Privacy Policy

1. Information Collected

We collect the following types of data:

• Registration information: name, email address, restaurant name, phone number, establishment address.

• Usage information: actions performed on the application, generated publications, created content, AI interactions, publication preferences.

• Technical data: IP address, browser type, operating system, device used, pages visited, session duration.

• Social media data: OAuth access tokens (encrypted), publication statistics, engagement metrics.

• Payment data: processed exclusively by our PCI-DSS certified payment providers (Stripe). We never store your credit card numbers.

2. Data Deletion

If you wish to delete your personal data, you can do so via your account settings in the "Danger Zone" section by clicking "Delete my account".

Once this action is confirmed:

• All your personal data will be deleted from our servers within 30 days.

• Publications already posted on your social networks will remain online (you must delete them manually on each platform).

• OAuth access tokens will be immediately revoked.

• Some anonymized data may be retained for statistical purposes.

• Limited retention may be maintained if required by legal obligations (accounting, taxation).

3. Use of Data

We use your information to:

• Provide and improve our services: AI content generation, automatic publishing, performance analytics.

• Personalize your experience: adapt the tone, style, and frequency of publications to your restaurant.

• Communicate with you regarding your account, service updates, and important notifications.

• Ensure security and fraud prevention, detect abusive use.

• Comply with our legal obligations and respond to requests from competent authorities.

• Improve our AI algorithms using aggregated and anonymized data (never your personally identifiable data).

4. Data Sharing

We never sell your personal data. We only share it with third parties in the following cases:

• With your explicit consent: for example, when you connect your social media accounts.

• Essential service providers: cloud hosting (Supabase/AWS), payment processing (Stripe), email sending (SendGrid), AI services (Google Gemini, FAL.ai). These partners are contractually required to protect your data.

• Legal obligations: to comply with a court order, subpoena, or any applicable regulatory obligation.

• Rights protection: to protect the rights, property, or safety of Nueve, our users, or the public.

5. Data Security

We implement robust technical and organizational measures to protect your information:

• Encryption: all data is encrypted in transit (TLS 1.3) and at rest (AES-256).

• Authentication: secure authentication with JWT tokens, automatically expired sessions.

• Limited access: only authorized personnel have access to data, following the principle of least privilege.

• Regular audits: we conduct regular security audits and penetration tests.

• Secure hosting: our servers are hosted in SOC 2 Type II certified data centers.

• Encrypted OAuth tokens: social media access tokens are stored in encrypted form and are never exposed.

6. Your Rights (GDPR & CCPA)

In accordance with GDPR (European Union) and CCPA (California), you have the following rights:

• Right of access: obtain a copy of all personal data we hold about you.

• Right of rectification: correct any inaccurate or incomplete information.

• Right to erasure ("right to be forgotten"): request deletion of your data in certain circumstances.

• Right to data portability: receive your data in a structured, machine-readable format.

• Right to object: object to the processing of your data for direct marketing purposes.

• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact us at: [email protected]

We will respond to any request within 30 days.

7. Cookies and Tracking Technologies

We use cookies and similar technologies for:

• Essential cookies: necessary for the application to function (authentication, session preferences).

• Analytical cookies: to understand how you use our service and improve it (anonymized data).

• Performance cookies: to optimize the speed and reliability of our application.

You can configure your browser to refuse non-essential cookies. However, some features of the application may not function properly.

8. Data Retention

We retain your information for as long as necessary to:

• Provide our services as long as your account is active.

• Comply with our legal obligations (accounting records: 10 years, tax data: 6 years).

• Resolve disputes and enforce our agreements.

After account deletion, data is permanently erased within 30 days, unless a contrary legal obligation applies.

9. International Transfers

Your data may be transferred to and processed in countries outside your country of residence, particularly the United States (hosting) and the European Union.

We ensure that these transfers are governed by appropriate safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission.

• Privacy Shield certification (where applicable).

• Data processing agreements with all our subcontractors.

10. Changes to the Privacy Policy

We may update this privacy policy to reflect changes in our practices or regulatory obligations.

In case of a substantial change:

• We will inform you by email and/or by a notification in the application at least 30 days before it takes effect.

• The effective date will be updated at the top of this document.

• Continued use of our services after notification constitutes your acceptance of the changes.