Privacy Policy

We may collect:

• First and last name
• Email address
• Telephone number
• Organization or employer
• Job title or professional role
• Business address
• Investor, advisor, employee, contractor, vendor, customer, partner, or other relationship category
• Name and contact details of the person who invited you
• Information provided by the organization you represent

Some of this information may be provided by the person who invites you before you access the Data Room.

We may collect:

• Account identifiers
• Access-link identifiers
• Invitation records
• Authentication tokens
• Password-related account information
• One-time verification codes
• Login and logout times
• Successful and unsuccessful authentication attempts
• Access approvals, denials, expirations, suspensions, and revocations
• Devices and sessions associated with your access
• Records showing that you accepted the Data Room Terms or another agreement

Passwords, when used, should be stored in a protected form rather than as readable text.

When you electronically sign or accept an agreement, we may collect:

• Your legal or typed name
• Your electronic signature
• Signature image or drawing
• Signature date and time
• Email address
• IP address
• Device and browser information
• Document version
• Agreement identifier
• Audit trail
• Authentication and verification events
• Records of your consent to electronic transactions
• Records showing when an agreement was delivered, opened, reviewed, accepted, or signed

We use this information to execute agreements, maintain legal records, authenticate signers, and establish the validity and history of an electronic transaction.

We do not use electronic signatures to infer sensitive characteristics about you.

We may automatically collect:

• Internet Protocol address
• Browser type and version
• Operating system
• Device type
• Device identifiers
• Screen size and display characteristics
• Language and locale
• Time zone
• Network provider
• Referring page
• Pages visited before or after a Data Room page
• Date and time of access
• Connection and response information
• Error logs
• Performance information
• Cookie and local-storage identifiers
• System configuration information

We may infer an approximate city, state, region, or country from your IP address.

IP-based location information is approximate and may be inaccurate, particularly when you use a corporate network, mobile network, proxy, or virtual private network.

We do not intend to collect precise GPS location through the Data Room unless you separately and affirmatively choose to provide it.

We may collect detailed information regarding how you interact with the Data Room, including:

• Whether you opened or viewed a file
• Which file, folder, or section you opened
• Which pages, slides, images, cells, sheets, videos, or portions you viewed
• The order in which you viewed Materials
• Date and time of each view
• Number of views
• Time spent in the Data Room
• Time spent on a particular document or page
• Whether the Data Room was visible or active
• Scrolling activity
• Clicks and taps
• Pointer or cursor movement
• Navigation activity
• Search activity
• Zoom or display activity
• Video play, pause, completion, and playback position
• Links or controls selected
• Documents marked as viewed
• Progress through a recommended review sequence
• Errors or interruptions occurring during viewing
• Attempts to access unavailable or restricted Materials

This information may be associated with your name, email address, organization, IP address, device, session, and watermark identifier.

We may use session-replay or similar technologies to reconstruct how a recipient interacted with the Data Room.

Depending on the technology and configuration used, session replay may record or recreate:

• Page navigation
• Document changes
• Pointer movement
• Clicks
• Taps
• Scrolling
• Page visibility
• Interface interactions
• Error events
• Security warnings
• Time spent on particular screens
• Attempts to use restricted controls

Session replay is limited to activity occurring within the Data Room or its associated interfaces.

We do not intend to record:

• Activity in unrelated browser tabs
• Activity in unrelated applications
• The contents of your email account
• The contents of files stored elsewhere on your device
• Password text
• Payment-card information
• Other information outside the Data Room

Fields containing passwords or similarly sensitive authentication information should be excluded or masked from replay tools.

We may collect information about actual or attempted actions involving:

• Printing
• Downloading
• Saving
• Copying
• Pasting
• Text selection
• Screenshots
• Screen recording
• Browser developer tools
• Restricted keyboard shortcuts
• Window switching
• Tab visibility
• Screen-sharing indicators
• Browser extensions
• Automated scripts
• Scraping
• Unusual request patterns
• Repeated authentication failures
• Attempts to modify or avoid a watermark
• Attempts to bypass access restrictions
• Attempts to access unapproved files, endpoints, or accounts
• Other activity that may indicate unauthorized capture or misuse

A security event does not necessarily mean that you successfully performed the associated action.

We may combine these events with other information to investigate potential violations of our Data Room Terms or a nondisclosure agreement.

Documents and interfaces may contain visible or invisible markings associated with:

• Your name
• Your email address
• Your organization
• Your IP address
• Date and time
• Session identifier
• Access-link identifier
• Document identifier
• Page identifier
• Unique forensic token

We may retain records linking a watermark or token to the recipient, session, and document view for the purpose of identifying the source of an unauthorized disclosure.

A watermark does not necessarily establish conclusively that a particular person caused a disclosure. It is one source of evidence that may be considered alongside access logs and other information.

