Privacy Policy

This Privacy Policy explains how THE LUMINA STUDIO SRL ("Nosy", "we", "us", or "our") collects, uses, stores, shares, and protects information when you use the Nosy platform, available at nosy.ro and reviews.nosy.ro (the "Service"). It also explains, in detail, how the Service accesses and uses data from Google services, in accordance with the Google API Services User Data Policy.

1. Who we are

The Service is operated by THE LUMINA STUDIO SRL, a company registered in Romania. For any privacy-related question or request, you can contact us at the email address listed at the end of this policy.

2. Information we collect

2.1 Information you provide

• Account information: name, email address, password, and business details you enter when registering.
• Business content: information about your business, services, products, menus, brand voice, and any content you create or upload within the Service.
• Communications: messages you send to us for support.

2.2 Information collected automatically

• Usage data: how you interact with the Service (pages visited, features used, timestamps).
• Technical data: IP address, browser type, device information, and similar diagnostic data.
• Website analytics (where a business enables it): we help businesses measure how their own website is used, with a privacy-friendly, cookieless method. For each visit we record the page address and the referring page without their query string, except campaign tags (UTM) and the name of the ad network an ad click came from (never its click id), and with path parts that look like a token or an e-mail address replaced, any campaign tags (UTM) on the link, a coarse device, browser and operating system, and how the visitor interacted with the page — how far down they scrolled, how long they stayed, where on the page they clicked, and a short description of the element they clicked (its tag, id, CSS class or accessible label).
  What we do not do is identify anyone. It sets no cookies and stores nothing at all on visitors' devices, and it keeps no raw IP addresses: a visitor is recognised only by a one-way hash of their IP and browser, salted with a secret that is regenerated every day and never re-used, and scoped to a single website. That means the hash cannot be reversed, cannot follow a visitor from one day to the next, and cannot follow them between sites. Whether a business still needs its visitors' consent for this depends on the country and on how its website is set up, so each business should check this with its data protection contact.
  Businesses should still avoid putting personal data into their own page addresses: what is not caught by the rules above is recorded as it appears.

2.3 Google user data we access

When you choose to connect your Google account(s) to Nosy, you authorize us — through Google's OAuth consent process — to access specific Google data on your behalf. We only request the minimum scopes necessary for the features you use. Specifically:

• Google Business Profile — we access your business profile information, customer reviews, ratings, questions and answers, and posts, in order to: display your reviews and ratings in your dashboard, help you collect new reviews, draft and publish replies to reviews in your brand voice, and manage your public business information.
• Google Search Console — we access your search performance data (such as search queries, impressions, clicks, average position, and indexed pages), in order to: show you which keywords your business ranks for, track ranking changes over time, and measure the impact of the content the Service publishes.
• Google Merchant Center / Google Shopping — we access your product and listing data, in order to: display and help you manage your product listings, and surface product-related insights within the Service.

2.4 Reviews you submit

When you leave a review or feedback through a business that uses Nosy — for example after scanning a QR code or opening a review link — we collect what you provide: your name or initials, your star rating, your written review, and any photos you choose to add. We do this so the business can receive your feedback and respond to it.

Reviews are meant to be seen. When you submit one, your name and review may be published publicly in the places the business chooses to share it, including:

• the business's Google Business Profile, where the review appears on Google Search and Maps;
• the business's social media (such as Facebook or Instagram posts and shared review cards);
• the business's own website, through a Nosy widget that displays customer reviews.

Because these places are public, your review and the name shown with it can be seen by anyone, may be indexed by search engines, and may stay visible after you post it. Please share only what you're comfortable making public, and avoid including sensitive personal details. To have a review taken down, contact the business directly — or contact us using the details below and we'll help.

2.5 Facebook and Instagram data we access

When you choose to connect your Facebook Page and/or Instagram Business account to Nosy, you authorize us — through Meta's OAuth consent process — to access specific data on your behalf, in order to:

• Publish posts to your Facebook Page and/or Instagram account on your behalf, only when you enable this feature and only after you have approved each post.

We request only the minimum permissions necessary for the features you use. We do not use Facebook or Instagram data for advertising, and we do not sell or share it with third parties except as described in Section 4 of this policy. You may disconnect your Facebook or Instagram account at any time from within the Service, which revokes our access to the associated data.

How publishing works. Publishing to Facebook and Instagram runs through our processor Zernio (see Section 4). When you connect, Meta shows its permission screen under the name "Social Media Connector"; that is the app Zernio operates for us. The access Meta grants (the login token) is held by Zernio and is not stored by Nosy. Nosy stores only the name and ID of the connected Page or Instagram account and the IDs of the posts it sends. Nothing is posted without your approval.

3. How we use information

We use the information described above — including Google user data — solely to provide, maintain, and improve the user-facing features of the Service that you have chosen to use. This includes:

• Operating the review collection, reply, and reputation features.
• Generating and publishing content (such as blog articles) on your behalf, where you enable this.
• Tracking and reporting your search visibility and rankings.
• Managing product listings and related insights.
• Providing dashboards, reports, and notifications.
• Providing customer support and responding to your requests.
• Maintaining the security and integrity of the Service.

