Last updated: July 1, 2021

This Privacy Policy describes how Nuro handles personal information in connection with our business practices, including our delivery services, websites, mobile applications, retail partner programs (collectively, the “Services”), and when you otherwise interact with us. Please also read our Terms of Service which are incorporated herein. By using our Services, you consent to this Privacy Policy.

Information We Collect

The types of information that Nuro collects includes, but is not limited to, the following categories below. We receive this information from consumers who provide this information directly to us (including through their interaction with our products and services), our retail partners, and in some cases, certain service providers we work with.

● Contact Information such as your full name, email address, phone number, and physical address for example when you sign up for our delivery service or when a retail partner provides this information to Nuro so that we can provide our Services

● Demographic Information such as your gender, age and date of birth, for example, to tailor our Services to you and to verify your age for certain age-restricted deliveries

● Order Details and History such as items, quantities, delivery preferences, instructions, pickup and delivery times to provide our Services and optimize them for your benefit

● Loyalty Card Information to apply discounts or earn rewards to your order

● Device Information such as geolocation, if you allow us access to your location through your device permissions, to provide our Services to you at a convenient location. If you choose not to provide us access to your location, we will deliver based on your provided delivery address, which in some cases (such as a large apartment complex) may be further from your device’s location. Most devices allow you to deactivate location sharing in the settings menu; please contact your device manufacturer if you would like more information on how to control location sharing.

If you order through one of our retail partners, they may share with us, and we may collect, your information pursuant to this Privacy Policy to deliver your goods and otherwise to develop and improve our Services. The privacy policies of our retail partners govern how and under what circumstances they will share data with us. If you are ordering through our retailer partners’ website or applications, you may wish to review their privacy policy to understand how they use and share your data.

Information We Collect Automatically

As is true of most websites and applications, Nuro’s website and mobile application collect certain information automatically and store it in log files for security, maintenance, and analytics purposes, or otherwise to develop and improve our Services. This information may include, but is not limited to:

● Internet protocol (IP) addresses,

● The region or general location where your computer or device is accessing the internet,

● Browser type, operating system and other usage information about the use of Nuro’s website and mobile application, including a history of which pages within Nuro’s website you view.

● Sensor Information. Nuro is developing a service to provide deliveries using autonomous vehicles. Nuro’s autonomous and mapping vehicles use sensing systems, including cameras and microphones, to perceive objects and environmental conditions, enabling safe operation. The vehicles “see” and “hear” their environment in much the same manner as the driver of a regular, passenger vehicle would, and so these sensing systems may incidentally capture images or sounds that may include users of the Services. Additionally, the sensing systems inside the delivery compartments of Nuro’s autonomous vehicles may be active and may capture images and sounds of the individual(s) who are retrieving the delivered goods from the vehicle. The data collected by these sensing systems is logged, and used to operate the vehicle and provide customer support, and to improve driving performance and customer experience.

Cookies and Tracking Technologies

Nuro works with service providers to provide its website. Nuro and these services use cookies, which are small files that are stored on and sent by your device when you access our service. Nuro and our service providers may use session cookies (which are destroyed when you close your application or web browser) or persistent cookies (which you can choose to delete from your device or computer). Nuro and our service providers use cookies to enable the functionality of the webpage (for example, ensuring a pop-up does not appear repeatedly), provide fillable forms, enhance site navigation, assist with our marketing efforts and provide analytics services, which help us understand the number of visitors and how visitors use the webpage and app. By using your browser settings, you may block cookies or adjust settings for notifications when a cookie is set. Your interactions with the service providers are governed by their terms of service.

We may combine information that we receive from the various sources described above for the purposes identified in this Privacy Policy.

How We Use Information

We may use the information collected for the following purposes:

● To provide, maintain and improve our Services

● To fulfill your order, including contacting you to confirm we received your order or to update you on progress, and allowing our drivers and autonomous vehicles to deliver your goods to you

● To process order payments

● To provide customer service, including contacting you with regards to issues or questions with your order or answering questions from you regarding your order

● For marketing, research and analytics

● To develop new products and Services

● To protect the rights and property of Nuro, our users, and others

● To detect, prevent, and respond to fraud, abuse, and security issues

● To comply with legal, regulatory or contractual requirements

● To carry out any other purpose described to you at the time the information was collected.

Communications with you in connection with these uses may be via mail, telephone, email, text message and other electronic messages, through our websites and applications. If you have signed up for our Services and have consented to receive text messages from Nuro, or if you have provided your consent to one of our retail partners so that we can stay in contact with you, we may send you text messages using an automated telephone dialing system to the mobile phone number you have provided and message and data rates may apply.

