Privacy Policy

Last updated: 30 August 2026

This Privacy Policy explains how THE LUMINA STUDIO SRL ("Nosy", "we", "us", or "our") collects, uses, stores, shares, and protects information when you use the Nosy platform, available at nosy.ro and reviews.nosy.ro (the "Service"). It also explains, in detail, how the Service accesses and uses data from Google services, in accordance with the Google API Services User Data Policy.

Summary of our Google data practices: Nosy accesses your Google Business Profile, Google Search Console, and Google Merchant Center / Google Shopping data only to provide and improve the features you ask us to perform on your behalf — such as collecting and replying to reviews, tracking your search rankings, and managing your product listings. We do not sell this data, do not use it for advertising, and do not share it except as strictly necessary to operate the Service.

1. Who we are

The Service is operated by THE LUMINA STUDIO SRL, a company registered in Romania. For any privacy-related question or request, you can contact us at the email address listed at the end of this policy.

2. Information we collect

2.1 Information you provide

Account information: name, email address, password, and business details you enter when registering.
Business content: information about your business, services, products, menus, brand voice, and any content you create or upload within the Service.
Communications: messages you send to us for support.

2.2 Information collected automatically

Usage data: how you interact with the Service (pages visited, features used, timestamps).
Technical data: IP address, browser type, device information, and similar diagnostic data.
Website analytics (where a business enables it): we help businesses measure how their own website is used, with a privacy-friendly, cookieless method. For each visit we record the page address (including any query string it carries), the referring page, any campaign tags (UTM) on the link, a coarse device, browser and operating system, and how the visitor interacted with the page — how far down they scrolled, how long they stayed, where on the page they clicked, and a short description of the element they clicked (its tag, id, CSS class or accessible label).
What we do not do is identify anyone. It sets no cookies and stores nothing at all on visitors' devices, and it keeps no raw IP addresses: a visitor is recognised only by a one-way hash of their IP and browser, salted with a secret that is regenerated every day and never re-used, and scoped to a single website. That means the hash cannot be reversed, cannot follow a visitor from one day to the next, and cannot follow them between sites. Because nothing is stored on the device and no visitor is identified, this needs no cookie-consent banner.
Businesses should avoid putting personal data into their own page addresses, since the address is recorded as it appears.

2.3 Google user data we access

When you choose to connect your Google account(s) to Nosy, you authorize us — through Google's OAuth consent process — to access specific Google data on your behalf. We only request the minimum scopes necessary for the features you use. Specifically:

Google Business Profile — we access your business profile information, customer reviews, ratings, questions and answers, and posts, in order to: display your reviews and ratings in your dashboard, help you collect new reviews, draft and publish replies to reviews in your brand voice, and manage your public business information.
Google Search Console — we access your search performance data (such as search queries, impressions, clicks, average position, and indexed pages), in order to: show you which keywords your business ranks for, track ranking changes over time, and measure the impact of the content the Service publishes.
Google Merchant Center / Google Shopping — we access your product and listing data, in order to: display and help you manage your product listings, and surface product-related insights within the Service.

2.4 Reviews you submit

When you leave a review or feedback through a business that uses Nosy — for example after scanning a QR code or opening a review link — we collect what you provide: your name or initials, your star rating, your written review, and any photos you choose to add. We do this so the business can receive your feedback and respond to it.

Reviews are meant to be seen. When you submit one, your name and review may be published publicly in the places the business chooses to share it, including:

the business's Google Business Profile, where the review appears on Google Search and Maps;
the business's social media (such as Facebook or Instagram posts and shared review cards);
the business's own website, through a Nosy widget that displays customer reviews.

Because these places are public, your review and the name shown with it can be seen by anyone, may be indexed by search engines, and may stay visible after you post it. Please share only what you're comfortable making public, and avoid including sensitive personal details. To have a review taken down, contact the business directly — or contact us using the details below and we'll help.

