Privacy Policy
This policy explains what personal data Nubilux processes, why we do it, who we share it with, and what rights you have.
In short: We collect what is needed to show your family's overview on a screen in your home. We never sell information about you. You can download everything we hold about you at any time, or delete your account yourself.
Who is responsible
The controller is Visbiz AS, the company that provides the Nubilux service.
- Company registration number: 998 359 139
- Postal address: Håbamyrå 26, 4325 Sandnes, Norway
- Privacy contact: privacy@nubilux.com
- General contact: support@nubilux.com
- Company email: post@visbiz.no
We have not appointed a data protection officer. You can always contact us directly at the address above.
A screen in the home shows data about more than you
Nubilux is made to hang on a wall. That means the content is visible to everyone in the room — including visitors, and including family members who do not have an account of their own.
Please think this through before entering information about other people:
- If you connect a calendar, the events are visible to everyone who sees the screen.
- If you add a family member without their own account, you are the one who entered the information about them, and you should have told them.
- You decide which modules appear on which screen.
What data we process
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored as a hash), phone number, date of birth | You |
| Household | Address, land registry data, coordinates, members and their roles | You |
| Calendar | Events with title, time and location | Google Calendar, CalDAV or iCal, when you connect them |
| Travel | Origin and destination, routes, departure times | You, plus Google and Entur |
| Screens | Device id, last contact, screen name, IP address | The screen itself |
| Lighting | Names and on/off status of lights | Philips Hue, when you connect it |
| Images | Images you upload for art mode or your own designs | You |
| Usage and errors | Request id, error messages, IP address | The system |
| AI feature | Prompt, generated code, job status | You |
| Audit trail | Administrative actions and security events | The system |
We do not intentionally process special categories of personal data. A calendar event may still reveal, for example, a medical appointment. That is why calendar content is something you choose to connect, and can disconnect again at any time.
Why we process it, and on what basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account | Contract, Article 6(1)(b) |
| Showing the modules you have chosen on your screens | Contract |
| Connecting a calendar, Hue or other external services | Consent, Article 6(1)(a) — withdrawn by disconnecting |
| Using the AI feature | Consent — see the separate AI document |
| Security logging and abuse prevention | Legitimate interests, Article 6(1)(f) |
| Invoicing and accounting | Legal obligation, Article 6(1)(c) |
Where the basis is legitimate interests, the interest is being able to detect intrusion, abuse and faults. We have assessed that this does not override your privacy, because the logs are short-lived, access is limited to operations, and the content is reduced to what is needed to understand an event.
Who we share with
We never sell personal data, and we do not use it for advertising.
We use sub-processors who process data on our behalf. Who they are, what they receive and where they are located is set out in a separate document: Sub-processors.
Some of them are outside the EEA. For these, the transfer relies on the European Commission's standard contractual clauses or on an adequacy decision. You may ask which basis applies to a particular provider.
When you connect Google Calendar
- We ask for read-only access to your calendars only when you press “Connect Google” in Studio, and only if you tick it at Google. We cannot change, create or delete anything in your Google calendar.
- We fetch only the calendars you choose, and only events from one month back to six months ahead. They are shown on the screens in your household, as you have chosen.
- The access is stored encrypted and used for this purpose only. We do not use data from Google for advertising, profiling or training AI models, and we do not pass it on, except to the sub-processors who run the service.
- When you disconnect, we revoke the access at Google and delete the Google calendars and their events from Nubilux. The same happens when your account is deleted. You can also revoke the access yourself at myaccount.google.com/permissions.
- Nubilux's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How long we keep it
| Type | Retention |
|---|---|
| Your account and content | For as long as the account exists |
| Events from Google Calendar | For as long as the calendar is connected. Deleted when you disconnect |
| Deleted account | Deleted 14 days after you request it. Logging in during that period cancels the deletion |
| Answers from the AI feature | 1 hour, then deleted automatically |
| Prompts sent to the AI feature | Not stored by us |
| Application log | Roughly 1–2 days |
| Web server access log | Up to roughly 37 days |
| Audit trail of administrative actions | Retained, but disconnected from you when the account is deleted |
| Backups | Encrypted, with a limited rotation period |
Your rights
You have the right of access, rectification, erasure, restriction, data portability, and to object to the processing. You may also withdraw consent, without affecting the lawfulness of processing before you withdrew it.
Two of these you can exercise yourself, without waiting for us:
- Access and portability: Under "My profile" you will find "Your data". There you download everything we hold about you, as a JSON file.
- Erasure: In the same place you will find account deletion. Deletion is confirmed by email, and you have a 14-day grace period.
For the other rights, contact privacy@nubilux.com. We respond within one month.
There are two limits in the export that we have set deliberately, and you should know about them:
- Keys and access tokens are not disclosed. An access token to your Google account is not information about you, it is access to your account. The export states that we hold it, but not what it is.
- Other people's content is not included. A calendar event written by another household member is theirs. Article 15(4) states that a copy shall not adversely affect the rights of others.
Your activity log is included up to the 5,000 most recent lines. If it is truncated, the file says so — we do not want you to believe the file is complete when it is not.
Complaints
If you disagree with how we handle information about you, we would like to hear it first, at privacy@nubilux.com.
You always have the right to lodge a complaint with the Norwegian Data Protection Authority, Postboks 458 Sentrum, 0105 Oslo, datatilsynet.no.
Children
Nubilux is made for families, and a child may be registered as a household member without having their own login. The account is created by an adult, who is responsible for the information entered about others in the household.
If you are a parent and want information about your child removed, contact us and we will do it.
Security
- Passwords are stored as hashes, never in plain text.
- Traffic is encrypted over HTTPS.
- Tokens for external services are stored encrypted.
- Single-use links, such as password resets, are stored as digests and are valid for one hour.
- Access to the production environment is restricted and logged.
No protection is absolute. If we discover a breach that poses a risk to you, we notify the Data Protection Authority within 72 hours, and you directly when the risk is high.
Cookies
We only use cookies that are necessary for the service to work. We have no tracking and no advertising cookies. Details are in Cookies.
Changes
We may change this policy. If a change is material, you will have to accept the new version the next time you log in, and you can read what has changed before you accept.