We collect information when you communicate with us, including:

• Emails
• Support requests
• Questions
• Feedback
• Meeting scheduling information
• Call notes
• Demonstration requests
• Messages submitted through the Data Room
• Reports of suspected security issues
• Privacy requests
• Legal notices
• Communications concerning a potential transaction or relationship

We may collect information relating to a potential:

• Investment
• Financing
• Partnership
• Customer relationship
• Vendor relationship
• Employment relationship
• Advisory relationship
• Acquisition
• Sale
• Licensing arrangement
• Strategic relationship
• Other business transaction

This may include your professional interests, diligence questions, document requests, meeting history, relationship status, investment focus, and communications with Nurvia.

We collect information that you voluntarily provide through:

• Forms
• Questionnaires
• Signature fields
• Access requests
• Document requests
• Feedback fields
• Messages
• Uploaded materials
• Email communications

Please do not submit sensitive personal information that is not necessary for the purpose of your interaction with Nurvia.

We may use:

• Cookies
• Local storage
• Session storage
• Pixels
• Software development kits
• Log files
• Device identifiers
• Similar technologies

These technologies may be used to:

• Keep you signed in
• Authenticate your session
• Remember preferences
• Prevent fraud and unauthorized access
• Apply access permissions
• Generate document analytics
• Support session replay
• Identify security events
• Diagnose technical problems
• Measure performance
• Improve the Data Room

Where applicable law requires consent before using a non-essential technology, we will request consent before activating that technology.

Refusing certain technologies may prevent us from authenticating you or providing access to secured Materials.

This includes information you enter, submit, sign, communicate, or generate through your interaction with the Data Room.

A founder, employee, advisor, administrator, investor, partner, or other authorized person may provide your name, email address, company, role, or other access-related information.

We automatically receive technical, security, access, and usage information when your device connects to the Data Room.

Authentication, hosting, email, security, analytics, session-replay, database, electronic-signature, and infrastructure providers may generate or return information necessary to operate the Data Room.

When reasonably necessary to verify a business identity or relationship, we may obtain limited professional information from:

• Company websites
• Professional networking profiles
• Public business records
• Publicly available investment information
• Publicly available professional directories

We do not use the Data Room to build consumer advertising profiles.

We use information to:

• Create and administer access
• Deliver invitations
• Authenticate recipients
• Display authorized Materials
• Apply access permissions
• Process access requests
• Maintain sessions
• Provide technical support
• Communicate about access

We use information to:

• Prevent unauthorized access
• Detect credential sharing
• Identify suspicious activity
• Apply document restrictions
• Generate watermarks
• Attribute unauthorized disclosures
• Investigate suspected copying or capture
• Protect trade secrets and confidential Materials
• Enforce nondisclosure agreements and Data Room Terms

We may use viewing and interaction information to understand:

• Whether Materials were opened
• Which Materials received attention
• How long a recipient reviewed particular information
• Whether a recipient completed a recommended review sequence
• Which parts of a document were viewed
• Whether follow-up may be appropriate
• The general level of interest in a potential relationship or transaction

These analytics may be reviewed by authorized Nurvia founders, employees, advisors, legal counsel, or administrators.

We do not use document engagement analytics as the sole basis for making a legally significant decision about an individual.

We use electronic-signature and consent information to:

• Deliver agreements
• Obtain signatures
• Verify acceptance
• Maintain audit records
• Establish agreement history
• Enforce contractual rights
• Respond to disputes
• Meet recordkeeping obligations

We may use your information to:

• Respond to questions
• Schedule meetings
• Send requested information
• Provide security notices
• Communicate changes to access
• Provide administrative messages
• Follow up concerning a potential transaction or relationship
• Respond to privacy and legal requests

We use information to:

• Diagnose errors
• Monitor availability
• Improve performance
• Test features
• Understand how interfaces are used
• Fix technical problems
• Improve document organization
• Develop security controls
• Maintain internal records

We may process information to:

• Comply with legal obligations
• Respond to lawful process
• Establish, exercise, or defend legal claims
• Enforce contracts
• Protect Nurvia, recipients, and third parties
• Investigate fraud or unlawful conduct
• Cooperate with regulators and law enforcement
• Maintain records required by law

We may use or disclose information in connection with:

• Financing
• Due diligence
• Merger
• Acquisition
• Reorganization
• Sale of assets
• Bankruptcy
• Change of control
• Similar corporate transaction

Any recipient of personal information in such a transaction will be expected to handle it consistently with applicable law.

We process information when necessary to provide requested Data Room access, execute an agreement, or administer our contractual relationship with you.

We may process information to evaluate or discuss a potential investment, partnership, employment relationship, acquisition, customer relationship, or other transaction at your request or the request of the organization you represent.

We may process information based on our legitimate interests in:

• Protecting confidential information
• Securing the Data Room
• Preventing fraud and unauthorized access
• Understanding engagement with Materials
• Managing potential business relationships
• Maintaining evidence of access and consent
• Improving Data Room performance
• Protecting our legal rights
• Establishing, exercising, or defending claims

We consider the nature of the information, the purposes of processing, the risks to individuals, and reasonable expectations when relying on legitimate interests.

