1. [Help](https://nuvia.ai/en/docs) 2. [Account Settings](https://nuvia.ai/en/docs/colecoes/19430666-account-settings) # Security, privacy, and LGPD at Nuvia Learn how Nuvia protects your data: encryption, access control, LGPD compliance, and good practices you can adopt. Available on All plans Updated on August 27, 2026 [Account Settings](https://nuvia.ai/en/docs/colecoes/19430666-account-settings) 1. [How to turn on two-factor authentication (MFA)](https://nuvia.ai/en/docs/artigos/18174510-how-to-turn-on-two-factor-authentication-mfa) 2. [How to set your availability (Away or Unavailable)](https://nuvia.ai/en/docs/artigos/18174522-how-to-set-your-availability-away-or-unavailable) 3. [How to manage API keys in Nuvia](https://nuvia.ai/en/docs/artigos/15230128-how-to-manage-api-keys-in-nuvia) 4. [How to deactivate and reactivate a user](https://nuvia.ai/en/docs/artigos/16497565-how-to-deactivate-and-reactivate-a-user) 5. [Security, privacy, and LGPD at Nuvia](https://nuvia.ai/en/docs/artigos/14576039-security-privacy-and-lgpd-at-nuvia) 6. [How to create and manage teams in Nuvia](https://nuvia.ai/en/docs/artigos/15649230-how-to-create-and-manage-teams-in-nuvia) Nuvia handles your operation's data with encryption, permission-based access control, and processes aligned with the LGPD (Brazil's General Data Protection Law). This article brings together what the platform does to secure your data and what you can do to strengthen it. **Available on:** All plans **Applies to:** All accounts The full, official documents are on the Nuvia website: the Privacy Policy ([nuvia.ai/politica-de-privacidade](https://nuvia.ai/en/politica-de-privacidade)), the Terms of Use ([nuvia.ai/termos-de-uso](https://nuvia.ai/en/termos-de-uso)), and the Basic LGPD Manual ([nuvia.ai/lgpd](https://nuvia.ai/en/lgpd)). This article summarizes the main points. **If there's any discrepancy, the official documents prevail:** [https://nuvia.ai/termos-de-uso](https://nuvia.ai/en/termos-de-uso) [https://nuvia.ai/politica-de-privacidade](https://nuvia.ai/en/politica-de-privacidade) [https://nuvia.ai/lgpd](https://nuvia.ai/en/lgpd) ## What data Nuvia handles Nuvia only handles professional and corporate data, obtained from public sources or with an appropriate legal basis: name, job title, and work email, phone number for contact via WhatsApp, and public company data (such as CNPJ and corporate address). Nuvia doesn't handle sensitive personal data, data about children or teenagers, or data such as CPF, home address, or personal email. Regarding processing, Nuvia is the controller of your account data (your registration and your use of the platform) and the processor of the lead data you handle on the platform, which is processed only to provide the service you signed up for. ### Storage and encryption All data is stored on cloud servers, with encryption always on. Nuvia applies technical controls to protect data against unauthorized access, loss, or improper disclosure: - **Encryption in transit (TLS):** Data is protected as it travels between your browser and Nuvia's servers, on every platform endpoint. - **Encryption at rest (AES-256):** Data is protected in the database and in file storage. - **Passwords hashed with bcrypt:** Stored in encrypted form, never in plain text. - **Role-based access control (RBAC):** With isolation by company, so one company's data never mixes with another's. - **Backup:** Automatic, recurring copies, also encrypted, with point-in-time recovery (PITR). - **Access logs, rate limiting, and data validation:** At every system boundary, under an active Information Security Program that is reviewed periodically. **Protection is automatic and always on; you don't need to configure anything.** ### Where your data is processed Some of Nuvia's vendors are outside Brazil, so your data may be processed in other countries, including the United States. These international transfers follow the safeguards of article 33 of the LGPD: Standard Contractual Clauses (SCCs), Data Processing Agreements (DPAs) with every vendor that handles data on Nuvia's behalf, and verification that the destination offers protection compatible with the LGPD. ### Sharing data with third parties Nuvia only shares data with vendors and partners needed to provide the service, always under a data protection agreement (DPA). The categories include cloud infrastructure providers, AI model providers, communication channel platforms, the CRM and calendar