Privacy notice
Last updated 25 August 2026.
This notice explains what personal data Nusan collects, why we collect it, who we share it with, how long we keep it and what rights you have. Nusan is a UK service and this notice is written to meet the UK GDPR and the Data Protection Act 2018.
1. Who we are
Nusan (nusan.uk) is a product of dijitul, a UK web agency. dijitul is the data controller for the personal data described in this notice. You can reach our privacy contact at hello@nusan.uk.
Operator to complete: registered company name, company number and registered office address.
This placeholder must be replaced with the trading entity's full registered details before this notice is relied on in production.
We are not required to appoint a statutory Data Protection Officer. Privacy questions, requests and complaints all go to hello@nusan.uk and are handled by the person responsible for data protection at dijitul.
2. Who this notice covers
- People who create a Nusan account and the businesses they represent.
- People who use the free check tool on our marketing site.
- People who contact us by email.
Much of what Nusan handles is business information rather than personal data. But if you are a sole trader or your business trades under your own name, your business details are also personal data, and we treat them accordingly.
3. What Nusan does with your business details
Nusan checks whether AI assistants name your business when someone asks a buying question in your category and area, for example a question about the best joiner in Mansfield. To do that, we generate questions from the profile you give us and send those questions, together with your business name, sector, town, website and description, to the application programming interfaces operated by OpenAI, Anthropic, Google and Perplexity. We store the answers those services return, the competitor names we detect in them and the scores we calculate.
This means your business profile leaves our systems and is processed by those AI providers. We use their business and API tiers, under which the providers state that content submitted through the API is not used to train their general models by default. We cannot control what those providers do beyond their published terms, so please do not put anything confidential, sensitive or special category into your business profile. It only needs the information a customer could already find on your website.
4. What personal data we hold
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Email address, a bcrypt hash of your password (never the password itself), account creation and sign-in timestamps | You, at sign-up |
| Business profile | Business name, sector, town or city, website address, business description | You, in the app |
| Scan data | Generated questions, answers returned by the AI providers, competitor names detected in those answers, visibility scores and scan history | Generated by Nusan and returned by the AI providers |
| Billing data | Stripe customer ID, Stripe subscription ID, plan, subscription status and renewal dates | Stripe, when you subscribe |
| Session and audit logs | IP address, timestamp, the action performed and the account it related to | Recorded automatically when you use the service |
| Email delivery logs | Recipient address, message type, send time and delivery or failure status | Recorded when we send you an email |
| Free check data | The business details you type into the free check, and an email address if you choose to give one so we can send you the result | You, on the marketing site |
We do not ask for and do not want special category data such as health, ethnicity, religious belief or biometric data. We do not collect card numbers. Card details are entered directly into Stripe and never reach our servers.
5. Why we use it, and our lawful basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and running your account, authenticating you | Account data | Performance of a contract, UK GDPR Article 6(1)(b) |
| Running scans, generating questions, calling the AI providers, storing and displaying results | Business profile, scan data | Performance of a contract, Article 6(1)(b) |
| Sending service emails such as scan results, trial reminders and password resets | Account data, email delivery logs | Performance of a contract, Article 6(1)(b) |
| Taking payment and managing your subscription | Billing data | Performance of a contract, Article 6(1)(b) |
| Keeping accounting and tax records | Billing data | Legal obligation, Article 6(1)(c) |
| Security, abuse prevention, rate limiting, investigating incidents, keeping an audit trail | Session and audit logs including IP address | Legitimate interests, Article 6(1)(f) — our interest in keeping the service secure and available, balanced against the limited intrusion of holding an IP address for a short period |
| Diagnosing faults and improving reliability | Logs, aggregate usage counts | Legitimate interests, Article 6(1)(f) |
| Returning the result of a free check by email | Free check data | Performance of a contract or steps taken at your request, Article 6(1)(b) |
| Marketing emails about Nusan | Email address | Consent, Article 6(1)(a), or the soft opt-in under regulation 22 of PECR where you are an existing customer. You can withdraw or object at any time |
Where we rely on legitimate interests, we have carried out a balancing assessment and are satisfied that our interests do not override your rights. You can ask us for a summary of that assessment at hello@nusan.uk.
Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of anything done before you withdrew it. Every marketing email carries an unsubscribe link. Unsubscribing from marketing does not stop service emails you need in order to use your account.
6. The free check tool
The free check on our marketing site can be used without an account and without giving an email address. If you do give an email address so that we can send you the result, we use it to send that result and, if you tick the box, to send you occasional emails about Nusan. We keep free check submissions and any email address given for twelve months, then delete them, unless you have created an account in the meantime or unsubscribed sooner.
