Privacy Policy

1. Information Collected

We collect the following types of data:

• Registration information: name, email address, restaurant name, phone number, establishment address.

• Usage information: actions performed on the application, generated publications, created content, AI interactions, publication preferences.

• Technical data: IP address, browser type, operating system, device used, pages visited, session duration.

• Social media data: OAuth access tokens (encrypted), publication statistics, engagement metrics.

• Payment data: processed exclusively by our PCI-DSS certified payment providers (Stripe). We never store your credit card numbers.

2. Data Deletion

If you wish to delete your personal data, you can do so via your account settings in the "Danger Zone" section by clicking "Delete my account".

Once this action is confirmed:

• All your personal data will be deleted from our servers within 30 days.

• Publications already posted on your social networks will remain online (you must delete them manually on each platform).

• OAuth access tokens will be immediately revoked.

• Some anonymized data may be retained for statistical purposes.

• Limited retention may be maintained if required by legal obligations (accounting, taxation).

3. Use of Data

We use your information to:

• Provide and improve our services: AI content generation, automatic publishing, performance analytics.

• Personalize your experience: adapt the tone, style, and frequency of publications to your restaurant.

• Communicate with you regarding your account, service updates, and important notifications.

• Ensure security and fraud prevention, detect abusive use.

• Comply with our legal obligations and respond to requests from competent authorities.

• Improve our AI algorithms using aggregated and anonymized data (never your personally identifiable data).

4. Data Sharing

We never sell your personal data. We only share it with third parties in the following cases:

• With your explicit consent: for example, when you connect your social media accounts.

• Essential service providers: cloud hosting (Supabase/AWS), payment processing (Stripe), email sending (SendGrid), AI services (Google Gemini, FAL.ai). These partners are contractually required to protect your data.

• Legal obligations: to comply with a court order, subpoena, or any applicable regulatory obligation.

• Rights protection: to protect the rights, property, or safety of Nueve, our users, or the public.

5. Data Security

We implement robust technical and organizational measures to protect your information:

• Encryption: all data is encrypted in transit (TLS 1.3) and at rest (AES-256).

• Authentication: secure authentication with JWT tokens, automatically expired sessions.

• Limited access: only authorized personnel have access to data, following the principle of least privilege.

• Regular audits: we conduct regular security audits and penetration tests.

• Secure hosting: our servers are hosted in SOC 2 Type II certified data centers.

• Encrypted OAuth tokens: social media access tokens are stored in encrypted form and are never exposed.

6. Your Rights (GDPR & CCPA)

In accordance with GDPR (European Union) and CCPA (California), you have the following rights:

• Right of access: obtain a copy of all personal data we hold about you.

• Right of rectification: correct any inaccurate or incomplete information.

• Right to erasure ("right to be forgotten"): request deletion of your data in certain circumstances.

• Right to data portability: receive your data in a structured, machine-readable format.

• Right to object: object to the processing of your data for direct marketing purposes.

• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact us at: hello@nueveapp.com

We will respond to any request within 30 days.

7. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential cookies: necessary for the application to function (authentication, session preferences).

• Analytical cookies: to understand how you use our service and improve it (anonymized data).

• Performance cookies: to optimize the speed and reliability of our application.

You can configure your browser to refuse non-essential cookies. However, some features of the application may not function properly.

Ad measurement (Meta): if you accept it in the banner shown at the bottom of the site, we use the Meta Platforms pixel to measure how well our ads on Facebook and Instagram work. It records the pages viewed, the creation of an account and the opening of the checkout. When you start a trial or pay for a subscription, our servers also report it to Meta, with your email address irreversibly encrypted (hashed). Without your consent, nothing is sent to Meta. You can change your mind at any time with the « Ad measurement » link at the bottom of the site's pages. Meta's use of this data is described in its privacy policy (https://www.facebook.com/privacy/policy).

8. Data Retention

We retain your information for as long as necessary to:

• Provide our services as long as your account is active.

• Comply with our legal obligations (accounting records: 10 years, tax data: 6 years).

• Resolve disputes and enforce our agreements.

After account deletion, data is permanently erased within 30 days, unless a contrary legal obligation applies.

9. International Transfers

Your data may be transferred to and processed in countries outside your country of residence, particularly the United States (hosting) and the European Union.

We ensure that these transfers are governed by appropriate safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission.

• Privacy Shield certification (where applicable).

• Data processing agreements with all our subcontractors.

10. Changes to the Privacy Policy

We may update this privacy policy to reflect changes in our practices or regulatory obligations.

In case of a substantial change:

• We will inform you by email and/or by a notification in the application at least 30 days before it takes effect.

• The effective date will be updated at the top of this document.

• Continued use of our services after notification constitutes your acceptance of the changes.

11. Google user data (YouTube, Google Analytics, Google Business Profile)

Nueve uses YouTube API Services and other Google APIs only when you choose to connect a Google service to your Nueve account. You decide which service you connect, and you can disconnect it at any time.

What we access and why:

• YouTube (YouTube API Services): your channel name and identifier; the right to upload the videos you create in Nueve and ask us to publish (right away or at the time you schedule), to update the title and description of those videos when you edit them in Nueve, and to delete them when you delete them from Nueve; the public statistics of your channel and of your latest videos (views, likes, comments), shown in your Nueve analytics.

• Google Analytics: we create a Google Analytics 4 property and a web data stream in your own Google Analytics account for the website Nueve builds for your business, and we store its measurement ID so that your website reports its visits to your own account.

• Google Business Profile: we find your business listing, publish the posts and photos you approve in Nueve, and read your reviews so that you can see them and reply from Nueve. When you ask for a suggested reply, the text of that review is sent to our AI provider (Google Gemini) to draft it, and nothing is posted until you confirm it.

Storage: the access you grant through Google (OAuth tokens) is stored on our servers, encrypted at rest, and is never shown in the app or shared. It is kept until you disconnect the service in Nueve, delete your account, or revoke Nueve's access from your Google account.

Sharing: we do not sell Google user data, we do not use it for advertising, and we do not share it with third parties, except our hosting provider (Supabase), which processes it on our behalf, and Google Gemini in the review reply case described above. We do not use Google user data to train or improve AI models. Nueve's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy).

Your control: you can disconnect a Google service at any time from the Social Networks page in Nueve, which deletes the access we stored. You can also revoke Nueve's access from your Google account security settings: https://security.google.com/settings/security/permissions

By connecting YouTube, you also agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). Google's own use of your data is described in the Google Privacy Policy (http://www.google.com/policies/privacy).