tools you integrate, and monitoring providers. Nuvia doesn't sell personal data. The lead data you handle on the platform is used only to provide the contracted service and isn't shared with other customers or used in Nuvia's own marketing. ### Your rights under the LGPD The LGPD (Law No. 13,709/2018) gives you, as the data subject, rights over your personal data. The authority that enforces the law is the ANPD (Brazil's National Data Protection Authority). The rights in article 18 include: confirmation that processing exists, access to the data, correction, anonymization or deletion of data processed in non-compliance, portability, deletion of data processed based on consent, information about who the data was shared with, withdrawal of consent, and objection to processing not based on consent. #### How to exercise your rights To request access, correction, portability, deletion, objection, or withdrawal of consent, write to Nuvia's Data Protection Officer (DPO) at **antero@nuvia.ai**, with your identification and a description of the right you want to exercise. The response time is up to **15 calendar days** from receipt, which can be extended with justification. For the contacts you manage on the platform, you can act directly: in **Side Menu > Lists**, open the contact to edit the data. To delete it for good, click the three-dot menu and choose **Permanently Delete Contact**. Deletion is irreversible. ### Who can see what Data access is defined by user permissions, with separation by company (multi-tenant RBAC). Nuvia recommends the following permission structure by role: - **Admin:** Sees data for the whole organization. - **Manager:** Sees data for their team. - **Agent:** Sees only the conversations assigned to them. When you remove a user, they lose access immediately, but their conversations aren't deleted: they remain as history. ### Data retention Nuvia keeps data for the shortest time needed for the purpose or to meet legal obligations: - **Conversations and lead data:** Kept according to your account settings while the contract is active. After the contract ends, they're kept for no more than 60 days and then securely deleted, with a confirmation record. - **Account registration data:** Up to 60 days after the contract ends, followed by secure deletion. - **Security and audit logs:** At least 1 year, according to internal security requirements. To delete a specific conversation, go to **Side Menu > Conversations**, open the conversation, click the three-dot menu, and choose **Delete Conversation**. This removes the history but keeps the contact. To remove the whole contact, use **Permanently Delete Contact** in Lists. ### Integrations and security When you connect Nuvia to an external tool, such as HubSpot, data starts flowing between the systems. This flow is protected: you authorize the connection through OAuth, without sharing your password; Nuvia only requests access to the data it needs; and traffic is encrypted. You can disconnect the integration whenever you want. When you disconnect, syncing stops right away, but data already sent stays in the other system: revoking doesn't delete the history there. If you want to remove it, do so in the tool itself. ### Webhooks and custom integrations If you use webhooks (your own URLs to receive data), the security of that data becomes your responsibility, since it goes out to your infrastructure. Good practices: use HTTPS in the URL, implement authentication (for example, a token), validate the data's origin, and monitor what is sent. Never send passwords, tokens, or sensitive data through a webhook. ### AI and privacy Nuvia doesn't use your data to train its own AI models. The AI only accesses data from your own account, such as your Knowledge Center, your contacts, and the Data Tables you set up. That's what lets the AI answer with your business context. Because access is isolated by company, one company's AI can't see another's data, and conversations aren't shared between customers. ### Audit logs Nuvia keeps structured access logs (with method, URL, status, and IP) for security audits. These records help investigate suspicious actions and ensure internal compliance. ### Suspected security incident If you suspect a leak, unauthorized access, or another incident: 1. **Report it right away**, by email to the DPO (antero@nuvia.ai) or support (support@Nuvia.ai). 2. **Document the problem:** What happened, when you noticed, and who may have had access. 