Privacy Policy
Last updated: 20 July 2026 · 日本語
Nurevo ("the Service") assists form completion and makes web forms operable by AI agents. By its nature, the Service observes how forms are used on the websites where it is installed. This policy sets out exactly what we collect, what we deliberately do not collect, and the rights you have over that data.
1. Who we are
The controller responsible for the processing described here is Bestie. LLC, a company registered in Japan, operating Nurevo. Contact: tsuyoshi.hashimoto@exitsign.jp.
Where you install the Service on your own website, you act as the controller for your visitors' data and we act as your processor. Where we use aggregated, non-identifying data to improve the Service across all installations, we act as a controller in our own right. Section 5 explains this split.
2. What we collect
| Form structure | The number and type of fields, their names and labels, which are required, the options in select menus, and a hash used to recognise the same form again |
|---|---|
| Outcome of use | Whether a submission succeeded or failed, how many required fields were completed, and how long the page was open |
| Validation errors | Which field failed validation, the type of failure (wrong format, missing value), and the message the browser displayed |
| Site context | Domain name, page path, page title |
| Account details | The website URL and email address you provide when requesting a site key |
3. What we do not collect
None of the following is collected, transmitted or stored under any circumstances:
- The values entered into form fields — names, telephone numbers, email addresses, postal addresses, dates of birth, or any other input
- Passwords or payment card details
- Cookies or any identifier used to track an individual across sessions or sites
- Raw IP addresses
Validation messages are the one place where a website's own code might echo back what someone typed. We therefore sanitise them twice — once in the browser before transmission, and again on receipt. Any run of three or more digits becomes [NUM], anything shaped like an email address becomes [EMAIL], and the message is truncated to 200 characters before storage.
4. Why we process it, and on what basis
| Showing you analytics | To display completion rates and drop-off points in your dashboard. Basis: performance of our contract with you. |
|---|---|
| Generating and improving markup | To produce the input assistance and agent-facing descriptions the Service exists to provide. Basis: performance of our contract with you. |
| Learning across installations | To identify which input formats are accepted or rejected, so that every site benefits from what the others encounter. Basis: our legitimate interest in improving the Service. This processing uses aggregated data that does not identify any individual. |
| Diagnostics and support | To investigate faults and respond to enquiries. Basis: our legitimate interest in operating a reliable service. |
| Billing | To take payment for paid plans. Basis: performance of our contract with you, and compliance with tax obligations. |
Because we do not collect the values people type, and do not set identifiers that follow an individual, the Service does not build profiles of your visitors and does not make automated decisions about them.
5. Your role as a website operator
If you install Nurevo on a site you operate, you decide that the Service runs there. You should refer to Nurevo in your own privacy notice and, where your jurisdiction requires it, obtain any consent needed before the tag loads.
For processing carried out on your behalf, this policy together with our Terms forms the data processing agreement between us. We process only on your documented instructions, keep the data confidential, apply the security measures described in section 8, assist you with data subject requests, and delete or return the data when our agreement ends. A list of sub-processors appears in section 7. We will give you notice before adding a new one, and you may object.
6. Cookies
The Service sets no cookies on the websites where it is installed, and uses no cross-site identifiers.
This website (nurevo.jp) stores your language preference and, if you have run the site diagnostic, which page variant you were shown. These are held in your browser's local storage, are not transmitted as cookies, and are not used to identify you.
7. Where your data goes
We use the following sub-processors:
| Cloudflare, Inc. | Hosting, storage and content delivery. Data may be processed in facilities outside your country. |
|---|---|
| Stripe, Inc. | Payment processing for paid plans. Card details are collected directly by Stripe; we never receive or hold them. |
Where personal data is transferred out of the European Economic Area or the United Kingdom, that transfer relies on the European Commission's Standard Contractual Clauses, together with the UK Addendum where applicable. Both sub-processors named above maintain such arrangements. Given the categories of data described in section 2, the volume of personal data involved in these transfers is minimal.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
8. How we protect it
Data is transmitted over TLS and stored on infrastructure operated by the sub-processors named above. Administrative interfaces require authentication. Sanitisation of validation messages is applied in the browser and again on the server, so that a failure in one does not result in disclosure.
9. How long we keep it
| Form structure and outcomes | 24 months from collection, after which records are deleted or irreversibly aggregated |
|---|---|
| Aggregated learning | Retained while the Service operates. This data describes patterns across many sites and does not identify individuals. |
| Account details | For the duration of your account, and 12 months thereafter |
| Billing records | 7 years, as required by tax law |
10. Your rights
Depending on where you live, you may have the right to obtain a copy of your personal data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent where consent is the basis for processing.
If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your supervisory authority.
If you are a California resident, you have the right to know what is collected, to request deletion or correction, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA, so no opt-out is required. We will not discriminate against you for exercising any right.
To exercise any of these rights, write to tsuyoshi.hashimoto@exitsign.jp. We respond within one month. If your request concerns data collected on a website that installed Nurevo, we may need to direct you to that site's operator, who is the controller for it.
11. Children
The Service is provided to website operators, not to consumers, and is not directed at children. We do not knowingly collect personal data from children.
12. Changes
If we change this policy we will post the revised version here with a new date. Where a change materially affects how we handle your data, we will email the address on your account before it takes effect.