Privacy Policy

Who we are

Nubo Suite is operated by Chandorkar Technologies OPC Private Limited (GSTIN 27AAHCC9556B1ZK), whose registered office is at Floor 2nd, Shreyas Eterna, NDA Pashan Rd, Shri Krishna Nagar, Sagar Co-Operative Housing Society, Bavdhan, Pune, Maharashtra 411 021, India (“we”, “us”). We decide why and how personal data is processed on this website and for our own account and billing records, so we are the data fiduciary (controller) for those. For the content a customer organisation stores in Nubo, the organisation is the data fiduciary (controller) and we act as its processor under the Data Processing Addendum.

This policy explains what we collect when you use nubosuite.tech, home.nubosuite.tech, Nubo Mail (nubo.email) and the Nubo apps, and what we do with it. The law we mainly work to is India’s Digital Personal Data Protection Act, 2023 and the rules made under it, as they come into force. If you are in the European Economic Area or the United Kingdom, the GDPR or UK GDPR also applies to you and the section “Your rights” says what that means. Questions: support@nubo.email.

What we collect

Account details you give us: username, name and a recovery email.
Content you create or store in your account: files, mail, calendar entries, contacts and app data.
Security and usage records: sign-in events, device and browser type, IP address and activity records, and per-day usage counts used to apply plan limits.
Notification details if you enable push: your browser push subscription.
Billing details for paid plans: payments are handled by Razorpay (India) or Dodo Payments (outside India). We do not store full card numbers.
Messages you send us from this website: the name, email address and message you type into a contact, partner, security-review or newsletter form, and the other fields on that form (for example company, phone number, team size and the page you were on). We also keep your browser’s user-agent text, the country the request came from, and a salted hash of your IP address, not the address itself, to limit abuse.
Website requests: our network provider, Cloudflare, sees the IP address, the page requested and the browser type for every request to this website. We do not run advertising scripts on this website.
Website usage (Google Analytics): if you allow it, or if your location does not require your choice first, Google Analytics records how you use our pages: pages visited, clicks on buttons, whether a form was sent (never what you typed in it), device and browser type, an approximate location (country and region) and the country version of the site, plus page-speed measurements (how fast the page loaded and responded), the type of site the visit came from (for example a search engine or an AI assistant; only the website name, never the address you were on) and the kind of script error that occurred (its type only, never its details). It sets cookies. See the Cookie policy for what loads when, how to opt out and how long the data is kept.
Website usage (Ahrefs Web Analytics): under the same choice described in the Cookie policy, Ahrefs counts visits using the page address, the referring site and your browser’s user-agent text, without cookies.
Website usage (Microsoft Clarity): if you allow it, or if your location does not require your choice first, Clarity records how you use our pages: pages visited, clicks, scrolling, device and browser type, an approximate location derived from your IP address, and anonymised recordings in which form fields are masked. It sets cookies. See the Cookie policy for what loads when, how to opt out and how long Microsoft keeps it.

Why we use it and our legal basis

To run the service you asked for (providing your account, files, mail and apps; billing). Basis: your consent when you sign up and use the service, and our contract with you or your organisation.
To keep accounts and the service safe (new-device alerts, sign-in lockouts, two-step verification, abuse limits on forms). Basis: our legitimate interest and, in India, the legitimate uses the DPDP Act allows.
To send service emails from noreply@nubo.email, such as sign-in codes, security alerts, invitations that you or your team trigger, and plan changes.
To answer your messages and support requests. Basis: you asked us to.
To send the newsletter, only if you sign up and confirm your address by clicking the link in the confirmation email (double opt-in). Basis: your consent, which you can withdraw at any time by writing to support@nubo.email.
To understand and improve this website with Google Analytics and Microsoft Clarity. Basis: your consent. On the UK version of the site, and for browsers in European time zones, nothing loads until you accept; elsewhere it loads by default and we tell you here and in the Cookie policy, and you can switch it off at any time with “Cookie settings” in the footer, or with a Global Privacy Control or Do Not Track signal.
To meet legal duties, such as tax and accounting records.

What we do not do

We do not sell your data and we do not use your content for advertising. We do not use your content to train AI models.

When you use an AI feature in Nubo, the text you send to it (and any content you attach to the request) is processed by Nubo’s AI gateway, which forwards it to DeepInfra to run the model and return the answer. We do not send your name or account details with it. This happens only when you use an AI feature. See the Sub-processors page.

When you share a file, board or meeting, the people you choose can see it. Our service providers process data for us under contract (see the Sub-processors page). We disclose information if the law requires it or to protect people from serious harm.

Where data is stored and transfers

Your account data, files, mail and databases are hosted by Hetzner in Helsinki, Finland. This means that data about people in India, the United States and elsewhere is transferred to and stored in Finland. Our network provider Cloudflare handles website traffic in the country nearest to the visitor, and AI requests go to DeepInfra, a company based in the United States (see Sub-processors). Payment details go to Razorpay or Dodo Payments.

