Privacy Policy

Effective 19 October 2026

This policy explains how Nuvora Digital Hub Marketing Solutions LLC (Commercial Register No. 11608, 107 Al Tahrir Street, First District, Ismailia, Egypt; "Nuvora", "we") handles personal data on this website and in our products, the Nuvora AI Agent and Nuvora Agency OS. We follow Egypt's Personal Data Protection Law (Law No. 151 of 2020) and, where it applies to our customers or their students, the EU General Data Protection Regulation (GDPR).

1. Our two roles

For our own customers and website visitors, we decide how their data is used. We are the controller.
For the students and leads that agencies manage in our products, the agency decides how that data is used. The agency is the controller, and we process the data on its behalf and on its instructions, under our Data Processing Addendum. A student who wants to access, correct or delete their data should contact their agency first; we will help the agency respond.

2. What we collect on this website

This website uses the Meta pixel to measure our ads, and its fonts are served from our own server. When you visit it:

Our hosting provider records standard server logs (IP address, browser type, pages requested and time) to keep the site running and secure.
If you use our contact form or email us, we keep what you send (such as your name, email, agency, country, phone number and message) to reply and to keep a record of our conversation. Contact form messages are delivered to our inbox by Web3Forms, a form-delivery service.
The Meta pixel, provided by Meta Platforms, records the pages you visit and sets a cookie, so we can measure our ads and show them to people interested in Nuvora. Meta uses this data under its own privacy policy. You can block it by blocking third-party cookies in your browser, and choose which ads you see in your Facebook and Instagram ad preferences.

3. What we collect from our customers

When an agency subscribes, we keep the contact details of its account holders and team members, the agency's business details, and records of its subscription. Online payments are handled by our reseller Paddle.com, which is the Merchant of Record for those orders and collects your payment details. We never see or store your full card number; Paddle shares with us the information we need to manage your subscription, such as your name, email, country and the status of your payments. Paddle's own privacy notice applies to the data it collects. If you pay us by bank transfer, we keep the payment details shown on the transfer and our invoice.

We may also contact people who work at study-abroad agencies, using business contact details that are publicly available or that they gave us, to tell them about our products. Every such message says who we are and lets the recipient ask us not to contact them again, and we respect that request.

4. Why we use data, and on what legal basis

To provide the products to our customers and manage their subscriptions, support and billing: because it is necessary for our contract with them.
To keep the website and products secure, prevent abuse and fix problems (for example, server logs): our legitimate interest in running a safe service.
To answer messages and to tell agencies about our products: our legitimate interest in running and growing our business, and consent where the law requires it.
To keep billing and tax records: to meet our legal obligations.
Data agencies store in our products: on the agency's instructions, as its processor. The agency decides the legal basis for its own use of that data.

5. Data agencies store in our products

Depending on how an agency uses the products, this can include students' and leads' names and contact details, the source of an enquiry, study preferences and academic background, language test results, conversations with the agency (including WhatsApp messages, when the agency connects WhatsApp), conversations with the AI Agent, program shortlists and choices, signed agreements, payment records, university commissions and uploaded documents. We use this data only to provide the products to that agency, to keep them secure and to support the agency when it asks us to.

We do not sell personal data or share one agency's data with another, and we never use the data agencies keep in our products for advertising. We do not use an agency's data to train AI models for anyone else.

Program suggestions in Agency OS are advice for the agency's counselors: they show what matches, what is unknown and what has been checked, and the counselor and student decide. No decision with legal or similarly significant effects on a student is made automatically.

Facebook and Instagram lead forms (Meta Lead Ads)

If an agency connects its Facebook Pages to Nuvora Agency OS, the answers people give in that agency's Facebook and Instagram lead forms are stored in the agency's Nuvora Agency OS account, which the agency controls. We also store the names of the form, campaign, ad set and ad a lead came from, so the agency can see which campaign works. These leads are kept like the agency's other records: until the agency erases them, or until its account is deleted after its subscription ends. We store the access Meta gives the agency, encrypted, only to read those leads, and delete it when the agency disconnects. You can ask Meta to delete the data the Nuvora Agency OS app holds about your Facebook account at any time (Settings and privacy > Apps and websites); to have a lead you submitted deleted, ask the agency you submitted it to.

If an agency connects its own WhatsApp Business number, the messages exchanged on that number are stored in the agency's account, and Meta processes them as the provider of the WhatsApp Business Platform. If you reply STOP, the agency's automated and template messages to you stop. When an agency erases a person's record, the text of their messages, their number and their name are removed.