7. Who we share data with
We do not sell personal data and we do not share it for advertising. We use the following processors and service providers.
| Provider | What they do for us | What they receive | Where they process it |
|---|---|---|---|
| OpenAI | Answers questions via the ChatGPT models API | Generated questions and your business name, sector, town, website and description | United States |
| Anthropic | Answers questions via the Claude models API | As above | United States |
| Answers questions via the Gemini models API | As above | United States and other Google regions | |
| Perplexity | Answers questions via the Perplexity API | As above | United States |
| Stripe | Payment processing, checkout, subscription management and the customer portal | Your email address and payment details you enter with Stripe | United Kingdom, European Union and United States |
| Our email provider | Sends transactional and service email over SMTP | Your email address and the content of the email | Depends on the provider configured for this deployment |
| DigitalOcean | Hosts the application and database on a droplet in the UK region | All data held by the service, at rest and in transit | United Kingdom, with support access possible from the United States |
We may also disclose data to our professional advisers, or to a regulator, court or law enforcement body where we are legally required to. If dijitul is sold or restructured, data may transfer to the acquiring entity, which would remain bound by this notice.
8. International transfers
Nusan is hosted in the United Kingdom, but the AI providers we depend on are based in the United States, so your business profile and generated questions are transferred outside the UK every time a scan runs. This is unavoidable given what the product does.
Where a transfer is not covered by UK adequacy regulations, we rely on the International Data Transfer Agreement, or on the UK International Data Transfer Addendum to the European Commission Standard Contractual Clauses, as incorporated into the data processing terms of each provider. We carry out a transfer risk assessment for each provider and keep it under review. Supplementary measures include sending only information that is already public on your website, sending no special category data, and encrypting data in transit.
You can ask us for details of the transfer mechanism used for a particular provider by emailing hello@nusan.uk.
9. How long we keep things
| Data | Retention period |
|---|---|
| Account data and business profile | For as long as your account is open, then deleted within 30 days of closure |
| Scan data, answers, competitor names and scores | Kept while your account is open so you can see trends over time, then deleted within 30 days of closure |
| Session and audit logs including IP address | 12 months from the date of the entry |
| Email delivery logs | 12 months from the date the message was sent |
| Billing and accounting records, including Stripe identifiers and invoices | 6 years from the end of the accounting period they relate to, to meet tax and company law requirements |
| Free check submissions and any email address given | 12 months, or until you unsubscribe if sooner |
| Support correspondence | 24 months from the last message in the thread |
| Encrypted backups | Rotated and overwritten within 35 days, so deleted data disappears from backups within that window |
Copies of your business profile and questions held by the AI providers are subject to those providers' own retention policies, which are typically up to 30 days for abuse monitoring on API traffic.
10. How we protect your data
- All traffic to and from Nusan is encrypted with TLS.
- Passwords are stored only as bcrypt hashes and are never recoverable by us.
- The session cookie is httpOnly and set with SameSite equal to Lax.
- Hosting is on a UK-region droplet with restricted administrative access and a firewalled database.
- Access to production data is limited to the small number of dijitul staff who need it, and administrative actions are recorded in an audit log.
- Backups are encrypted and access to them is restricted.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and we will tell you directly without undue delay where the risk to you is high.
11. Your rights
Under the UK GDPR you have the right to:
- be told what personal data we hold about you and get a copy of it;
- have inaccurate data corrected;
- have data erased where we no longer have a good reason to keep it;
- restrict how we use your data while a dispute is resolved;
- receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider where technically feasible;
- object to processing we carry out on the basis of legitimate interests, including profiling;
- object at any time to direct marketing, which is an absolute right;
- withdraw consent where consent is the basis we rely on.
To exercise any of these, email hello@nusan.uk from the address on your account, or tell us enough for us to identify you if you do not have an account. We may ask for proportionate proof of identity so we do not disclose your data to the wrong person. We respond within one month. If a request is complex or you have made several, we may extend that by up to two further months and will tell you why within the first month. There is no charge unless a request is manifestly unfounded or excessive.
Some rights have limits. We may keep billing records to meet our legal obligations even after you ask for erasure, and we cannot recall answers already processed by an AI provider, although we will pass on a deletion request to them where their terms allow.
12. Automated decision-making
Nusan calculates a visibility score from the answers the AI providers return. That score is an analytical output about a business, not a decision about a person, and it produces no legal or similarly significant effect on any individual. We do not carry out automated decision-making of the kind described in Article 22 of the UK GDPR.
13. Cookies
Nusan uses one strictly necessary session cookie and no analytics or advertising cookies. See our cookie notice for the detail.
14. Children
Nusan is a business tool and is not intended for anyone under 18. We do not knowingly collect data about children. If you believe a child has given us personal data, tell us at hello@nusan.uk and we will delete it.
15. Complaints
If you are unhappy with how we have handled your personal data, please tell us first at hello@nusan.uk so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or through the ICO website at ico.org.uk.
16. Changes to this notice
We update this notice when the service changes. The date at the top shows when it was last revised. If we make a change that materially affects how we use your data, we will email account holders before it takes effect.