● How We Share Information

Nuro may share the information it collects about you in the following circumstances:

● Within Nuro and our current and future parents, affiliates, subsidiaries and other companies under common control and ownership

● With our trusted services providers who work on our behalf

● With our retail partners

● With your consent, including if you intentionally interact with third-parties on our site

● In connection with the sale, transfer or financing of a significant part of Nuro business or its assets, including any such activities associated with a bankruptcy proceeding

● When we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud or respond to a law enforcement request

● As required by law, such as in conjunction with a subpoena, government inquiry, litigation, dispute resolution or similar legal process

How Long We Keep Information

We may keep the information we collect for as long as reasonably necessary to provide our Services to you, to operate our business, develop or improve the Services, to enable us to communicate with you, for our safety, research, evaluation of use, or troubleshooting purposes, or to satisfy our legal or contractual obligations. Where required, we will anonymize or dispose of the information we collect when we no longer need it for the uses described above.

Children’s Information

Nuro’s services are not available to children under the age of 13, nor are they intended for use by anyone under the age of 13. A valid credit card is required to place an order on our system. If you are a parent or guardian of a child under the age of 13 and believe he or she has disclosed personal information to us, please contact us at privacy@nuro.ai. You can request to review the information we collected and request that we delete the child’s personal information. If we obtain actual knowledge that any information we collect has been provided by a child under the age of 13, we will delete that information.

Do-Not-Track

Your browser or device may include “Do-Not-Track” settings or functionality. Currently, our systems do not recognize browser “Do-Not-Track” requests. The information collection and disclosure practices, and the choices that we provide to customers, will continue to operate as described in this Privacy Policy, whether or not a Do-Not-Track signal is received. However, you may disable certain tracking on our Sites, as discussed in this section (e.g. by disabling cookies), and you may opt-out of certain third party ad networks as described below. For more information about Do-Not-Track signals, please click here.

Security

We take reasonable administrative, technical, and physical security measures to protect your personal information and to ensure that it is used in accordance with this Privacy Policy.

Third Party Links and Services

Our Services may contain links to third-party websites that are not owned or controlled by Nuro. Nuro has no control over, and assumes no responsibility for, the content, privacy policies, or practices of any third-party websites. If you visit such sites, your activities and the collection, use, and disclosure of information will be subject to the privacy policies and terms of the third-party websites or services, and not this Privacy Policy. We recommend that you read the privacy policies of these third parties.

Your Choices

You can make a request to access and change your personal information we store by contacting us via email, at privacy@nuro.ai. To further protect privacy, these requests are subject to identity verification.

If you would like to update your preferences, or opt out of marketing communications from us, you may do so at any time by contacting privacy@nuro.ai, or by following the opt out instructions in the marketing communications. Please note that we may continue to send non-promotional communications such as important notices and transaction-related emails and other information about your use of the Services.

California Residents

California residents have a right to knowledge, access, and deletion of their personal information under the California Consumer Privacy Act (CCPA).

California residents also have a right to opt out of the sale of their personal information by a business, however Nuro does not sell personal information.

When we say “Personal Information” in this disclosure, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. Personal Information does not include information that is aggregated or information that cannot be reasonably linked to you.

Nuro provides notice of our data practices throughout this Privacy Policy. This includes the categories of personal information we may collect, the categories of sources of personal information, the purposes of use, as well as the categories of parties with whom Nuro may share personal information in the past 12 months.

Your California Rights and Choices

This section describes the CCPA rights that you may have and explains how to exercise those rights. You have a right not to receive discriminatory treatment for exercising these privacy rights and Nuro does not discriminate in response to privacy rights requests.

Right to Know About Personal Information Collected, Used, or Disclosed

You have the right to request up to twice in a 12-month period that we disclose certain information to you about our collection, use and disclosure of your Personal Information over the past 12 months. Once we receive your request, verify your identity and determine that we have your information, we will disclose to you the information you request in the following areas: (1) the categories of Personal Information we collected about you; (2) the categories of sources for the Personal Information; (3) our business or commercial purpose for collecting that Personal Information; (4) the categories of third parties with whom we shared that Personal Information; and (5) the specific pieces of Personal Information we collected about you in the preceding 12 months.

Right to Delete Personal Information Collected or Maintained

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive your request, verify your identity and determine that we have your information, we will delete your Personal Information from our records, unless an exception under the CCPA applies. In our response to your request to delete, we will specify the manner in which we have deleted your Personal Information or, if we must deny your deletion request, the basis for this refusal.

Exercising Your Rights

To exercise the rights described above, please submit a verifiable consumer request to us by either:

· Calling us at 1-888-914-9661 and entering in the PIN #:653544

· Submitting a request through the webform made available here

Authorized Agent

You may designate an authorized agent to submit your consumer request on your behalf, so long as the authorized agent has your written permission to do so and you have taken steps to verify your identity directly with us.

