Privacy Policy
Last updated: July 30, 2026
Introduction
At NourLabs, protecting your personal data is a core commitment. When you use NourForm, NourLMS, or our other products, you're trusting us with information that matters.
This policy applies to NourLabs, a software company registered in Niamey, Niger, and to all of its products — currently NourForm (in production) and NourLMS (in development), as well as any future NourLabs product. It clearly describes the data we collect, why we use it, who it may be shared with, how long we keep it, and how you can stay in control.
The rules below apply to all NourLabs products. Where a point differs or is added for a specific product, a "Specific to [Product]" note is added as a bullet in the relevant section.
In short
- We do not sell your personal data.
- We use your data to provide, secure, and improve our products, and to bill you when you're a User Institution.
- Our role changes depending on the product and the data: data controller for your account and billing, technical processor for data you entrust to a User Institution.
- A limited number of providers (hosting, payments, email) process your data, only to the extent needed for their role.
- You can exercise your rights — access, correction, or deletion of your data; we respond within 30 days.
1. Data controller
The data controller is NourLabs, a software company registered in Niamey, Niger (RCCM No. NE-NIM-01-2026-A10-02672 — NIF No. 168960/P). "Processing" means any operation performed on personal data, including its collection, storage, use, analysis, disclosure, or deletion.
NourLabs products are used by institutions ("User Institutions") to interact with their own participants, learners, or clients ("Respondents"). Our role varies depending on the data involved:
| Type of data | NourLabs' role | User Institution's role |
|---|---|---|
| The User Institution's account (name, email, password) on a NourLabs product | Data controller | — |
| Respondent data collected through a NourLabs product (e.g. form responses, course enrollment, learning progress) | Data processor | Data controller |
| NourLabs billing data (subscription, the institution's payment method towards NourLabs) | Data controller | — |
In practice: when a User Institution creates a registration form through NourForm, or enrolls learners on NourLMS, and collects their data, it is the User Institution — not NourLabs — that is the data controller for those individuals. We act as a technical processor, under the terms of our Data Processing Agreement (DPA), signed with each User Institution.
2. Data we collect
2.1 — Data you give us
- Identity and contact details: first and last name, email address, and phone number when a product requires it.
- Account: organization name, legal name, address, logo, and brand color, along with a password stored in hashed form. We do not have access to your password in plain text.
- Content: forms, responses, courses, learning-progress content, and other content that you or your Respondents choose to submit.
- Support: information shared when you contact us, such as a problem description or a screenshot.
2.2 — Data collected as you use our products
- Activity: pages viewed, clicks, searches, forms created or filled in, session duration, and interactions.
- Technical data: device type, operating system, browser, language, IP address, and technical logs related to incidents or performance.
- Security data: login attempts, fraud signals, and technical fingerprints needed to prevent abuse.
2.3 — Payment data
When a product includes a payment, transaction data (mobile money phone number, amount, status) is processed by our payment providers (see section 7). We do not store payment credentials or secret codes.
2.4 — Sensitive data
Our products are not intended to collect sensitive data, such as information about health, political opinions, or religion. We recommend that User Institutions avoid requesting this type of information in their forms or courses, unless there is a clear need and an appropriate legal basis.
2.5 — Product-specific details
- Specific to NourForm: form fields freely chosen by the User Institution (name, phone, email, attached files, or any other data requested).
- Specific to NourLMS: course enrollment data, progress and quiz results, participation in live sessions, certificates issued, course forum content [to be confirmed closer to launch].
3. Where data comes from
- Directly from you: when you create your account, configure a product, or exchange with our support.
- From your usage: as you browse or interact with our products.
- From technical partners: in particular our payment, hosting, or fraud-prevention providers, limited to the information they need.
4. Why we process data
We process your data to:
- create and manage your account, including sign-in, profile, and settings;
- provide the products you use, including creating, publishing, and managing forms or courses, and collecting responses or enrollments;
- process payments related to a product, where that option is enabled;
- respond to your requests and provide support;
- ensure security, prevent fraud, investigate abuse, and protect users;
- improve our products, fix issues, and design new features;
- keep you informed through service notifications, transactional emails (confirmation, receipt, certificate), and security alerts;
- bill the User Institution for its use of NourLabs products.
5. Legal bases
We process your data only when a valid legal basis allows it, in particular:
- performance of the contract, to provide you with the products and features tied to your account;
- our legitimate interest, in particular for security, fraud prevention, and improving our products;
- your consent, for example for certain communications or an optional configuration;
- compliance with a legal obligation, when applicable regulation requires us to retain or disclose certain information.
