Who we are
NuErraa, Inc. is a Delaware corporation based in the United States. Our platform is offered only in the United States and is intended for use with candidates and employees located in the United States. You can learn more at https://www.nuerraa.com. You can reach us about this policy at hello@nuerraa.com.

The Scope of this Policy
Nu Erraa means the company, and “we”, “us” and “our” refer to it. Personal data in this policy means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated or deidentified information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual.

Information We Collect
This privacy policy applies primarily where Nu Erraa determines the purposes and means for the processing of personal data, as detailed below, and specifically regarding the following categories of personal data and data subjects.

User Data: personal data concerning our customers’ internal focal persons who directly engage with Nu Erraa concerning their organizational account, and users of the platform on behalf of such customers, e.g., the account administrators and users, billing contacts and authorized signatories on behalf of the customer (collectively, “users”); as well as the customer’s business needs and preferences, as identified to us or recognized through our engagement with them.

Prospect Data: personal data relating to visitors of our websites, participants at our events, and any other prospective customer, user or partner (collectively, “prospects”) who visits or otherwise interacts with our website, online ads and content, emails, sales and marketing channels, integrations or communications under our control (“sites”, and collectively with the platform and any related applications and services offered by us – the “Services”).

Customer Data: We also process personal data submitted by or for a customer to Nu Erraa’s products and or services (“Customer Data”). If not stated otherwise in this Privacy Policy, we process such Customer Data on such customers’ behalf. Each such customer (and/or its affiliates), as relevant, is the responsible controller or owner of the Customer Data concerned, whilst Nu Erraa acts as their data processor or service provider, in accordance with our customer’s reasonable instructions and as further stipulated in our Data Processing Addendum and other commercial agreements with such customer. We are not responsible for and have no control over the privacy and data security practices of our customers or third parties, which may differ from those set forth in this Privacy Policy. If you wish to learn more about the privacy and data security practices of those customers or third parties, please reach out to them directly.

Data Collection & Processing
The personal data Nu Erraa collects will be determined by your interaction with us, our partners, and other related sources. We collect personal data automatically when an individual interacts with our services, and we collect personal data directly from the individual. At times, we may collect personal data about an individual from other sources and third parties (such as our customers and service providers, or from publicly available sources), even before our first direct interaction.

If you are a candidate or an employee and you want to access, correct or delete your information, your request goes to the employer, not to us. We will help that employer respond, and if you contact us directly we will refer you to them.

Information From Services You Connect
Where an employer connects a third party service, we receive data from that service in order to provide the connected feature. The section titled “Google user data” below describes Google in detail, because Google user data carries specific obligations. Other connections an employer may choose to enable include job boards, payroll and HR systems, and electronic signature providers. If an employer connects its own background screening provider, that provider is the employer’s vendor and not ours; we do not obtain, assemble, or furnish consumer reports, and we are not a consumer reporting agency.

Website & Usage
We collect standard technical information when you visit our website or use the application, including IP address, browser and device type, pages viewed, referring pages, and timestamps. We use this to operate, secure and improve the service.

Google user data
This section applies when you connect a Google account to Nuerraa. It is the disclosure Google requires, and it governs over any more general statement elsewhere in this policy.

What we request and why
userinfo.email — Your primary Google email address — Identify your account and match you to your Nuerraa user
userinfo.profile — Your name and profile picture — Display your identity in the application
calendar.freebusy — Whether you are busy at a given time, without event details — Offer interview times that do not conflict with your calendar
calendar.events — View and edit events on your calendars — Create, update and cancel interview events, and add attendees and conferencing details

We request the narrowest scopes that allow these features to work. We do not request access to your Gmail messages, your Google Drive files or your contacts.

How We Manage Data
• We use Google user data only to provide the scheduling features described above and requested by you or your employer.
• We do not use Google user data for advertising.
• We do not sell Google user data, and we do not transfer it to third parties except as necessary to provide the service, comply with law, or as part of a merger or acquisition with notice to you.
• We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.
• Human access to Google user data is limited to what is necessary to resolve a support issue you have raised, to comply with applicable law, to address a security issue, or where you have given explicit consent.

Google API Limited Use
Nuerraa’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information
• To provide, maintain and secure the platform and its features.
• To authenticate users and control access.
• To schedule and manage interviews through connected calendars.
• To send transactional messages such as interview invitations, offer notifications and system alerts.
• To provide customer support.
• To bill customers and manage subscriptions.
• To detect, investigate and prevent fraud, abuse and security incidents.
• To comply with legal obligations and enforce our agreements.
• To analyse aggregated and de-identified usage in order to improve the product, and, where a customer has not opted out, to train and improve our models as described in the section titled “AI and automated processing” and in our Terms of Service.

AI and automated processing
The Service includes features that use artificial intelligence to generate summaries, suggestions, drafts, and other outputs. Personal information may reach those features in the following ways.

User inputs. When a user interacts with an AI feature, any personal information included in that interaction is processed to fulfil the request. [Chat history is retained for [PERIOD] and customers can configure their own retention settings.] Confirm the actual retention behaviour before publication.