Verifying Your Request

We cannot respond to your request to know or request to delete if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify your identity or authority to make the request. To verify your identity, we ask you to provide us with the following information when you submit your request: (1) first name, (2) last name, and (3) phone number or email.

We will use the above information to verify your identity. We will require additional information to verify your identity and fulfill your request depending on the type of request or the information requested by you.

CCPA Privacy Choices With Other Companies

Please note that the privacy choices described above apply specifically to Nuro and the personal information that Nuro collects about you. We do not control the privacy practices of other companies, including our retail partners, and therefore if you would like for your privacy choices to apply to other companies or to the personal information that we may hold as their service provider, then you will need to reach out directly to the other companies and submit your requests.

California “Shine The Light” Disclosure

Pursuant to California Civil Code Section 1798.83, we do not disclose information of consumers from whom we directly collect data to third parties for the third parties’ direct marketing purposes.

Changes to this Policy

This policy may change from time to time and any revised Privacy Policy will be posted at this page, so we encourage you to review it regularly. If we make changes, we will notify you by revising the date at the top of this Privacy Policy and, in the case of materials changes to the Privacy Policy, we may provide you with additional notice (such as a notice in our user interface or sending you a notification by email). By continuing to access and/or use the service after the effective date of a revised Privacy Policy, you agree to be bound by the revised Privacy Policy.

Contact us

You may contact us at privacy@nuro.ai if you have any questions or comments about this Privacy Policy.

Data Protection Information
Collection and processing of personal data in public spaces

Last updated: May 13, 2026

With this data protection information, we inform you in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR) about which personal data we collect in public spaces and how we process such data.

1. Controller, Data Protection Officer

1.1 Controller

Nuro, Inc.
1290 Terra Bella Ave
Mountain View, CA 94043 USA
Phone: 1-888-914-9661 PIN: 653544
Email: info@nuro.ai

(hereinafter “we” or “us”)

1.2 Data Protection Officer

Our company data protection officer can be reached at:

Alan Wilemon
KirkpatrickPrice
4235 Hillsboro Pike, Suite 300
Nashville, TN 37215 USA
Email: NuroDPO@kirkpatrickprice.com

You may contact our data protection officer at any time with questions or concerns regarding data protection.

2. Subject Matter of This Data Protection Information

We operate vehicles (including partially or fully automated or autonomous vehicles) on public roads in Germany and Europe. These vehicles are equipped with various sensors and recording technologies to collect data for the purpose of improving our technology, mapping, navigation, and ensuring road safety.

This Data Protection Information applies to all personal data collected by our vehicles on public roads. Separate privacy notices apply to the use of our website, our apps, or other services, which you can find here.

3. What Data Do We Collect?

3.1 Camera and Image Recordings

Our vehicles are equipped with multiple cameras that continuously record images and/or videos of the vehicle’s surroundings. In doing so, the following personal data may be collected:

a) Images of individuals (faces, bodies, clothing, behavior in traffic)
b) License plate numbers and vehicle characteristics
c) Visible personal belongings
d) House numbers, street signs, and other signage

3.2 LiDAR and Sensor Data

Our vehicles use LiDAR (Light Detection and Ranging) sensors, radar, and, where applicable, ultrasonic sensors. These generate three-dimensional point clouds and distance measurements of the surroundings. In this data, people and vehicles may be recognizable as point or shape patterns.

3.3 Microphone Data

Our vehicles are equipped with external microphones to capture relevant road traffic sounds, such as sirens. In this context, personal audio data may also be captured and subsequently processed without further analyzing it.

3.4 Location and Telemetry Data

We collect GPS coordinates, speed, direction of travel, acceleration, and other telemetry data from our vehicles. When combined with image or sensor data, this information may allow conclusions to be drawn about the location and time of the recording.

4. Purposes of Processing

We do not collect the data described above for the purpose of targeted identification of specific individuals. However, we cannot prevent personal data from being processed as part of the recording of the road environment. We process such personal data for the following purposes:

4.1 Development and Improvement of Autonomous Driving Technology

• Training and validation of algorithms for machine learning and artificial intelligence
• Detection and classification of road users, objects, and traffic situations
• Improving the perception, planning, and control systems of our vehicles

4.2 Mapping and Navigation

• Creation and updating of high-resolution maps
• Localization and positioning of vehicles
• Detection of road infrastructure, signage, and traffic guidance

4.3 Ensuring Traffic Safety

• Real-time analysis of the traffic environment to prevent accidents
• Documentation of safety-related events
• Analysis and reconstruction of near-misses and incidents

4.4 Compliance with Legal Obligations

• Compliance with statutory recording and documentation requirements (in particular under the German Road Traffic Act (Straßenverkehrsgesetz, StVG), the German Road Traffic Licensing Regulation (Straßenverkehrs-Zulassungs-Ordnung, StVZO), and the German Autonomous Driving Act) and other applicable legal provisions
• Cooperation with authorities in accident investigations or in response to official inquiries
• Demonstration of compliance with regulatory requirements

4.5 Research and Development

• Scientific research in the field of autonomous driving
• Statistical analysis of traffic patterns

4.6 Assertion, Exercise, or Defense of Legal Claims

• Documentation and preservation of evidence in the event of accidents, incidents resulting in damage, or legal disputes

5. Legal Basis for Processing

The processing of personal data is based on the following legal bases:

5.1 Legitimate Interest (Art. 6(1)(f) GDPR)

The processing of the aforementioned personal data is based on Art. 6(1)(f) GDPR in order to safeguard our legitimate interests.

