Privacy policy
Last updated: October 30, 2026.
At NŪR Protocol, we handle your personal data with care and transparency. This policy explains what data we collect, why, who we share it with, and how to exercise your rights. It applies to the website www.nurprotocol.com (the "Site"), our products, and the Skin Coach IA.
1. Data Controller
| Information | Detail |
|---|---|
| Data controller | NŪR Protocol |
| Website | www.nurprotocol.com |
| Personal data contact | contact@nurprotocol.com |
We process your data in accordance with the General Data Protection Regulation (GDPR) for individuals located in the European Union, and the UAE Federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) for individuals located in the United Arab Emirates.
2. Data We Collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | First and last name, email, phone number, shipping and billing address | You |
| Account | Username, encrypted password, preferences | You |
| Order and payment | Products ordered, amounts, date, payment method, last 4 digits of card | You, payment provider |
| Delivery | Shipping status, carrier, tracking number | Us, carrier |
| Skin Coach IA | Skin type, goals, lifestyle, environment, questionnaire answers, generated routine | You, AI system |
| Customer service | Messages, return or warranty requests, attached photos | You |
| Browsing | IP address, device and browser type, pages visited, approximate location data, cookies | Automatic |
| Marketing | Newsletter subscription, preferences, interactions with our emails | You, automatic |
| Reviews and content | Product reviews, survey or contest responses | You |
We do not retain your full card number: it is processed by our payment provider. When we show you your payment method, only the last 4 digits appear.
Reviews you publish may be read and reused by other people. Once in the public domain, we no longer have control over their use by third parties.
3. Skin Coach IA and Your Data
The Skin Coach IA uses your answers (skin type, goals, lifestyle, environment) to generate a personalized skincare routine. You are interacting with an artificial intelligence system, not a person.
- No health data requested. We do not ask you for medical information. If you voluntarily enter such information in a free-text field, for example a skin condition, you authorize us to use it to generate your routine. You may withdraw this consent at any time (Section 10).
- No legally binding decisions. The Skin Coach IA provides cosmetic suggestions. It does not make any decision that produces legal effects or significantly affects you. You may request human review of a recommendation.
- Technical providers. Your profile and answers are processed by our technical hosting and AI provider, solely for the purpose of providing the service.
- Limited use. Your answers are used only to provide and improve the Skin Coach IA. They are never sold.
- Control. You may view, correct, or delete your Skin Coach profile at any time by writing to us at contact@nurprotocol.com.
4. Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Process your order, deliver it, manage returns, refunds, and warranties | Performance of the contract |
| Create and manage your account | Performance of the contract |
| Provide the Skin Coach IA and generate your routine | Performance of the contract; explicit consent for any health data voluntarily provided |
| Respond to your requests and handle complaints | Performance of the contract or legitimate interest |
| Verify your identity, prevent fraud, and secure the Site | Legitimate interest |
| Comply with our accounting, tax, and legal obligations | Legal obligation |
| Send you our newsletter and offers | Consent; for our customers, legitimate interest for similar products, with the right to object at any time |
| Measure audience, improve the Site and the Skin Coach IA | Consent (analytics cookies) or legitimate interest for anonymous statistics |
| Show you our ads on other websites (remarketing) | Consent |
Where we rely on your consent, you may withdraw it at any time, without affecting the processing already carried out. If you no longer wish to be contacted for marketing purposes, use the unsubscribe link included in every email.
5. Cookies and Tracking Technologies
A cookie is a small file placed on your device when you visit the Site. It allows information to be remembered until your next visit, for example the contents of your cart.
| Type | Purpose | Your consent |
|---|---|---|
| Strictly necessary | Cart, session, security, payment, remembering your cookie choices | Not required |
| Preferences | Language, country, currency | Required |
| Analytics | Estimating traffic and understanding Site usage | Required |
| Marketing and remarketing | Measuring our campaigns and showing you our products on other websites | Required |
On your first visit, a banner lets you accept, reject, or customize your choices, with rejecting being just as easy as accepting. You can change your choices at any time via the "Cookie Settings" link at the bottom of the page. You can also configure your browser to reject cookies, but some parts of the Site, such as the cart, may then stop working. Your choices are stored for 6 months, and cookies have a maximum lifespan of 13 months.
