Privacy Policy

Nurlux McpHub ("the Service") is a private gateway that lets the AI agents you choose, such as Claude Code, Codex or Cursor, use tools and data sources you connect to it. The Service is operated by Nurlux ("we", "us"), based in Istanbul, Türkiye. Access is by invitation only, and the Service runs on a private network that is not reachable from the public internet.

This policy explains what information the Service handles, why, how it is protected, and the choices you have. It applies to the Service and to this website.

Effective date: September 23, 2026.

Information we collect

Account information: your name, email address, a hashed password, your two-step verification settings and your sign-in sessions.

Device information: the name and identifier of each device you enroll on the private network, and the network address it connects from, so that access can be tied to your own devices.

Activity records: for each request an AI agent makes, the time, the account and device, the connection and tool used, and whether it was allowed or blocked. Activity records never contain passwords, tokens, secret values or the contents of the request.

Connection credentials: the API keys and access tokens you provide so the Service can reach a connected tool on your behalf. They are stored encrypted and are never shown back in the interface.

Website analytics: this website uses Cloudflare Web Analytics to count visits and measure page performance. It does not use cookies, does not track you across other sites and does not collect personal information. It records anonymous details such as the page visited, the referring site, your browser and device type, your country and page load times. This website has no advertising trackers.

Information from Google

If you connect a Google account, you choose which Google product to connect and whether to grant read-only or full access. Depending on your choice, the Service may access:

• Google Search Console: your sites, search performance, URL inspection and sitemaps;
• Google Analytics and Tag Manager: your accounts, properties, reports and configuration;
• Google Sheets, Docs and Forms: the files you open or create through the Service, and their content and responses;
• your Google account email address, to show which account is linked.

This data is only retrieved when you, or an AI agent you have authorized, asks for it, and it is returned to that agent to complete your request. We do not keep copies of your Google data beyond what is needed to complete a request, apart from the list of available sites, properties and files, which is saved so you can manage access.

Nurlux McpHub's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:

• use Google data only to provide the features you request in the Service;
• do not sell Google data or use it for advertising;
• do not use Google data to develop, improve or train generalized artificial intelligence or machine learning models;
• do not allow people to read Google data unless you give permission, it is needed for security or to comply with the law.

How we use information

We use the information above to run the Service: to sign you in, verify your devices, decide whether each request is allowed, carry out the requests you and your agents make, show you an activity history, keep the Service secure, and respond to you when you contact us.

Sharing

We do not sell personal information. Data from a connected tool is sent only to the AI agent that you or your team authorized to request it. We use a small number of providers to operate the Service, such as the server host, Cloudflare for website delivery, security and privacy-friendly analytics, the private networking provider and encrypted backup storage. They process data only on our behalf. We may disclose information if required by law.

Security

The Service is reachable only from devices on its private network. Sign-in requires two-step verification. Credentials and tokens are encrypted at rest with AES-256-GCM, backups are encrypted before they leave the server, and every request is checked against the permissions of the account and device that made it.

Retention and deletion

Activity records are kept for 180 days by default and then deleted automatically. Expired or revoked sign-in tokens are removed after 30 days. When you disconnect a connection, its stored credentials are deleted and, for Google, the access token is revoked with Google. When an account is removed, its sessions and tokens are deleted.

You can ask us to access, correct or delete your information at any time by writing to the address below.

Your choices

You can disconnect any connection from the Service at any time. You can also remove the Service's access to your Google account from your Google Account permissions page.

Children

The Service is intended for businesses and is not directed to children under 16.

Changes

We will post any changes to this policy on this page and update the effective date above.

Contact

Questions or requests: [email protected].