Privacy notice.

1. Who this covers

This notice applies to visitors of the public site and enrolled users of the authenticated workspace at nurlab.pro.

2. Data we process

• Account data — username, password verifier, TOTP secret material (protected), role, recovery-code state.
• Case data — titles, sharing permissions, job metadata, sanitized reports, authorization references.
• Artifacts — encrypted wallet backups and inspection metadata after intake.
• Security telemetry — audit events, session identifiers, rate-limit counters, approximate request metadata needed to protect the service.
• Provider configuration — encrypted API credentials managed by owners (never displayed back in clear text).
• Public site — standard HTTPS logs and security headers; marketing pages do not require an account.

3. Secrets and sensitive material

Wallet passwords and private keys are used for ephemeral recovery operations where features allow. Export flows are designed for one-time reveal. Do not email secrets. Audit logs should record actions, not raw key material. You remain responsible for what you upload.

4. Why we process data

• Authenticate users and enforce MFA
• Operate cases, research, and recovery tooling
• Maintain security, audit integrity, and abuse prevention
• Meet owner-configured retention and backup policies

5. Sharing

We do not sell personal data. Data may be processed by infrastructure strictly required to run the lab (for example database, encrypted backup destinations, or approved chain-data providers you enable). Case sharing exposes case content only to users you authorize.

6. Cookies and sessions

Authenticated use relies on secure session cookies (Secure, HttpOnly, SameSite). See Cookies for detail. Theme preference may be stored locally in your browser.

7. Retention

Artifact retention is configurable within policy bounds. Audit history is append-oriented for security. Session and rate-limit data expire according to configuration. Deleted artifacts are removed from active storage; audit records of the deletion remain.

8. Security measures

Encryption at rest for artifacts, MFA, reauthentication windows, role scoping, CSP and transport security on the public origin, and fail-closed runtime gates. No measure is perfect — report suspected incidents via Contact.

9. Your choices

Request access changes through your administrator. Use account recovery for factor loss. Ask the owner about deletion or retention of case material you are authorized to manage. Public visitors can stop browsing at any time.

10. International notes

The product UI displays times in Asia/Dhaka. Infrastructure location follows the operator’s deployment. If additional regional privacy rights apply to you, contact the workspace operator with a clear request that does not include wallet secrets.

11. Changes

Updates will be posted on this page with a revised date.