6. Service providers

We rely on a small number of providers to run our products, each bound to protect the data and to use it only to provide their service to us:

Hostinger (Hostinger International Ltd.), which hosts our application server and database in its Frankfurt, Germany data centre, and this website. Hostinger also keeps its own weekly server backups, stored in Lithuania;
Cloudflare R2 (Cloudflare, Inc.), which stores uploaded files and our nightly database backups in its European Union jurisdiction. Uploaded files are scanned for malware on our own server before they are accepted;
Resend (Resend, Inc.), which delivers our product emails, such as invitations, invoices and notifications, from servers in Ireland;
Lark (Lark Technologies), which provides our company email at nuvorahub.com, including support@nuvorahub.com;
Meta Platforms, when an agency connects its Facebook Pages or its WhatsApp Business number (see above), and for the Meta pixel on this website;
Web3Forms, which delivers messages sent through the contact form on this website to our inbox;
Paddle.com, our reseller and Merchant of Record, for online subscription payments and billing;
AI model providers, which will process conversation content to generate the AI Agent's responses and will not keep it to train their models. The AI Agent is not yet available; we will name these providers here before it launches.

Some of these providers (including Lark, Meta, Paddle and Web3Forms) may process data outside Egypt and the European Economic Area. Where they do, we rely on the safeguards required by the applicable law, such as standard contractual clauses. We will update this list when our providers change, and tell agencies in advance as described in our Data Processing Addendum.

7. How we protect data

Each agency's data is isolated from every other agency's, enforced in the database itself.
Data is encrypted in transit, access tokens for connected platforms are stored encrypted, and access inside each agency follows the roles and permissions the agency sets.
Our staff do not access an agency's data without its permission, except where the law requires it.
Files uploaded to Agency OS are scanned for malware and are only reachable through short-lived, private links.

If a security incident affects personal data, we act at once to contain it. We tell affected agencies without undue delay, and in any case within 72 hours of becoming aware of it, and notify the authorities and the people affected where the law requires.

8. Cookies

This website sets one advertising cookie: the Meta pixel’s cookie (_fbp), which lasts up to 90 days and is used to measure our ads and build advertising audiences. You can delete it or block it in your browser settings at any time. The checkout page loads Paddle, which may set cookies it needs to process your payment, under its own privacy notice. Our products (app.nuvorahub.com) use only cookies that are strictly necessary to keep you signed in and to protect your session; they are not used for advertising or tracking.

9. How long we keep data

Agency data is kept while the subscription is active. When it ends, the workspace becomes read-only for 90 days for export, and is then deleted. Deleted data leaves our backups as those backups expire, within 30 days.
Our nightly database backups are kept for 30 days and then deleted automatically. Hostinger's own server backups are kept for at most 30 days.
An agency can erase a specific student's data at any time; we act on such requests as the agency's processor.
Payment and billing records (dates, methods and amounts) are kept for 5 years, or longer where tax and accounting law requires.
Emails you send us are kept for as long as needed to handle your request and our ongoing relationship.

10. Your rights

Depending on the law that applies to you, you may have the right to access your personal data, to correct it, to have it deleted, to object to or restrict how it is used, to receive a copy in a portable format, and to withdraw consent. To use these rights for data we control, email support@nuvorahub.com. If your data was entered by a study-abroad agency, contact that agency. You may also complain to the data protection authority where you live; in Egypt, this is the Personal Data Protection Center.

How to ask for your data to be deleted

If an agency contacted you through Nuvora Agency OS, for example after you filled in a Facebook or Instagram lead form or messaged it on WhatsApp, ask that agency to delete your data; it can erase your record in the product at any time, and we carry out the erasure on its behalf. If you cannot reach the agency, or for data we control, email support@nuvorahub.com with the subject "Data deletion request" and the email address or phone number the data is linked to. We confirm the request and complete it within 30 days, except for records the law requires us to keep.

11. Students under 18

Our products are used by agencies, not sold to students. Some students an agency works with may be under 18; the agency is responsible for obtaining any consent required from a parent or guardian. Their data receives the same protections as every other student's, and we never use it for any purpose other than providing the products to the agency.

12. Changes to this policy

We will post any update on this page with a new effective date, and tell our customers by email about material changes.

13. Contact

Questions about privacy or data protection: support@nuvorahub.com, or by post to Nuvora Digital Hub Marketing Solutions LLC, 107 Al Tahrir Street, First District, Ismailia, Egypt.