Nuvia handles your operation's data with encryption, permission-based access control, and processes aligned with the LGPD (Brazil's General Data Protection Law). This article brings together what the platform does to secure your data and what you can do to strengthen it.
Available on: All plans
Applies to: All accounts
The full, official documents are on the Nuvia website: the Privacy Policy (nuvia.ai/politica-de-privacidade), the Terms of Use (nuvia.ai/termos-de-uso), and the Basic LGPD Manual (nuvia.ai/lgpd).
This article summarizes the main points. If there's any discrepancy, the official documents prevail:
https://nuvia.ai/termos-de-uso
https://nuvia.ai/politica-de-privacidade
https://nuvia.ai/lgpd
What data Nuvia handles
Nuvia only handles professional and corporate data, obtained from public sources or with an appropriate legal basis: name, job title, and work email, phone number for contact via WhatsApp, and public company data (such as CNPJ and corporate address).
Nuvia doesn't handle sensitive personal data, data about children or teenagers, or data such as CPF, home address, or personal email.
Regarding processing, Nuvia is the controller of your account data (your registration and your use of the platform) and the processor of the lead data you handle on the platform, which is processed only to provide the service you signed up for.
Storage and encryption
All data is stored on cloud servers, with encryption always on. Nuvia applies technical controls to protect data against unauthorized access, loss, or improper disclosure:
-
Encryption in transit (TLS): Data is protected as it travels between your browser and Nuvia's servers, on every platform endpoint.
-
Encryption at rest (AES-256): Data is protected in the database and in file storage.
-
Passwords hashed with bcrypt: Stored in encrypted form, never in plain text.
-
Role-based access control (RBAC): With isolation by company, so one company's data never mixes with another's.
-
Backup: Automatic, recurring copies, also encrypted, with point-in-time recovery (PITR).
-
Access logs, rate limiting, and data validation: At every system boundary, under an active Information Security Program that is reviewed periodically.
Where your data is processed
Some of Nuvia's vendors are outside Brazil, so your data may be processed in other countries, including the United States. These international transfers follow the safeguards of article 33 of the LGPD: Standard Contractual Clauses (SCCs), Data Processing Agreements (DPAs) with every vendor that handles data on Nuvia's behalf, and verification that the destination offers protection compatible with the LGPD.
Sharing data with third parties
Nuvia only shares data with vendors and partners needed to provide the service, always under a data protection agreement (DPA). The categories include cloud infrastructure providers, AI model providers, communication channel platforms, the CRM and calendar tools you integrate, and monitoring providers.
Nuvia doesn't sell personal data. The lead data you handle on the platform is used only to provide the contracted service and isn't shared with other customers or used in Nuvia's own marketing.
Your rights under the LGPD
The LGPD (Law No. 13,709/2018) gives you, as the data subject, rights over your personal data. The authority that enforces the law is the ANPD (Brazil's National Data Protection Authority). The rights in article 18 include: confirmation that processing exists, access to the data, correction, anonymization or deletion of data processed in non-compliance, portability, deletion of data processed based on consent, information about who the data was shared with, withdrawal of consent, and objection to processing not based on consent.
How to exercise your rights
To request access, correction, portability, deletion, objection, or withdrawal of consent, write to Nuvia's Data Protection Officer (DPO) at antero@nuvia.ai, with your identification and a description of the right you want to exercise. The response time is up to 15 calendar days from receipt, which can be extended with justification.
For the contacts you manage on the platform, you can act directly: in Side Menu > Lists, open the contact to edit the data. To delete it for good, click the three-dot menu and choose Permanently Delete Contact. Deletion is irreversible.
Who can see what
Data access is defined by user permissions, with separation by company (multi-tenant RBAC).
Nuvia recommends the following permission structure by role:
-
Admin: Sees data for the whole organization.
-
Manager: Sees data for their team.
-
Agent: Sees only the conversations assigned to them.
When you remove a user, they lose access immediately, but their conversations aren't deleted: they remain as history.
Data retention
Nuvia keeps data for the shortest time needed for the purpose or to meet legal obligations:
-
Conversations and lead data: Kept according to your account settings while the contract is active. After the contract ends, they're kept for no more than 60 days and then securely deleted, with a confirmation record.
-
Account registration data: Up to 60 days after the contract ends, followed by secure deletion.
-
Security and audit logs: At least 1 year, according to internal security requirements.
To delete a specific conversation, go to Side Menu > Conversations, open the conversation, click the three-dot menu, and choose Delete Conversation. This removes the history but keeps the contact. To remove the whole contact, use Permanently Delete Contact in Lists.
Integrations and security
When you connect Nuvia to an external tool, such as HubSpot, data starts flowing between the systems.
This flow is protected: you authorize the connection through OAuth, without sharing your password; Nuvia only requests access to the data it needs; and traffic is encrypted. You can disconnect the integration whenever you want.
When you disconnect, syncing stops right away, but data already sent stays in the other system: revoking doesn't delete the history there. If you want to remove it, do so in the tool itself.
Webhooks and custom integrations
If you use webhooks (your own URLs to receive data), the security of that data becomes your responsibility, since it goes out to your infrastructure. Good practices: use HTTPS in the URL, implement authentication (for example, a token), validate the data's origin, and monitor what is sent. Never send passwords, tokens, or sensitive data through a webhook.
AI and privacy
Nuvia doesn't use your data to train its own AI models. The AI only accesses data from your own account, such as your Knowledge Center, your contacts, and the Data Tables you set up. That's what lets the AI answer with your business context.
Because access is isolated by company, one company's AI can't see another's data, and conversations aren't shared between customers.
Audit logs
Nuvia keeps structured access logs (with method, URL, status, and IP) for security audits. These records help investigate suspicious actions and ensure internal compliance.
Suspected security incident
If you suspect a leak, unauthorized access, or another incident:
-
Report it right away, by email to the DPO (antero@nuvia.ai) or support (support@Nuvia.ai).
-
Document the problem: What happened, when you noticed, and who may have had access.
-
Change your password if there's a risk it was compromised.
-
Revoke suspicious access: Remove users and disconnect integrations that may be involved.
Nuvia follows an Incident Response Plan: it contains the incident, assesses the impact, notifies the ANPD when applicable (article 48 of the LGPD), and informs the affected data subjects when appropriate.
Security best practices
Under the Terms of Use, you're responsible for keeping your account confidential and for notifying Nuvia of any unauthorized use. To strengthen security:
-
Use a strong password. We recommend 12 characters or more, mixing letters, numbers, and symbols, well above the required minimum. Avoid dates, names, and sequences like “123456”. See “How to recover your password and reset access to your Nuvia account”.
-
Don't share your password. Nuvia never asks for your password by email or chat.
-
Review permissions often. Check who has access, remove people who have left the company, and adjust anyone with more access than they need.
-
Audit your integrations. Disconnect tools you no longer use.
-
Review your data periodically. Check for duplicate or inactive contacts, delete old campaigns, and archive closed conversations.