Dated:
This Notice at Collection is provided to California residents pursuant to the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). This notice is provided at or before the point of collection and supplements our Privacy Policy and California Residents disclosures.
The table below describes the categories of Personal Information we collect, the purposes for collection, retention periods, and whether such information may be sold or shared.
| Category | Purposes for Collection | Retention Period | Sold or Shared |
|---|---|---|---|
| Identifiers (name, email, IP address, account name) | Account creation, authentication, customer support, fraud prevention, communications, website analytics | Account duration + 30 days; backups up to 90 days | Not sold or shared for cross-context behavioral advertising; disclosed to service providers |
| California Customer Records (name, address, phone, financial info) | Order fulfillment, billing, customer support | Account duration + 30 days; financial records 7 years | Not sold; disclosed to payment processors |
| Protected Classifications (gender, age, date of birth) | Service personalization, legal compliance | Account duration + 30 days | Not sold or shared |
| Commercial Information (transactions, purchase history) | Order processing, analytics, service improvement | 7 years from transaction | Not sold or shared |
| Internet or Network Activity (browsing, interactions) | Service operation, security, fraud prevention, website analytics | 13 months | Not sold or shared for cross-context behavioral advertising; disclosed to analytics service providers |
| Geolocation Data (IP-derived location) | Service delivery, localized content, aggregate website analytics, fraud and abuse prevention, service security, and human review | 13 months for analytics; account duration plus 30 days for account safety; backups up to 90 days | Not sold or shared for cross-context behavioral advertising; disclosed to analytics and account-safety service providers |
| Inferences (account-safety classifications, summaries, human reviewer labels, and bounded reviewer notes derived from account, authentication, general location, network, relationship, and commercial context) | Fraud and abuse prevention, service security, and human review | Account duration plus 30 days; backups up to 90 days | Not sold or shared for cross-context behavioral advertising; disclosed to account-safety service providers |
| Sensitive Personal Information (account credentials, payment info) | Authentication, payment processing | Account duration + 30 days; payment data stored by Stripe | Not sold or shared |
| Biometric and Identity Verification Data (depending on verification method: facial images, identity document images, ID numbers, phone numbers) | Identity verification via Stripe | Verification session references, status, and outcome retained locally for account duration; identity documents and facial images hosted by Stripe and redacted upon account deletion or data erasure request | Not sold or shared; disclosed to Stripe for verification |
For product analytics, Mixpanel acts as our service provider. The active analytics events cover page use, account and session creation, Presence claims, the 14-day Thrive trial, and conversion to paid Thrive. They may include a random browser or Nusu user identifier, route pathname without its query string, country and region, and limited Presence, entity, claim, trial, or subscription context. Nusu disables page analytics on authentication, sign-in, onboarding, invite, and unsubscribe routes and disables Mixpanel's automatic URL, referrer, marketing-query, and IP-derived geolocation collection, although Mixpanel can observe source network metadata when it receives a direct browser request. For California visitors, analytics begins only after "Allow analytics" is selected. Selecting "Decline" keeps it disabled.
You have the right to:
To exercise these rights, visit Your Privacy Choices or submit a request at nusu.ai/legal/data-request.
For questions about this notice, contact us at privacy@nusu.ai or dsr@nusu.ai.