4. How we share information

We do not sell your personal information or Google user data. We share information only in the following limited circumstances:

• Service providers (sub-processors): We use trusted third-party providers to operate the Service — for example, cloud hosting and infrastructure, and AI text-generation providers used to draft content and replies. These providers process data only on our instructions and only as necessary to perform their services. Google user data is shared with such providers solely to the extent required to deliver the feature you requested (for example, sending the text of a review to an AI provider to draft a reply).
• Publishing to Facebook and Instagram (Zernio): If you connect a Facebook Page or an Instagram account, we use Zernio Software SL (Spain) as a processor to publish your posts. A post is only ever sent after you have approved it; nothing is published without your approval. Zernio receives the post text and image, the scheduled time, and the name and ID of the connected Page or Instagram account, and it holds the access token Meta grants when you connect (shown by Facebook as "Social Media Connector"). It does not receive your customers' contact details. Zernio processes this data under its data processing agreement (DPA) with us, stores it mainly in London (United Kingdom), and keeps technical logs in the United States.
• Generating post backgrounds (Google, Gemini API): If your business has no photos of its own and you have not chosen stock photos, Nosy can create an AI-generated background picture for a social media post. For this we use the Gemini API of Google as a processor. Google receives only a short written description: the kind of business (for example "a hair salon"), a neutral subject of a few words (for example "a bottle of nail polish"), your brand colours as colour codes, and style instructions. Google does not receive your business name, your reviews or any review text, your customers' details, the text of your post, or any image. Google returns one picture, which we store with the post and delete when the post is deleted or the picture is replaced. Under the terms for the paid Gemini API, Google does not use these requests or the pictures to improve its products and keeps them only for a limited time to detect misuse . Before a picture is used, our AI provider checks it for unwanted writing and for whether it leaves room for the text. Every such picture is labelled "AI-generated background" in the editor.
• Legal requirements: Where required by applicable law, regulation, legal process, or enforceable governmental request.
• Protection of rights: Where necessary to protect the rights, property, or safety of Nosy, our users, or others.
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy.

We do not transfer or disclose Google user data to third parties except as described above, and never for advertising or resale.

5. Data storage and protection

We implement appropriate technical and organizational measures to protect your information, including Google user data. These measures include:

• Encryption of data in transit (HTTPS/TLS) across the Service.
• Encryption of sensitive credentials and access tokens at rest.
• Access controls limiting who and what systems can access stored data.
• Hosting on reputable, secured infrastructure.

While we take reasonable steps to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data retention and deletion

We retain your information for as long as your account is active or as needed to provide the Service. Specifically:

• You may disconnect any connected Google account at any time from within the Service. When you disconnect, we stop accessing the associated Google data and revoke the stored access tokens.
• You may request deletion of your account and associated data by contacting us. Upon a verified request, we will delete your personal data and Google user data within a reasonable period, except where retention is required by law (for example, accounting or tax obligations).
• You can disconnect Facebook or Instagram at any time in Social → Settings. We also disconnect them when social posting is switched off. After that, nothing more is sent to Zernio for your business. Posts that are already live on your Page or account stay there until you delete them on Facebook or Instagram.
• AI-generated post backgrounds are stored with their post and deleted when the post is deleted or the background is replaced. Requests sent to Google's Gemini API are kept by Google only as described in Section 4 .
• Cached Google user data (such as previously retrieved reviews or ranking history) is deleted or anonymized when you disconnect the relevant Google service or delete your account, subject to the legal-retention exception above.

7. Your rights

Depending on your location, and in particular under the EU General Data Protection Regulation (GDPR), you may have the right to: access the personal data we hold about you; request correction or deletion; restrict or object to certain processing; request data portability; and withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority (in Romania, the National Supervisory Authority for Personal Data Processing — ANSPDCP). To exercise any of these rights, contact us using the details below.

8. International data transfers

Your information may be processed in countries other than your own, including by sub-processors located outside the European Economic Area. Where such transfers occur, we take steps to ensure an adequate level of protection in accordance with applicable law (for example, through standard contractual clauses).

When you use Facebook and Instagram publishing, post content and technical logs are processed by our processor Zernio in the United Kingdom and the United States, under its data processing agreement and the safeguards it provides (such as standard contractual clauses).

When an AI-generated post background is created, the short description in Section 4 is processed by Google, which may process it in the United States and other countries where it operates , under Google's data processing terms and the safeguards they provide (such as standard contractual clauses) .

9. Children's privacy

The Service is intended for businesses and is not directed to individuals under the age of 16. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we change the way we use Google user data, we will notify you and, where required, obtain your renewed consent before applying the change. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated through the Service or by email.

11. Contact us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

• THE LUMINA STUDIO SRL
• Registered office: str. Mileniului nr. 24, ap. 24, Satu Mare, jud. Satu Mare, 440037, Romania
• CIF (tax ID): 46647910
• Trade Register no.: J2022000888307
• Email: contact@nosy.ro
• Website: nosy.ro