2.5 Facebook and Instagram data we access

When you choose to connect your Facebook Page and/or Instagram Business account to Nosy, you authorize us — through Meta's OAuth consent process — to access specific data on your behalf, in order to:

Display and help you reply to reviews and comments left on your connected Facebook Page;
Display and help you reply to comments on your connected Instagram account;
Publish posts to your Facebook Page and/or Instagram account on your behalf, only when you enable this feature;
Manage the review and reputation features you've chosen to use.

We request only the minimum permissions necessary for the features you use. We do not use Facebook or Instagram data for advertising, and we do not sell or share it with third parties except as described in Section 4 of this policy. You may disconnect your Facebook or Instagram account at any time from within the Service, which revokes our access to the associated data.

3. How we use information

We use the information described above — including Google user data — solely to provide, maintain, and improve the user-facing features of the Service that you have chosen to use. This includes:

Operating the review collection, reply, and reputation features.
Generating and publishing content (such as blog articles) on your behalf, where you enable this.
Tracking and reporting your search visibility and rankings.
Managing product listings and related insights.
Providing dashboards, reports, and notifications.
Providing customer support and responding to your requests.
Maintaining the security and integrity of the Service.

Limited Use commitment. Nosy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide or improve user-facing features that are prominent in the Service's user interface. We do not use Google user data for serving advertisements, and we do not transfer or sell it to third parties for advertising, retargeting, credit-worthiness, or lending purposes.

4. How we share information

We do not sell your personal information or Google user data. We share information only in the following limited circumstances:

Service providers (sub-processors): We use trusted third-party providers to operate the Service — for example, cloud hosting and infrastructure, and AI text-generation providers used to draft content and replies. These providers process data only on our instructions and only as necessary to perform their services. Google user data is shared with such providers solely to the extent required to deliver the feature you requested (for example, sending the text of a review to an AI provider to draft a reply).
Legal requirements: Where required by applicable law, regulation, legal process, or enforceable governmental request.
Protection of rights: Where necessary to protect the rights, property, or safety of Nosy, our users, or others.
Business transfers: In connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy.

We do not transfer or disclose Google user data to third parties except as described above, and never for advertising or resale.

5. Data storage and protection

We implement appropriate technical and organizational measures to protect your information, including Google user data. These measures include:

Encryption of data in transit (HTTPS/TLS) across the Service.
Encryption of sensitive credentials and access tokens at rest.
Access controls limiting who and what systems can access stored data.
Hosting on reputable, secured infrastructure.

While we take reasonable steps to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data retention and deletion

We retain your information for as long as your account is active or as needed to provide the Service. Specifically:

You may disconnect any connected Google account at any time from within the Service. When you disconnect, we stop accessing the associated Google data and revoke the stored access tokens.
You may request deletion of your account and associated data by contacting us. Upon a verified request, we will delete your personal data and Google user data within a reasonable period, except where retention is required by law (for example, accounting or tax obligations).
Cached Google user data (such as previously retrieved reviews or ranking history) is deleted or anonymized when you disconnect the relevant Google service or delete your account, subject to the legal-retention exception above.

7. Your rights

Depending on your location, and in particular under the EU General Data Protection Regulation (GDPR), you may have the right to: access the personal data we hold about you; request correction or deletion; restrict or object to certain processing; request data portability; and withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority (in Romania, the National Supervisory Authority for Personal Data Processing — ANSPDCP). To exercise any of these rights, contact us using the details below.

8. International data transfers

Your information may be processed in countries other than your own, including by sub-processors located outside the European Economic Area. Where such transfers occur, we take steps to ensure an adequate level of protection in accordance with applicable law (for example, through standard contractual clauses).

9. Children's privacy

The Service is intended for businesses and is not directed to individuals under the age of 16. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we change the way we use Google user data, we will notify you and, where required, obtain your renewed consent before applying the change. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated through the Service or by email.

11. Contact us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

THE LUMINA STUDIO SRL
Email: contact@nosy.ro
Website: nosy.ro