Our legitimate interests include:

a) The development and improvement of safe autonomous driving technology, which is intended to contribute to increased road safety and a reduction in accidents in the long term
b) The creation and maintenance of map data
c) Ensuring the operational safety of our vehicles
d) The assertion, exercise, or defense of legal claims

5.2 Legal Obligation (Art. 6(1)(c) GDPR)

To the extent that we are legally required to collect or store data (e.g., pursuant to Section 1g StVG, Section 63a StVG), we process the data to fulfill these legal obligations.

5.4 Processing of Special Categories of Personal Data

Camera and image recordings may, under certain circumstances, contain special categories of personal data (e.g., inferences regarding ethnic origin, religious beliefs, or data concerning health). There is no targeted collection or analysis of such data. To the extent that such data is unavoidably captured, we base the processing on Art. 9(2)(e) GDPR (processing of data that the data subject has manifestly made public) and/or Art. 9(2)(j) GDPR in conjunction with Section 27 of the German Federal Data Protection Act (BDSG) (scientific research purposes), while applying appropriate safeguards.

6. Recipients and Transfer of Data

6.1 Data Processors

We use carefully selected data processors who process data on our behalf and in accordance with our instructions. We have entered into data processing agreements in accordance with Art. 28 GDPR. Data processors include in particular:

a) Cloud hosting and infrastructure providers
b) IT service providers and data processing services
c) Providers of annotation and labeling services (data labeling)

6.2 Other Third Parties

Data will only be transferred to other third parties if:

a) this is necessary to fulfill legal obligations (e.g., to law enforcement agencies, regulatory authorities, or courts)
b) this is necessary to assert, exercise, or defend legal claims
c) this is necessary in the context of a sale of the company or a restructuring

6.3 Transfer to Third Countries

To the extent that we transfer personal data to countries outside the European Economic Area (EEA), we ensure that an adequate level of data protection is guaranteed. This is achieved through:

a) Adequacy decisions by the European Commission (Art. 45 GDPR), e.g., the EU-U.S. Data Privacy Framework
b) Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR) in their current version

7. Retention Period

7.1 Principle of Data Minimization

We store personal data only for as long as necessary for the respective processing purposes or to the extent statutory retention obligations apply.

7.2 Specific Retention Periods

a) Data for the fulfillment of statutory retention obligations (e.g., under the StVG):
Stored for the period prescribed by law (e.g., storage obligations in connection with autonomous driving: currently up to 6 months pursuant to Section 1g StVG or the applicable regulations; in the event of accidents, up to 3 years or until the conclusion of the respective proceeding, as applicable).

b) Data related to legal disputes:
Stored until the final conclusion of the relevant proceeding and the subsequent limitation period.

8. Your Rights as a Data Subject

As a data subject, you have the following rights under the GDPR:

8.1 Right of Access (Art. 15 GDPR)

You have the right to request information from us regarding your personal data processed by us in accordance with Art. 15 GDPR.

Please provide us with additional information when submitting your request so that we can locate your data in our systems (e.g., the exact location and time when you were in the vicinity of one of our vehicles, as well as a description of your appearance). Please note that your right of access may be restricted under certain circumstances in accordance with legal provisions.

8.2 Right to Rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data.

8.3 Right to Erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data, provided that the conditions of Art. 17 GDPR are met (e.g., the data is no longer necessary for our processing purposes or you successfully object to the processing).

8.4 Right to Restriction of Processing (Art. 18 GDPR)

Under certain conditions, you have the right to request the restriction of the processing of your data.

8.5 Right to Data Portability (Art. 20 GDPR)

To the extent that processing is based on your consent or a contract and is carried out using automated means, you have the right to receive the data concerning you in a structured, commonly used, and machine-readable format.

8.6 Right to Object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR (legitimate interest).

If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing serves the establishment, exercise, or defense of legal claims.

8.7 Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR.

You can find an overview of German state data protection authorities at:
https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

8.8 Exercising Your Rights

To exercise your rights, please contact our data protection officer using the contact details provided in Section 1.

9. Automated Decision-Making

We do not make automated decisions within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you.