Remarketing involves placing a cookie on your device to show you our products when you visit other websites. We may use a third-party provider for this, only if you have accepted marketing cookies.
6. Data Sharing and Recipients
We do not sell your personal data. We only share it with:
- Shopify, our online store and hosting platform;
- our payment providers, who process your payment method and help us fight fraud;
- our carriers and logistics providers, to deliver your order;
- our hosting and AI provider for the Skin Coach IA;
- our email, customer service, and analytics tools;
- our professional advisors (accountant, legal), when necessary;
- authorities, when required by law or to protect our rights, the safety of our customers, or to prevent fraud.
These providers only use your data under our instructions, within the framework of contracts that commit them to protecting it.
If NŪR Protocol is sold, merged, or transferred in whole or in part, your data may be transferred to the acquirer, who will be required to comply with this policy.
7. International Transfers
We operate between France and the United Arab Emirates, and some of our providers are located elsewhere, including Canada, Ireland, and the United States. Your data may therefore be transferred, stored, and processed outside the European Economic Area and the United Arab Emirates.
When this is the case, we ensure an adequate level of protection: an adequacy decision where one exists, the European Commission's Standard Contractual Clauses, or another safeguard provided under Article 46 of the GDPR, as well as compliance with the transfer requirements of UAE law. You can obtain information about these safeguards by writing to us at contact@nurprotocol.com.
8. Retention Periods
We retain your data only for as long as necessary for each purpose.
| Data | Retention period |
|---|---|
| Customer account | As long as the account is active, then 3 years after the last contact |
| Orders, invoices, accounting records | 10 years |
| Warranty and after-sales service | Duration of the warranty, then until the end of the statute of limitations |
| Skin Coach IA profile and answers | As long as your account is active, then 24 months after last use, or until you request deletion |
| Customer service messages | 3 years after the last exchange |
| Marketing outreach | 3 years after the last contact; until you withdraw consent for the newsletter |
| Cookies | 13 months maximum; consent choices 6 months |
| Payment data | Not retained by NŪR Protocol (processed by the payment provider) |
At the end of these periods, your data is deleted or anonymized.
9. Security
Your data is stored on secure servers, and payment transactions are encrypted (SSL/TLS). Access to your data is restricted to authorized individuals and providers, who are bound by confidentiality.
You are responsible for keeping your password confidential: do not share it with anyone. Because no transmission over the Internet is completely secure, we cannot guarantee the absolute security of the information you send us. Upon receipt, we apply strict procedures and security measures to prevent unauthorized access.
In the event of a data breach likely to expose you to risk, we will notify you and the relevant authorities, under the conditions provided by law.
10. Your Rights
You have the following rights regarding your data:
- access, to obtain a copy of the data we hold;
- rectification, to correct inaccurate or incomplete data;
- erasure, to request deletion where permitted by law;
- restriction of processing and objection, in particular to marketing outreach, at any time and without justification;
- portability, to receive your data in a common format;
- withdrawal of your consent, at any time;
- setting instructions for the fate of your data after your death (France).
To exercise your rights, write to us at contact@nurprotocol.com. You can also correct your information by logging into your account. We may ask you for proof of identity to protect your data. We respond within one month, extendable by two months for complex requests, and we will inform you if that is the case.
If you believe your rights are not being respected, you may file a complaint with the data protection authority in your country, for example the CNIL in France (www.cnil.fr) or the UAE Data Office.
11. Minors
Our products and the Skin Coach IA are intended for individuals aged 18 and over. We do not knowingly collect data about minors. If you believe a minor has provided us with data, write to us at contact@nurprotocol.com and we will delete it.
12. Changes and Contact
We may update this policy, in particular as our services evolve (for example, the launch of a mobile app for the Skin Coach IA). The version in effect is the one published on this page, along with its update date. We will notify you by email of significant changes.
For any question about this policy or your data: contact@nurprotocol.com.