Privacy Policy

nrtur LLC ("nrtur", "we", "us") builds a CRM for small teams. We are based in Wyoming, USA.

This policy covers:

• Our website — www.nrtur.io, including the blog, comparison pages, and the waitlist and product-update signup forms.
• The nrtur application — the CRM itself, once you have an account and are signed in.

It does not cover third-party websites we link to, or the separate privacy practices of services you choose to connect to nrtur (your email provider, for example). Those have their own policies.

This distinction matters more in a CRM than almost anywhere else, so we put it first. There are two very different piles of data involved, and we have a different legal role for each.

Data about you (we are the controller)

Your name, your work email, your billing details, how you use the product. We decide why and how this is processed, which makes us the data controller. Most of what follows is about this data.

Data you put into nrtur (we are the processor)

Your contacts, leads, deals, notes, call logs, and synced email. This is normally personal data about *other* people — your customers and prospects. For this data you are the controller and we are the processor: we only handle it on your instructions, to provide the service to you.

That has a practical consequence. If one of your contacts asks us to delete their data, we cannot act on that request unilaterally — we will point them to you, and help you action it. See Data you put into nrtur.

Everything below is either something you typed in yourself, or something a browser sends automatically. We do not buy personal data about you from anyone, and we do not build advertising profiles.

We do not ask for special-category data (health, race, religion, biometrics, political views) and the product is not designed to hold it. Please do not put it in nrtur.

When you use the CRM you will upload or create records about other people — the contacts, companies, deals, notes, tasks, and messages that make up your pipeline. Depending on the features you turn on, that can also include email threads synced from Gmail or Outlook, and the SMS and email you send through nrtur.

What we do with it

• Store it and show it back to you — that is the product.
• Run the features you switch on — automations, sequences, reminders, reports.
• Keep backups, so a mistake or an outage does not cost you your pipeline.
• Investigate problems you report to us, when we need to look at a specific record to fix a bug.

What we do not do with it

• We do not sell it, rent it, or share it with advertisers.
• We do not use your CRM data to market to your contacts.
• We do not use your CRM data to train AI models. nrtur does not currently include any AI features — if we add one, we will name the provider in the table below and update this policy before it processes anything.
• We do not browse it. Staff access is limited to the small number of people who need it, is logged, and happens only to run the service, fix a fault, or when the law requires it.

A cookie is a small piece of text a website asks your browser to store. We use a deliberately short list — and the only optional item on it is off until you say otherwise.

We do not run advertising or retargeting pixels, we do not use third-party marketing cookies, and Google Consent Mode is configured to keep every advertising signal denied even when you have accepted analytics.

Changing your mind

• Click Cookie settings in the footer of any page. That clears your stored choice, deletes any Google Analytics cookies already on your device, and brings the banner back.
• Send a Global Privacy Control signal from your browser or extension. We treat GPC — and legacy Do Not Track — as a standing refusal: analytics never load and we do not show you the banner at all.
• Block cookies in your browser settings or use a content blocker. Nothing here breaks if you do.
• Or just email us at ops@nrtur.io and we will handle it.

Withdrawing is as easy as consenting, and we do not treat a declined banner as a reason to ask again on the next page.

We use a small number of vendors to actually run the service. Each one only gets what it needs, is bound by a contract that limits what it can do with it, and is listed here so you can check for yourself.

The nrtur application

This website

The other three situations

Beyond those vendors, we will only disclose personal data when:

1. You ask us to — for example when you connect an integration, or tell us to share something with someone.
2. The law requires it — a valid court order, subpoena, or equivalent legal process. Where we are legally allowed to tell you first, we will, so you have a chance to challenge it. We will push back on requests that look overbroad.
3. The business changes hands — if nrtur is acquired or merged, your data may transfer to the new owner, who stays bound by this policy. We will tell you before that happens and before your data becomes subject to a different policy.

Stated plainly, because US state privacy laws require it and because a lot of CRM companies are vague about it: we have not sold personal information in the past twelve months, we do not sell it now, and we do not share it for cross-context behavioural advertising. We have no plans to start.

We also do not sell the data of anyone under 16 — we do not knowingly collect it at all.

nrtur is a US company and our infrastructure is primarily in the United States. If you use nrtur from the UK, the EEA, or Switzerland, your personal data is transferred to and processed in the US.

