Privacy Policy

1. Who we are

Nexvin Digital (Brazilian company registration CNPJ 62.214.955/0001-07), based in São Paulo, Brazil, is the controller of the personal data processed on nexvin.digital and in its own products, such as PickStop and NexvinAgenda. This policy also covers the apps and integrations we run on Meta platforms (WhatsApp, Facebook, Instagram and Messenger) and Google.

When we build or run a system on behalf of a client, the client is the controller and Nexvin Digital acts as a processor, handling the data only on the client's instructions and under this policy.

Privacy questions: [email protected].

2. Data we collect

We collect only what each purpose needs, depending on the source:

• Website and contact form: name, email, company, phone number (if provided) and the message sent through the form, which is processed by HubSpot.
• Browsing: pages visited, referral source, device and browser type, IP address and cookie identifiers, through Google Analytics 4, Google Tag Manager and Cloudflare Web Analytics.
• WhatsApp Business (Cloud API): phone number, WhatsApp profile name, the content of messages and media exchanged with our numbers, and their date, time and delivery status.
• Facebook or Instagram Login: name, profile picture, email and app-scoped user ID, only for the permissions you grant on Meta's login screen.
• Instagram and Messenger messaging: messages, comments and sender IDs for the pages or professional accounts you connect, the IDs of those pages and accounts, and the access tokens granted.
• Google APIs: name, email and profile picture when you sign in with Google and, when you explicitly authorize it, data from the granted scope (for example, Google Calendar events for bookings).

We do not ask for sensitive data (such as health, religion or biometrics) and ask you not to send it in messages.

3. How we use data

• To reply to enquiries, prepare proposals and deliver contracted services.
• To run the features of our products and integrations, such as customer service over WhatsApp, Instagram and Messenger, booking confirmations and notifications.
• To authenticate you when you sign in with Facebook, Instagram or Google.
• To provide support, prevent fraud and keep our systems secure.
• To understand, in aggregate, how the website is used so we can improve it.
• To comply with legal and regulatory obligations.

We do not sell personal data. We do not use data received from Meta or Google for advertising, marketing profiles or any purpose other than those described here.

4. Legal bases

We process personal data under article 7 of Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and, where it applies, the equivalent bases of the EU and UK GDPR:

• Consent, when you connect your Meta or Google account or accept analytics cookies.
• Performance of a contract and pre-contract steps, such as replying to a quote request.
• Legitimate interest, for security, fraud prevention and improving the website, always respecting your rights.
• Legal obligation, such as keeping the access logs required by Brazil's Internet Civil Framework (Marco Civil da Internet).

5. Sharing

We share data only with the providers needed to deliver the service, acting as processors or independent controllers:

• Meta Platforms (WhatsApp, Facebook, Instagram and Messenger), to send and receive messages and authenticate users.
• Google, for sign-in, the APIs you authorize and website analytics.
• HubSpot, to receive and organize contact form submissions.
• Cloudflare and our hosting provider, to serve the website securely.

We may also disclose data when required by law, a court order or a competent authority, or to protect the rights of Nexvin Digital and others.

6. International transfers

Some providers, such as Meta, Google, HubSpot and Cloudflare, may process data on servers outside Brazil, mainly in the United States. These transfers follow article 33 of the LGPD, relying on contractual clauses and equivalent safeguards offered by those providers.

7. Data received from Google APIs

Nexvin Digital's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use this data only to provide or improve user-facing features of the app that requested access.
• We do not transfer this data to third parties, except as needed to provide the service, to comply with the law, or as part of a merger or acquisition with prior notice.
• We do not use this data for advertising, including personalized or retargeted ads.
• No one on our team reads this data, except with your express consent, for security purposes or to comply with the law.
• We do not sell this data or use it to determine creditworthiness or for lending purposes.

8. Data received from Meta platforms

Data received from WhatsApp, Facebook, Instagram and Messenger is processed under the Meta Platform Terms: only for the purpose stated when you authorized it, never sold, never used for advertising and never shared with data brokers.

You can remove our app's access at any time in your Meta account settings and request deletion of your data on the Data deletion page.

9. How long we keep data

• Enquiries and proposals: up to 2 years after the last contact, or for the length of the contract and the legal period after it.
• Messages and integration data: while the service is active or until you or the client request deletion.
• Access tokens: until you disconnect the account, the token expires or access is revoked, at which point they are deleted.
• Browsing analytics: up to 14 months, aggregated whenever possible.
• Access logs: 6 months, as required by article 15 of Brazil's Internet Civil Framework.

When these periods end, data is deleted or anonymized unless the law requires us to keep it longer.

10. Security

We use encrypted connections (HTTPS/TLS), secure storage for credentials and tokens, role-based access and monitoring. No system is fully immune to incidents; if a relevant incident happens, we will notify the people affected and Brazil's data protection authority (ANPD) as the LGPD requires.

11. Your rights

Under article 18 of the LGPD, and the GDPR where it applies, you can ask us at any time for:

• Confirmation that we process your data, and access to it.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of unnecessary data or data processed unlawfully.
• Portability of your data to another provider.
• Information about who we share your data with.
• Withdrawal of consent and deletion of the data processed on that basis.

Send your request to [email protected]. We reply within 15 days. To delete your data, follow the steps on the Data deletion page.

You can also lodge a complaint with Brazil's National Data Protection Authority (ANPD) or your local data protection authority.

12. Cookies

• NEXT_LOCALE: remembers your chosen language for 1 year. Needed for the website to work.
• Google Analytics and Google Tag Manager: measure visits and website usage statistically.

You can block or delete cookies in your browser settings. The website keeps working, but it may not remember your language.

13. Children

Our services are aimed at businesses and professionals and are not intended for anyone under 18. We do not knowingly collect data from children or teenagers.

14. Changes to this policy

We may update this policy to reflect changes in our services or in the law. The date at the top shows the current version; significant changes will be highlighted on this page.

15. Contact and data protection officer

Data protection officer (DPO): Nexvin Digital, at [email protected].

Nexvin Digital · CNPJ 62.214.955/0001-07 · São Paulo, Brazil.