, financial, or safety consequences. Nourva may inform such decisions, but human professional judgment is required.

4.6 Verification Duty. You agree to independently verify all factual claims, citations, statistics, dates, names, calculations, and recommendations produced by Nourva before relying on them. You bear sole responsibility for the consequences of acting on unverified Output.

4.7 Emergency Situations. Nourva is not designed for emergency use. In any emergency involving risk to life, health, safety, or property, immediately contact your local emergency services (911 in the United States, 112 in the European Union, 999 in the United Kingdom, 999 in Saudi Arabia and the UAE, or the equivalent number in your country). Do not rely on Nourva for emergency assistance.

4.8 Web Automation Risks. Nourva includes browser automation capabilities ("Arachne"). When you authorize Nourva to perform actions on your behalf in a web browser: (a) You take full responsibility for any action taken, including form submissions, purchases, communications, account creations, data deletions, or modifications; (b) You authorize Nourva to interact with websites and services using your credentials and identity, subject to the policies of those websites; (c) You acknowledge that web automation carries inherent risks, including unintended actions, account suspensions by third-party platforms, captcha failures, terms-of-service violations of third parties, and unforeseen consequences; (d) You are responsible for monitoring automated tasks and intervening when necessary; (e) Tokra is not liable for any loss, damage, or third-party action resulting from web automation Outputs you authorized.

4.9 Generated Content Watermarking. Where required by law (including the EU AI Act Article 50(2) and California SB 942), content generated or substantially modified by Nourva may include machine-readable markers indicating its synthetic origin. You agree not to remove, obscure, or circumvent such markers.

4.10 No Reliance. You acknowledge that you have not relied on any representation about the accuracy, reliability, or fitness for purpose of Nourva, and that your use is at your own risk.

Section 8Automated Decision-Making (GDPR Article 22)

8.1 Where Nourva makes automated decisions that produce legal or similarly significant effects on you (such as eligibility, billing tier assignment, account suspension, or content moderation), you have the right under GDPR Article 22, UK GDPR, and equivalent laws to: (a) Receive meaningful information about the logic involved; (b) Request human review of the decision; (c) Express your point of view; (d) Contest the decision.

8.2 To exercise these rights, contact us at [email protected]. We will respond within thirty (30) days.

8.3 Standard Service operations (such as generating Outputs in response to your prompts) are not "automated decisions" within the meaning of Article 22, as they do not produce legal effects requiring human-equivalent judgment.

Section 9Privacy Policy

This Section 9 constitutes our Privacy Policy and forms an integral part of this Agreement. It complies with GDPR, UK GDPR, CCPA/CPRA, PDPL (Saudi Arabia), PIPEDA, LGPD, DPDP Act 2023 (India), and other Applicable Data Protection Laws.

9.1 Data Controller — Tokra, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA. Email: [email protected]. For EU/UK users, our designated representative will be appointed prior to material EU/UK operations and disclosed at https://nourva.ai/legal/eu-representative.

9.2 Personal Data We Collect — Identity (name, email, country), Authentication (hashed password, session tokens, device IDs), Payment (last-4 of card via Stripe), Content (prompts, files, outputs, memory), Usage (feature interactions, error logs), Technical (IP, OS, app version, hardware ID), Communications (support tickets, feedback).

9.3 Legal Bases (GDPR/UK GDPR) — (a) Contract: deliver the Service; (b) Legitimate interests: secure systems, prevent fraud, defend legal claims; (c) Consent: marketing & optional analytics — withdrawable; (d) Legal obligation: tax, accounting, lawful authority requests.

9.4 How We Use Your Data — Provide & maintain Nourva; process payments; authenticate; secure your account; communicate notices; provide support; detect fraud; comply with law; defend legal rights; with consent, send marketing. We do not sell your personal data. We do not share it with advertisers. We do not use it to train AI models.

9.5 Sub-Processors — Listed in Annex A and at https://nourva.ai/legal/sub-processors. Material changes notified 30 days in advance.

9.6 International Data Transfers — Standard Contractual Clauses (EU-approved), UK IDTA / UK Addendum, adequacy decisions where applicable, plus other lawful mechanisms. PDPL Article 29 cross-border transfer requirements respected for Saudi data.

9.7 Data Retention — Active account: while open. Closed account: 30 days then deleted (except where retention required). Conversation/prompt history: 30 days post-deletion request. Billing records: 7 years (tax law). Consent records: 5 years minimum (GDPR Art. 7). Security & audit logs: 2 years. Marketing data: until consent withdrawn. Legal-hold data: duration of dispute.

9.8 Your Privacy Rights — Subject to identity verification, you have the right to: access (GDPR Art. 15, CCPA §1798.100), rectify (Art. 16), delete (Art. 17, CCPA §1798.105), restrict processing (Art. 18), data portability (Art. 20), object (Art. 21), withdraw consent (Art. 7(3)), opt out of "sale/sharing" (CCPA — note: we do not sell or share), limit sensitive PI use (CPRA), non-discrimination for exercising rights, and lodge a complaint with your supervisory authority (national DPA / ICO / SDAIA / etc.). Email [email protected] or use Account → Privacy panel. Response within 30 days (extendable up to 2 months for complex requests, with notice).

9.9 Children's Privacy — Nourva is not directed at and does not knowingly collect data from anyone under eighteen (18). If you believe a minor has provided us data, contact [email protected] for immediate deletion.

9.10 Security Measures — TLS 1.3 in transit, AES-256-GCM at rest for sensitive data, on-device encryption for memory database, hashed passwords (bcrypt/argon2), MFA available, role-based access controls, regular security audits and penetration testing, formal incident response. No system is 100% secure — you participate by using strong passwords, enabling MFA, and reporting suspicious activity.

9.11 Data Breach Notification — Awareness of a breach with risk to your rights triggers: (a) notification to the relevant supervisory authority within 72 hours (GDPR Art. 33, PDPL Art. 21); (b) notification to affected users without undue delay where risk is high (Art. 34) via email and in-app notice; (c) public statement at https://nourva.ai/security where appropriate.

9.12 Cookies & Similar Technologies — The Nourva desktop application uses minimal local storage for session tokens and preferences only — no advertising cookies. Our website uses essential cookies and, with your consent, analytics cookies. Granular control is available via the cookie banner. Full Cookie Policy at https://nourva.ai/cookies.

9.13 California (CCPA/CPRA) — Categories collected: Identifiers, commercial info, internet activity, geolocation (city-level), professional info, inferences. Categories disclosed for business purposes: all above to sub-processors (Annex A). We do not sell or share. Sources: directly from you, automatic from device. Rights as listed in 9.8.

9.14 Saudi Arabia (PDPL) — PDPL Royal Decree M/19 rights apply. Cross-border transfers comply with Article 29. Complaints: SDAIA (sdaia.gov.sa). Nourva aligns AI governance with the SDAIA AI Adoption Framework (Nov 2025).

Contact

Privacy: [email protected] · DPO: [email protected] · General: [email protected]

© 2026 Nourva.