For those transfers we rely on the Standard Contractual Clauses approved by the European Commission (and the UK Addendum for UK transfers), together with additional technical measures such as encryption in transit and at rest. We are not currently certified under the EU–US Data Privacy Framework; if that changes we will say so here.

Want a copy of the transfer safeguards we rely on? Email ops@nrtur.io and we will send them.

We keep data for as long as it is doing a job, and no longer.

• Encryption in transit — everything travels over HTTPS/TLS. We do not serve the site over plain HTTP.
• Encryption at rest — stored data and backups are encrypted on disk.
• Passwords are hashed, using a slow, salted algorithm. Nobody at nrtur can read your password, and we will never ask you for it.
• Least-privilege access — production access is limited to the engineers who need it, protected by multi-factor authentication, and logged.
• Backups are taken regularly and periodically test-restored, because a backup nobody has restored is not a backup.

No system is perfectly secure, and we will not pretend otherwise. If we suffer a breach that affects your personal data, we will notify you and the relevant regulator without undue delay — and within 72 hours of becoming aware of it where GDPR applies.

Our security overview goes into more detail, including an honest status table of what we have built and what we have not, and our vulnerability disclosure policy.

Depending on where you live, some or all of the following apply. We extend them to everyone regardless of location, because maintaining two standards of decency is more work than maintaining one.

• Access — get a copy of the personal data we hold about you.
• Correction — fix anything inaccurate or incomplete.
• Deletion — ask us to erase your data.
• Portability — get your data in a structured, machine-readable format, or exported to another provider.
• Restriction and objection — tell us to stop or limit a particular use, including anything we do on the basis of legitimate interests.
• Withdraw consent — at any time, where we relied on consent. This does not undo processing that already happened.
• Opt out of sale or sharing — there is nothing to opt out of, because we do not do it, but the right stands.
• No retaliation — we will not degrade your service or charge you more for exercising any of this.

How to make a request

Email ops@nrtur.io from the address on your account and tell us what you want. We will confirm receipt and respond within 30 days — and if a request is genuinely complex we will tell you why we need longer, up to a further 60 days. It is free, unless a request is repetitive or excessive.

We may need to verify who you are before acting, particularly for access and deletion. An authorised agent can make a request for you where the law allows it; we will ask for proof of authorisation.

If we get it wrong

Come back to us first — we would rather fix it. You also have the right to complain to your data protection authority: the ICO in the UK, your national supervisory authority in the EEA, or your state Attorney General in the US.

nrtur is a business tool. It is not directed at children, and you must be at least 16 to have an account. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.

nrtur connects to other tools when you tell it to — your mailbox, your calendar, and others over time. Connecting one means granting nrtur permission to read or write data in that account.

Google and Microsoft mailbox sync

In practice that means the mail and calendar data we receive is used only to display and organise your messages against the right contact inside nrtur, and to run features you explicitly turn on. We do not use it for advertising, we do not sell it, we do not use it to train AI models, and no human reads it except with your explicit permission, to resolve a fault you reported to us, for security purposes, or where the law requires it.

We connect to Gmail and Outlook through [Aurinko](https://www.aurinko.io/privacy-policy), a mail and calendar API provider that processes this data on our behalf as a sub-processor under contract. It is listed in the sub-processor table above.

You can revoke access at any time from your Google account permissions or your Microsoft account settings — that immediately stops any further sync.

Our website also links out to other sites — documentation, comparison sources, our vendors. Once you follow a link you are on their turf and under their privacy policy, not ours.

We will update this page when our practices change. The "last updated" date at the top always reflects the current version.

For minor edits — clarifying wording, adding a vendor to the table — updating this page is the notice. For material changes that affect your rights or meaningfully expand how we use your data, we will email account holders and give at least 30 days notice before they take effect, so you have time to object or close your account.

Questions, requests, complaints, or a Data Processing Agreement to sign — all go to the same place, and a person on the team answers.

• Email — ops@nrtur.io
• Post — nrtur LLC, Wyoming, USA

If you are in the UK or EEA and would like to raise something with our data protection contact specifically, use the same address and put "GDPR" in the subject line so it gets routed correctly.

EU and UK representative