Privacy Policy

Nubri GmbH, Liebenowzeile 22, 12167 Berlin, Germany (info@nubri.co) runs AI Business Co-Pilot (aicopilot.live) and is the controller for the personal data described here.

• Account: your email address and sign-in data, managed by Supabase Auth, which also sends the sign-up and password-reset emails.
• Your businesses: the names, descriptions, goals and other details you enter, and the plans, tasks, insights and advisor answers made from them.
• Payments: handled by Stripe. We keep only your Stripe customer and subscription identifiers and the subscription status, never card details.
• Usage: how many AI calls you used this month, and usage events (a random visitor id and which steps of the site you reached, with the campaign tags you arrived with). They tell us which pages work; they are not used for advertising.

To provide the service under our contract with you (Art. 6(1)(b) GDPR), including payments. For security, abuse prevention and understanding how the site is used, on our legitimate interest (Art. 6(1)(f) GDPR). To keep records the law requires, such as invoices (Art. 6(1)(c) GDPR).

These companies process data on our behalf, under data processing agreements:

• Supabase (sign-in, account emails and the database; USA).
• OpenAI (writes the plans, tasks, insights and answers from what you enter; USA). OpenAI does not use API data to train its models and keeps it for up to 30 days for abuse monitoring.
• Amazon Web Services (servers; region us-east-1, USA).
• Stripe (payments; USA and Ireland).

Transfers to the USA rely on the EU-U.S. Data Privacy Framework or the EU standard contractual clauses.

Your data stays while you have an account. You can delete businesses and tasks at any time. To delete your account and everything in it, email info@nubri.co from the account's address; we cancel any subscription and delete it within 30 days. Usage events are kept without any link to you. Stripe keeps payment records as the law requires.

When you open any page, our web server records your IP address, the time, the address requested, the response and your browser's user agent. We use these logs only to keep the service secure and to find faults (Art. 6(1)(f) GDPR). They are deleted automatically after at most 8 days.

Supabase sets the cookies that keep you signed in; they are strictly necessary. In your browser's local storage we keep the random visitor id and the campaign tags you first arrived with. No advertising or cross-site tracking.

You have the right to access, correct, delete, restrict and port your data, and to object to processing based on our legitimate interest. Write to info@nubri.co. You can also complain to a data protection authority; ours is the Berlin Commissioner for Data Protection and Freedom of Information.