We may rely on consent for:

• Non-essential cookies or tracking technologies where required
• Optional marketing communications
• Specific information you voluntarily choose to provide
• Other processing for which consent is legally required

You may withdraw consent at any time. Withdrawal does not affect processing that occurred before withdrawal.

We may process information when necessary to comply with applicable law, court orders, regulatory requirements, tax obligations, or valid legal process.

In rare situations, we may process information where necessary to protect a person’s life or physical safety.

Authorized founders, employees, contractors, advisors, and administrators may access personal information when necessary to:

• Operate the Data Room
• Review recipient engagement
• Manage a potential transaction
• Respond to questions
• Investigate security activity
• Enforce agreements
• Maintain legal and business records

Access should be limited to people with a legitimate need to know.

We may disclose information to providers supporting:

• Cloud hosting
• Content delivery
• Database services
• Authentication
• Email delivery
• Electronic signatures
• Security monitoring
• Session replay
• Product analytics
• Error monitoring
• Customer support
• Communication services
• Document processing
• Legal compliance
• Backup and storage
• IT administration

These providers may process personal information only as needed to perform services for Nurvia, subject to contractual and legal obligations.

We may disclose information to:

• Attorneys
• Accountants
• Auditors
• Insurers
• Bankers
• Financial advisors
• Security consultants
• Other professional advisors

Disclosure is limited to what is reasonably necessary for their services.

Information may be disclosed to prospective or actual investors, lenders, purchasers, successors, or transaction advisors in connection with a corporate transaction, subject to appropriate confidentiality protections where applicable.

We may disclose information when we believe in good faith that disclosure is reasonably necessary to:

• Comply with law
• Respond to a subpoena, court order, or compulsory request
• Respond to a regulator
• Investigate unlawful activity
• Protect a person’s safety
• Prevent fraud
• Protect Nurvia’s rights or property
• Enforce an agreement
• Defend against a legal claim

Where legally permitted and appropriate, we may provide notice before disclosing information in response to compulsory legal process.

We may disclose information when you direct us to do so or provide consent.

Depending on your interaction with the Data Room, we may have collected:

Identifiers

Examples include name, email address, IP address, account identifier, access-link identifier, authentication information, and electronic-signature records.

Personal information described by California Civil Code Section 1798.80

Examples may include name, address, telephone number, employment information, and electronic signature.

Commercial and professional information

Examples include your organization, job title, professional relationship, investment interest, diligence activity, and potential transaction information.

Internet or electronic-network activity

Examples include browsing activity, document views, pages viewed, clicks, scrolling, pointer movement, session duration, session replay, and security events.

Geolocation information

This generally consists of approximate location inferred from your IP address.

Audio, electronic, visual, or similar information

This may include signature images, uploaded materials, communications, video engagement information, and session-replay representations.

Professional or employment-related information

Examples include your company, professional role, title, and business relationship.

Inferences

We may infer a recipient’s general level of engagement or interest based on Data Room activity.

We do not use those inferences for cross-context behavioral advertising.

Sensitive personal information

Depending on how the Data Room is configured, this may include account login credentials or information used to authenticate access.

We use sensitive personal information only for providing and securing the Data Room, authenticating recipients, preventing misuse, and other legally permitted purposes.

We collect these categories from:

• You
• The person or organization inviting you
• Your device and browser
• Nurvia systems
• Service providers
• Limited public professional sources

We use these categories to:

• Provide access
• Authenticate users
• Protect confidential information
• Measure document engagement
• Administer electronic agreements
• Communicate with recipients
• Prevent fraud and security incidents
• Improve the Data Room
• Comply with law
• Establish and defend legal rights

We may disclose the categories described above to:

• Cloud and infrastructure providers
• Authentication providers
• Security providers
• Analytics and session-replay providers
• Electronic-signature providers
• Email and communication providers
• Professional advisors
• Other contractors providing services to Nurvia

During the preceding 12 months, Nurvia has not sold personal information collected through the Data Room.

During the preceding 12 months, Nurvia has not shared Data Room personal information for cross-context behavioral advertising.

Subject to applicable exceptions, California residents may have the right to:

• Know the categories and specific pieces of personal information collected
• Know the categories of sources
• Know the purposes for collection, use, or disclosure
• Know the categories of recipients
• Delete personal information
• Correct inaccurate personal information
• Opt out of sale or sharing
• Limit certain uses of sensitive personal information
• Receive equal treatment when exercising privacy rights

Because Nurvia does not sell or share Data Room personal information for cross-context behavioral advertising, an opt-out of sale or sharing is not ordinarily necessary for Data Room processing.

We do not use sensitive personal information for purposes that require a separate right-to-limit mechanism, unless otherwise disclosed at collection.