Nuestra ("Nuestra," "we," "us") provides business messaging automation, lead qualification, CRM integration, appointment scheduling, and related support. This policy explains how we handle personal information through nuestra.studio and our services.

For information about our own prospects, clients, billing contacts, and website visitors, we determine the purposes of processing. When we handle a client's lead information to deliver their configured service, we generally act on that client's instructions. The client's privacy notice also applies to their relationship with their leads. Our service agreement and any applicable Data Processing Addendum describe those responsibilities further.

Contact: hello@nuestra.studio.

Depending on the services used, we receive information directly from you, from the business you contact, and from connected accounts and providers:

• Contact and account information: names, business names, email addresses, phone numbers, social handles, platform identifiers, and account settings.
• Conversations: messages, comments, attachments, timestamps, delivery information, and conversation history made available through connected business channels.
• Lead and appointment information: interests, preferred areas, budget ranges, timelines, answers to qualification questions, CRM tags and notes, and appointment details.
• Service records: configured workflows, generated responses, integration events, troubleshooting records, and operational logs. These records may contain portions of conversations or contact information.
• Website and billing information: inquiries, scheduling submissions, billing records, and technical information such as IP addresses and browser information, where collected by the tools actually enabled on our website.

The information available from a connected account depends on its permissions and the provider's integration behavior. Connecting a business channel may make conversations available beyond those that become qualified leads. This can include personal or unrelated messages on that account.

Do not submit passwords, Social Security numbers, full payment card details, medical records, or other highly sensitive documents through ordinary lead conversations. Use the appropriate secure channel for those records.

We use information to deliver the services a client configures: respond to inquiries, understand lead preferences, update CRM records, schedule appointments, and send configured follow-ups. We also use information to provide support, investigate errors, prevent misuse, maintain security, administer accounts and billing, and meet legal obligations.

Automated systems and AI providers process relevant conversation context to generate responses and extract information. AI can make mistakes; its output does not constitute a professional eligibility or lending decision.

Customer content includes messages, attachments, contacts, and CRM records provided by you or made available through integrations you connect to the service. We process customer content on your behalf to provide and support your configured services.

We process customer content to operate, maintain, and support your service. Authorized Nuestra personnel may access this content, including connected messages and CRM records, for account administration, configuration, troubleshooting, and security. Service providers may separately process information as described below.

Connecting an account does not limit access to messages from qualified leads. Personal or unrelated conversations on the same connected account may also be available through the integration. We recommend using an account dedicated to your business.

Clients and their authorized team members may access information through the permissions available in their CRM. A separate client does not receive permission to view your records merely because both businesses use Nuestra.

Service providers. We use third-party service providers to operate and support our services. These providers may receive and process personal information as necessary to perform their functions. Depending on the setup, these include CRM and connected inbox providers, Meta for Facebook and Instagram messaging, AI providers such as Anthropic and OpenAI, cloud hosting and infrastructure providers, and browsing and search providers. Information sent to a search or browsing provider depends on the request and configuration.

Payment processing is provided through Stripe, transactional email through SendGrid, and SMS delivery through Twilio, where these services are enabled. We require service providers processing personal information on our behalf to protect that information and use it only to perform the agreed services, subject to applicable law and the relevant processing agreements.

Not every provider is used in every client setup. Contact us for information about the providers used for your account.

Privacy information for named providers: Meta (Facebook and Instagram), Anthropic, and OpenAI. These notices do not replace Nuestra’s responsibilities or the applicable service agreements.

We disclose information as needed to deliver and support the service, comply with valid legal requirements, protect rights and security, or carry out an authorized business transfer subject to applicable protections. Some platforms also process information under their own terms for their own purposes.

We do not sell or rent client conversations or contact lists, or provide them to third parties for their unrelated marketing purposes.

Using conversation context to produce a response is different from using it to train a general-purpose AI model.

Relevant messages and service records may be reviewed to investigate errors and assess whether your configured automation is working correctly. AI-provider processing and retention depend on the provider, the commercial service used, and the applicable agreement and settings. Different providers may have different retention and model-improvement terms. Contact us for the terms applicable to your setup.

Information may be held in the CRM, Nuestra's databases, automation execution records, provider systems, and backups. Disconnecting an integration stops future access subject to the platform's behavior; it does not automatically erase information already stored in these systems.

We retain information according to the purposes for which it was collected, the client's instructions and agreement, operational needs, and applicable legal requirements.

Retention depends on the type and sensitivity of the information, the duration of the service, client instructions, support and security needs, and applicable recordkeeping requirements. Cancellation ends service access at the end of the paid billing cycle and starts the offboarding process described below. It does not immediately erase stored information.

Your seven-day offboarding window

The offboarding period ends seven calendar days after service ends. For ordinary cancellation, service ends at the end of the paid billing cycle, not on the date cancellation is requested. Clients may request a standard export of available client records before or during this seven-day period. We will fulfill verified export requests before deleting the relevant records and complete export delivery and deletion within that period. Clients should submit requests before service ends to allow time for identity verification and delivery.

Subject to the limited exceptions below, we will delete client conversation and lead records from active systems, automation execution records, and backups under Nuestra’s control by the end of the seven-day period. The export request window does not create an additional retention period. Deleted records will no longer be available for export.

Limited retention exceptions

We may retain records required for legal obligations, billing, security investigations, or resolving disputes for as long as reasonably necessary for those purposes. These exceptions do not authorize indefinite retention of an entire conversation history. Copies independently controlled by the client or a connected platform remain subject to that party’s terms, account settings, and legal obligations. Requests received during an active service are handled under applicable law and the client’s instructions.

We use safeguards appropriate to the information and services involved. No internet service is completely secure. A provider's security certification or encryption statement does not certify Nuestra's entire system.

Information may be processed outside your state or country, depending on the providers used. Contact us for information about processing locations and applicable transfer arrangements for your service.

Contact hello@nuestra.studio to ask about access, correction, deletion, a copy of your information, or other rights available under applicable law. We may need to verify your identity and authority. We respond within applicable legal deadlines and explain any permitted exception.

If your information was collected by one of our business clients, contact that business first. We assist the client with requests concerning information processed on its behalf. Removing information from Nuestra does not necessarily remove copies independently held by the business or another platform.

Clients can request changes to connected channels and automation. Revoking necessary permissions may stop parts of the service. Marketing recipients may use the unsubscribe method provided; applicable service communications may continue.

Nuestra does not use website analytics or advertising trackers, including Google Analytics or Meta Pixel. Website hosting and embedded services may still process technical information or use technologies necessary to deliver their functionality. Third-party services you interact with are also subject to their own privacy notices. Contact us with questions about these services or your privacy choices.

Children

Our services are intended for adult business users and are not directed to children. If you believe a child has supplied information improperly, contact us so we can assess and respond.

Changes to this policy

We will update this policy when our practices change, revise its effective date, and provide any additional notice required by law. This notice explains our practices; it does not replace consent where consent is required.