6. Statistics and improvement
We may analyze how our products are used to produce statistics and understand usage trends. Where possible, we favor aggregated and/or anonymized data.
Example: "the average number of responses per form this month", without naming a specific User Institution or Respondent.
As we develop features based on automation or artificial intelligence — for example, help drafting a form or a course — we will make sure those features rest on an appropriate legal basis, and update this section accordingly.
7. Who we share data with
We do not resell your data.
7.1 — Sub-processors
We rely on the following providers to deliver our products. Each acts as a data processor, limited to the purposes described above, and receives only the information it needs for its role.
| Sub-processor | Role | Data involved | Location |
|---|---|---|---|
| MongoDB Atlas | Database hosting | All data stored by NourForm (accounts, forms, responses) | European Union (configured region) |
| Vercel | Application and public form hosting | Data passing through the web application | European Union / United States (CDN) |
| LigdiCash | Mobile money payment processing | Phone number, amount, transaction status | West Africa (UEMOA) |
| I-Pay | Mobile money and card payment processing | Phone number, amount, transaction status | West Africa (UEMOA) |
| Resend | Transactional emails (confirmations, receipts, response copies) | Email address, transactional email content | United States / European Union |
| Bunny.net | Course video hosting and delivery (NourLMS) | Video files, viewing statistics | European Union (global CDN) |
- Specific to NourLMS: Bunny.net will join the active sub-processors at product launch; the table above already reflects this.
7.2 — Competent authorities
We may disclose data when we receive a legally valid request.
7.3 — Business transfers
In the event of a merger, acquisition, or transfer of all or part of NourLabs' assets, certain data may be transferred as part of that transaction, subject to appropriate confidentiality safeguards.
8. Where data is stored
Your data is hosted on secure servers, located in Niger or other countries depending on our technical providers (see section 7.1). In all cases, we select partners that offer high security standards and govern these transfers with adequate contractual safeguards.
9. Retention periods
- User Institution account: kept for the duration of the contract, then 90 days after it ends.
- Respondent data: kept according to the configuration chosen by the User Institution; by default, 12 months after the relevant form or course is closed or archived.
- Payment transaction data: kept for 5 years, in line with accounting and fraud-prevention obligations. This period is separate from NourLabs' general accounting obligations, which may be longer.
- Security logs: kept for 12 months, then deleted or anonymized.
- Specific to NourLMS — certificates: the certificate record (holder, course, date, identifier) is kept indefinitely, to allow later verification by a third party. The underlying learning activity (quiz answers, forum content) follows the standard Respondent data period above.
Example: when a User Institution closes its account, we delete or anonymize its account data according to the schedule above. Some information may still be kept longer where applicable regulation requires it, in particular as proof of a transaction.
10. Data security
We implement appropriate technical and organizational measures, including:
- encryption, where applicable, and secured connections (HTTPS/TLS);
- restricted access to production data, limited to people who need it;
- selecting sub-processors that offer adequate security guarantees;
- regular audits and improvements.
No system can guarantee absolute security. In the event of a serious incident, we will take the necessary steps to limit its consequences and will inform you in line with the severity of the incident.
11. Protection of minors
Our products are intended for use by institutions and their adult representatives. Some Respondents enrolled by a User Institution — for example, learners on NourLMS — may be minors; in that case, it is up to the User Institution, as data controller, to ensure compliance with the rules applicable to processing minors' data. If we find that a minor's data was collected without an appropriate legal basis, we will inform the User Institution concerned and may delete it.
12. Your rights and how to exercise them
Depending on applicable law, you can:
- access your data;
- have inaccurate or incomplete data corrected;
- request its deletion, where the conditions are met;
- withdraw your consent where processing relies on it;
- object to certain processing or request that it be restricted;
- request portability of your data, where that right applies.
For data processed as part of a product used by a User Institution, these rights are exercised primarily with that Institution, as data controller. For NourLabs account or billing data, these rights are exercised directly with us using the details in the Contact section.
We will respond as soon as possible, and no later than 30 days after receiving your request, except in cases of particular complexity.
Example: to request deletion of your account data, contact us directly. For data you submitted to a User Institution through a NourForm form or a NourLMS course, send your request directly to that Institution.
14. Updates to this policy
We may update this policy to reflect changes to our products or our security practices. The last-updated date appears at the top of this document. In the event of a material change, we will inform User Institutions through an appropriate channel, such as email or a notice on our site.
15. Contact
- Email: privacy@nour-lab.com
- Address: NourLabs, Niamey, Niger
- Online support: https://form.nour-lab.com/f/6a69e88fcc46c2514def4450