Generated records. If a user directs an AI feature to create a record containing personal information, that record may be stored in the Service or written to a third-party system the customer has connected, at the user’s direction. Records stored in the Service are retained until the user deletes them or the account is closed.

Data retrieved from connected systems. An AI feature may retrieve personal information from a connected system where a user requests it as part of a workflow. The same storage and retention principles described above apply.

Human review of decisions. Our customers, not Nu Erraa, make employment decisions. Our Terms of Service require a customer to have a qualified person review any AI output before relying on it, and prohibit using an output as the sole basis for a decision to hire, not hire, promote, discipline, compensate, or terminate anyone.

Third-party AI providers. Where we use a third-party artificial intelligence provider to deliver these features, that provider is listed in our subprocessor list and is contractually prohibited from training its own models on Customer Data.

How we share information
We share personal information in four situations: with subprocessors who help us run the Service; with services a customer chooses to connect; when the law requires it; and in a corporate transaction. We require each subprocessor to protect personal information on terms no less protective than those in this policy and in our Data Processing Addendum.

We may disclose information where we believe in good faith that it is required by law, legal process or a government request, or where necessary to protect the rights, property or safety of Nuerraa, our customers or the public. If Nuerraa is involved in a merger, acquisition or sale of assets, personal information may transfer as part of that transaction, and we will give notice before it becomes subject to a different privacy policy.

We do not sell personal information, and we do not share it for cross context behavioural advertising.

Data retention
We keep personal information for as long as it is needed for the purposes described in this policy, and then delete or de-identify it. In practice: we retain Customer Data for the life of the customer’s account and delete it within sixty (60) days after the account closes, except for copies in routine backups, which are deleted on our standard backup cycle; we retain user account records for [PERIOD] after an account is closed; we retain prospect and website data for [PERIOD]; and we retain billing records for seven (7) years or as long as tax and accounting law requires. Where a specific period is not stated, we determine retention by reference to the purpose for which the information was collected, our legal and contractual obligations, and the need to resolve disputes.

Security
We maintain administrative, technical and physical safeguards designed to protect personal information. These include encryption of data in transit using TLS, encryption of data at rest, database level access controls that separate each customer’s data, role based access for our personnel, least privilege access to production systems, and logging of administrative activity.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information we will notify you and any affected customer as required by law.

International transfers
We are based in the United States and our service providers are primarily located in the United States. If you access Nu Erraa from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

Your privacy rights
Subject to applicable law, you have the right to access your personal data, to correct inaccurate data, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your supervisory authority.

California
Subject to the California Consumer Privacy Act as amended, you have the right to know what personal information we collect, use, disclose and retain, the right to delete personal information, the right to correct inaccurate personal information, the right to opt out of sale or sharing, and the right to limit use of sensitive personal information. We do not sell or share personal information as those terms are defined by that Act. We will not discriminate against you for exercising these rights.

Categories of information and sources. In the twelve months before the effective date of this policy, we collected the following categories of personal information: identifiers, including name, email address and IP address; professional and employment information; commercial information, including subscription and billing records; internet and network activity; and audio, electronic or visual information where a user supplies it. We collect this information from users and prospects directly, automatically through the Service and our website, from our customers, and from publicly available sources. We use it for the purposes described in the section titled “How we use information” and we disclose it to the categories of recipients described in the section titled “How we share information”. We do not use or disclose sensitive personal information for any purpose other than those permitted without a right to limit.

How to exercise your rights. You may submit a request by emailing hello@nuerraa.com. We will verify your identity by matching the information in your request against our records before responding. You may use an authorized agent, in which case we may require written authorization and verification of your identity.

If you are a candidate or employee of a company that uses Nu Erraa, your rights requests go to that company, which is the business responsible for your information. If you contact us, we will refer you to your employer and will assist your employer in responding.

Other States
Residents of other states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others, have similar rights. If we decline your request, you may appeal by replying to our response or by emailing hello@nuerraa.com with the word “Appeal” in the subject line. We will respond to an appeal within forty-five (45) days and will explain our reasons. If we deny your appeal, you may contact your state attorney general. To exercise any right under a state privacy law, contact us at hello@nuerraa.com.

Cookies & Tracking
We use cookies and similar technologies that are strictly necessary to operate including keeping you signed in and maintaining session security. We also use analytics to understand how the website and product are used.

You can control cookies through your browser settings. Disabling strictly necessary cookies will prevent the application from working.

Children’s privacy
Nu Erraa is a workplace product intended for use by adults. We do not knowingly collect personal information directly from anyone under 16 through our website or in creating a user account, and if we learn that we have, we will delete it. Where an employer lawfully employs or considers a person under 18 and submits that person’s information to the Service, we process it on the employer’s behalf under our agreement with the employer, and the employer is responsible for any notice or consent that law requires.

Changes to this policy
We may update this policy from time to time. When we make a material change we will update the effective date at the top and notify account administrators by email or through the application before the change takes effect. Continued use of Nuerraa after the effective date means you accept the updated policy.

How to contact us
Questions, requests, and complaints about this policy can be sent to hello@nuerraa.com. We will respond within the time applicable law requires.