Privacy Policy
Who we are
Nurvo is business management software operated by Lunartech Solutions (Private) Limited, a company incorporated in Zimbabwe (registration no. 33123A0222025, registered at 4 Meredith Drive, Eastlea, Harare) ("we", "us"). Contact: sales@nurvo.co.zw.
Controller or processor — who is responsible for what
Under the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe, responsibility depends on whose data it is:
- For your account with us — your name, email, phone number, billing and support correspondence — we are the data controller.
- For the records your business keeps inside Nurvo — your customers, suppliers, employees, payroll and invoices — your business is the data controller and we act only as its data processor: we store and process that data solely on your instructions to provide the service, and we do not use it for our own purposes. Requests from your customers or staff about that data should go to your business; if they reach us, we will pass them to you.
What this website collects
The marketing site at nurvo.co.zw collects no personal information. It sets no cookies, runs no analytics, loads no third-party scripts, fonts or embeds, and has no forms. Our web server keeps standard access logs (IP address, time, page requested) for security and error diagnosis; these are kept only as long as needed for those purposes.
What the Nurvo application collects
When your business signs up for Nurvo, we collect and process:
- Account data — your name, email address, phone number and password (stored hashed), used to create and secure your login.
- Business data you enter — customers, suppliers, products, invoices, payroll and similar records. This data belongs to your business; we process it only to provide the service.
- Fiscalisation data — invoices and receipts your business submits to the Zimbabwe Revenue Authority (ZIMRA) are transmitted to ZIMRA as required by law, signed with your fiscal device certificate.
- Operational logs — sign-ins and key actions, kept for security and audit.
We collect only what is necessary to run the service. We do not sell personal information, and we do not use your business data for advertising.
Legal basis and purpose
We process personal information to perform our contract with your business, to comply with legal obligations (including tax law and fiscalisation requirements), and for our legitimate interest in keeping the service secure and reliable.
Who we share it with
- ZIMRA — fiscalised documents, as the law requires.
- Service providers — hosting and email delivery providers who process data on our instructions and only to run the service.
- Meta (WhatsApp Business) — if your business enables WhatsApp commerce or messaging, customer phone numbers, names, order contents and delivery details pass through the WhatsApp Cloud API to deliver those conversations.
- AI providers — if your business enables AI-assisted features (tender reading, email-to-quote extraction, product classification), the documents or messages you submit to those features are processed by the AI provider your business selects (Anthropic, OpenAI, Google or DeepSeek). These features are off until a business configures them with its own provider account.
- Mapping services — delivery addresses are geocoded via Google Maps (your business's own key) or OpenStreetMap/Nominatim to price and route deliveries.
- Couriers — if your business connects a courier, the delivery address, receiver name and phone number are sent to that courier to fulfil the delivery.
- Payment providers — payment amounts and references are exchanged with Paynow when your business takes online payments.
- Authorities — where the law compels disclosure.
We do not share personal information with anyone else. Except for ZIMRA and legal disclosure, every recipient above is optional and applies only when your business switches that feature on.
Your rights
For data we control (your account with us), you may ask us to confirm what personal information we hold about you, to correct it, to delete it where we have no legal duty to keep it, or to object to its processing. Email sales@nurvo.co.zw and we will respond within a reasonable time. You may also lodge a complaint with the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the designated Data Protection Authority. For records held inside a business's Nurvo system, direct your request to that business — it is the controller of that data.
Security and retention
Data is encrypted in transit (HTTPS), access is role-based, and databases are firewalled to private networks. Account and business records are kept for as long as your subscription is active and thereafter only as long as tax and company law require (generally six years for accounting records in Zimbabwe), after which they are deleted.
Consent in forms
Where a form in the application collects personal information beyond what the contract requires (for example marketing preferences), it will say so at the point of collection and will not be pre-ticked. Registration requires acceptance of our Terms of Service.
Changes
If we change this policy we will update the date above; material changes will be notified inside the application.