NURAI VISIBILITY / PRIVACY
PRIVACY NOTICE

Your information, plainly.

This notice covers discovernur.com. It was last updated on 12 October 2026. Questions or requests: contact@discovernur.com.

What we collect

The starting score

When the score page is open, it works in two steps. Using it is your choice; without your details no check is made.

AI assistants and automated visitors

When an AI assistant or another automated program opens a page of this site, we record that visit: the page, the kind of program and the time. The links we give some assistants carry a short code, so that its requests can be read as one visit; if one of those links is opened later, we record that it was followed, with the page and the code.

If you open a link carrying one of these codes, we store the code in a cookie in your browser for up to 30 days. If the address or the referring site names one of a fixed list of AI assistants, we store that name in the same way. We also record each such opening of a page: the page, the assistant’s name and the time. That record holds no IP address, user agent, cookie value or identifier. The marker is not proof that a person came from that assistant: anyone can add it to an address, and an automated request that does not name itself can be counted this way. Reloading an address that still carries the marker can add another record. When a link with a code is opened, a cookie that lasts ten seconds helps us avoid counting the same arrival twice. Records of opened links and of such arrivals are deleted once they are 60 days old. If you later send us a demo or visibility-check form, the email we receive may include those markers and, where the code matches our record, the assistant fetcher recorded for it, whether its identity was verified, when it came, which of our pages it requested, and a guess about the kind of question from those pages. Where the code came from a link in a result of the tools described below, the email may include the tool calls recorded with it: the name the calling program gave for itself, when it called, and the pages it asked for and the words it searched for in the two minutes before. Where the calling program keeps no session, that two-minute group is made of calls with the same program name, user agent and provider marker, and may include calls made for another user of the same assistant. If no code can be matched but an assistant’s name was stored, the email may instead list up to 12 of our pages that that assistant’s fetchers requested in the 30 minutes before, how recently, and whether their identity was verified; that is a match in time only, nothing connects those requests to you, and no guess is made from them. We separately count that a request came this way; that count holds the kind of request, the code and the assistant’s name, and not your name, your email or anything you wrote.

We also count page openings in groups by minute and page: how the visit began (for example, from a link on another site or typed in), the kind of device and whether the browser’s language is English or Hebrew. These are counts only; nothing identifies you or links one page to another. We use them to tell visits that AI assistants send apart from other visits.

This site also offers its public pages to AI assistants through tools: an MCP server and a small API. When one of them is called we record the call: the time, which of the two was used, the request method and protocol version, the tool, the page asked for or the words searched for (up to 200 characters), a random identifier for the connection when the calling program’s protocol uses one, the name, version and user agent the calling program gives for itself, and the name of the AI provider when its address is in a range that provider publishes. Words searched for may be words you gave your assistant. When the MCP server returns a page, or a search that found something, the links to our pages in that result are short links of this site (discovernur.com/api/go/…) that hold one short code of the kind described above and forward to the page; the API returns no such links. Our pages also offer the same tools, and the demo form as a tool, to an AI agent working in your own browser, in browsers that support this (WebMCP). In other browsers the script sends nothing and no record is made. When such an agent calls a tool we record the tool and the page asked for or the words searched for, with a random identifier that the page makes for that one page view and keeps only in that page’s memory; for the form we record only that an agent started, cancelled or sent it, and the email we receive from a form sent that way says so. Your browser’s user agent is not kept in these records. These records hold no IP address and are deleted once they are 30 days old.

A browser operated by an AI assistant, or another automated browser, is given a cookie containing a random identifier, so that we can recognise the same browser as returning, and that identifier is recorded with its page visits. We give it to a browser that proves by a signature that it is an assistant’s own (today, ChatGPT’s), to one that names itself as the Claude app’s built-in browser or as a headless browser (which may be an assistant’s or another automated tool), and to one that the check described below judges to be automated. That check is a judgement and can be wrong about a person: if it is, your later page visits on this site are recorded with the identifier, as an automated browser’s. Deleting the cookie stops later visits from being linked to it; it does not delete what was already recorded. The cookie expires 30 days after it is first set and is not renewed. It contains no name or account identifier and does not tell us which person or account used the browser. The notes of that check, and visits recorded only because a browser returned this cookie, are deleted 30 days after they are recorded. Visits of browsers that sign or name themselves are kept with our other records of automated visits, for which we have not set a time limit.

Some automated browsers look exactly like a person’s. To notice them, each page runs a check in your browser. It looks at the first three mouse clicks on links and controls and at typing, for five things: whether a click landed on the exact centre of the link or control, whether the pointer had moved before it, whether the click’s position on the screen was the same as its position in the browser’s viewport, whether the page was visible at the time, and whether text arrived without key presses or faster than keys can be pressed. Unless a click on the exact centre comes together with one of the last three, nothing is sent. When it does, the page sends us the path of the page (the part of the address after the site’s name), the names of the signs it saw and the code from the address if there is one, and nothing else: not what you typed or clicked, not positions or timings, and nothing about your device. We record this as an automation-like visit. It is a guess, it can be wrong, and it is never treated as a person’s identity. These notes are deleted after 30 days.

The records of automated visits and the count of requests hold no IP address, name, email or text you wrote; the records of tool calls hold the technical details listed above and the page asked for or up to 200 characters of the words searched for. What a calling program sends in those may itself contain personal information; we keep no IP address and no separate record of who a person is. When you send a form from a browser that carries one of the cookies above, the visit information described there reaches us in the same email as the details you submit.

Analytics and cookies

Google Analytics is provided by Google, which processes this information on our behalf and may store it outside Israel. You can block or delete the cookies in your browser settings, or install Google’s opt-out add-on (tools.google.com/dlpage/gaoptout). The site works the same without them.

Who processes it

The site is hosted by Vercel. Demo requests and the starting score’s messages are delivered by email through Resend. The records of automated visits and of starting-score requests are stored for us by Supabase. The brand name of a starting-score request is looked up on Wikidata and Wikipedia, which are run by the Wikimedia Foundation, and the website’s address is given to Ora (ora.ai) for its score of the site. The starting score’s questions are answered by OpenAI, Google and Perplexity, and the answers are read by Anthropic; they receive the questions, and the reading step receives the brand name and website, but not your email address. Site analytics are processed by Google (Google Analytics). We do not sell or share your information for marketing.

Accounts in Periscope, and payments

When you use Periscope, NUR AI's app, we keep your email address (it is how you sign in), the workspaces you belong to and what you enter for your brands. Payments are made to Paddle.com, our Merchant of Record: Paddle collects your card and billing details under its own privacy notice, and tells us your plan, its status and the country for tax, never your card number. Account data is stored for us by Supabase.

How long we keep it

Demo requests are kept for up to 12 months after our last contact with you, then deleted, unless you become a client.

Your rights

You may ask to see, correct or delete the information we hold about you by writing to contact@discovernur.com. You may also contact the Israeli Privacy Protection Authority.

The recorded answers on our homepage

The answers in the console were recorded by NUR AI from the named AI services, as described on each answer. Brand names in them are the services’ own output and belong to their owners.