Where personal data leaves India or the EEA/UK, we rely on our written agreements with these providers and the security measures described below. We have not signed the EU Standard Contractual Clauses with every provider ourselves, and we do not claim an adequacy decision for any of them. If you need a specific transfer mechanism for your organisation, write to us before you start using Nubo and we will discuss it. The DPDP Act allows transfers outside India except to countries the Government of India restricts; we will follow any such restriction.

How long we keep data

Your content stays in your account until you delete it. Other periods:

Closing your account. You can close your account at any time in Nubo Home under Account > Delete account. We sign you out everywhere straight away and email you the date of deletion. For 30 days you can sign in and cancel the deletion; nothing is lost. If you do not cancel, we permanently delete your account and its data (your files, mailbox, contacts, calendar, app data, shared links and sites, sign-in credentials, trusted devices, notifications and usage records) when the 30 days end. Our deletion job runs once a day, so it can take up to a day longer. We then email you to confirm. Your membership of teams ends and team admins are told; content owned by a team stays with the team, and messages you sent to other people stay in their copies. If you are the only owner of a team or organisation that has other members, you must transfer ownership or delete it first. If a legal hold applies to an account, deletion waits until the hold ends.
What we keep after deletion. A minimal record (an irreversible code of your account id, the deletion date and your plan) for 12 months, to prevent abuse and meet legal obligations. Your username stays reserved for 90 days so nobody can impersonate you. Invoices and payment records are kept for as long as Indian tax and company law require us to keep them.
Website form messages (contact, partner, security-review): kept while we need them to answer you and to keep a record of the enquiry, and deleted when you ask us to. Newsletter sign-ups are kept until you unsubscribe, and unconfirmed sign-ups are not used.
While an account is open: deleted items in a Team Drive stay in the trash for 30 days by default (an organisation can set 1 to 365 days) and are then removed. An organisation’s event log is kept for 90 days by default; an organisation admin can set a different period. The record of sharing events is kept for 90 days. A sign-in session lasts 30 days, and “remember this device” for two-step verification lasts 30 days. A team invitation expires after 14 days.

How we protect data

Passwords are stored as salted scrypt hashes. Sessions are signed tokens. You can turn on two-step verification with an authenticator app or a passkey, and repeated failed sign-ins are locked out. Data is encrypted in transit with TLS (HTTPS). We do not claim end-to-end or zero-knowledge encryption: our servers can process your content in order to run the service. We hold no security certification such as SOC 2 or ISO 27001. If a personal data breach affects a business customer’s data, we tell that customer within 72 hours of becoming aware of it, and we report to the authorities and affected people where the law requires.

Cookies

See the Cookie Policy. On this website we set one functional cookie, nubo_locale, only when you choose a country or language version of the site or answer the suggestion banner.

Your rights

You can access, correct, export and delete your data from your account, and you can ask us to do it for you. Export is done through the apps (for example downloading files, exporting contacts and calendars, mail as .eml files, and CSV or JSON export in the business apps); if you need help, write to us. Where the Digital Personal Data Protection Act, 2023 applies to you, you have the right to information about your data, to correct and erase it, to grievance redressal, and to nominate another person to exercise your rights if you die or cannot act. Where the GDPR or UK GDPR applies, you also have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the right to complain to your data protection authority.

To use any of these rights write to support@nubo.email; we will answer within 30 days. If you are in a US state whose privacy law gives you rights, you may use the same address to ask what we hold about you, to correct or delete it, and we will not treat you worse for asking. We do not sell or share personal data for advertising. If your data is in an account run by an organisation (for example your employer), ask that organisation first, because it decides how that data is used.

Grievance Officer (India)

For complaints about how your personal data is handled, write to our Grievance Officer:

Name: Ninad Chandorkar, Director, Chandorkar Technologies OPC Private Limited
Email: grievances@nubo.email
Address: Floor 2nd, Shreyas Eterna, NDA Pashan Rd, Shri Krishna Nagar, Sagar Co-Operative Housing Society, Bavdhan, Pune, Maharashtra 411 021
Phone: 020 4731 9072, Monday to Friday, 10:00 to 19:00 IST

We acknowledge a complaint within 24 hours of receiving it and resolve it within 15 days. If you are not satisfied you may complain to the Data Protection Board of India once it is in operation, or to the authority in your own country.

Children

Nubo Suite is for people aged 18 or over. We do not knowingly create accounts for anyone under 18. If you think a child has an account, write to support@nubo.email and we will close it. Childcare and similar apps are used by organisations about the children in their care; the organisation is responsible for that data, including any parental consent the law requires.

Changes and contact

We will post changes here and tell you about material ones by email or in the app at least 30 days before they take effect. Contact support@nubo.email.