3. **Change your password** if there's a risk it was compromised. 4. **Revoke suspicious access:** Remove users and disconnect integrations that may be involved. Nuvia follows an Incident Response Plan: it contains the incident, assesses the impact, notifies the ANPD when applicable (article 48 of the LGPD), and informs the affected data subjects when appropriate. ### Security best practices Under the Terms of Use, you're responsible for keeping your account confidential and for notifying Nuvia of any unauthorized use. To strengthen security: 1. **Use a strong password.** We recommend 12 characters or more, mixing letters, numbers, and symbols, well above the required minimum. Avoid dates, names, and sequences like “123456”. See “How to recover your password and reset access to your Nuvia account”. 2. **Don't share your password.** Nuvia never asks for your password by email or chat. 3. **Review permissions often.** Check who has access, remove people who have left the company, and adjust anyone with more access than they need. 4. **Audit your integrations.** Disconnect tools you no longer use. 5. **Review your data periodically.** Check for duplicate or inactive contacts, delete old campaigns, and archive closed conversations. ## Frequently asked questions ## Frequently asked questions **Where do I request access to, correction of, or deletion of my personal data?** Write to the Data Protection Officer (DPO) at antero@nuvia.ai, with your identification and the right you want to exercise. The response comes within 15 calendar days, which can be extended with justification. **Does Nuvia sell my contact data?** No. Nuvia doesn't sell personal data. The lead data you handle on the platform is used only to provide the service and isn't shared with other customers or used in Nuvia's marketing. **Does my data stay only in Brazil?** Not necessarily. Some vendors are outside Brazil, so your data may be processed in other countries, such as the United States, always with the safeguards of article 33 of the LGPD (SCCs, DPAs, and verification of compatible protection). **Can I delete a contact who requested deletion (LGPD)?** Yes. In **Side Menu > Lists**, open the contact and use **Permanently Delete Contact**. For a formal request from a data subject, forward it to the DPO **If I have a HubSpot integration, is the contact deleted there too?** No. Deleting a contact in Nuvia only removes it from Nuvia. To remove it from HubSpot, delete it in HubSpot. **How long are conversations stored?** While the contract is active, according to your account settings. After the contract ends, for no more than 60 days, and then they're securely deleted. **Does my data feed Nuvia's AI?** No. Nuvia doesn't use your data to train its own AI models. The AI only uses your account's data to answer with your business context, and access is isolated by company. **Does Nuvia comply with other laws, such as the GDPR?** Nuvia follows the LGPD. If you have customers under other laws, such as the European GDPR, talk to the DPO for guidance on specific provisions. **My login was compromised. What should I do?** Change your password immediately, notify an Admin or the account Owner and the DPO, and ask for a review of the audit logs to check for anything suspicious. [PreviousHow to deactivate and reactivate a user](https://nuvia.ai/en/docs/artigos/16497565-how-to-deactivate-and-reactivate-a-user) [NextHow to create and manage teams in Nuvia](https://nuvia.ai/en/docs/artigos/15649230-how-to-create-and-manage-teams-in-nuvia) Was this article helpful? ## Related articles - [Quick guide: Nuvia platform overview](https://nuvia.ai/en/docs/artigos/14500951-quick-guide-nuvia-platform-overview) - [Nuvia glossary of terms](https://nuvia.ai/en/docs/artigos/14580494-nuvia-glossary-of-terms) - [How to connect the Nuvia MCP](https://nuvia.ai/en/docs/artigos/15422389-how-to-connect-the-nuvia-mcp) - [What Nuvia syncs with HubSpot and when](https://nuvia.ai/en/docs/artigos/16473526-what-nuvia-syncs-with-hubspot-and-when) [Account Settings](https://nuvia.ai/en/docs/colecoes/19430666-account-settings) 1. [How to turn on two-factor authentication (MFA)](https://nuvia.ai/en/docs/artigos/18174510-how-to-turn-on-two-factor-authentication-mfa) 2. [How to set your availability (Away or Unavailable)](https://nuvia.ai/en/docs/artigos/18174522-how-to-set-your-availability-away-or-unavailable) 3. [How to manage API keys in Nuvia](https://nuvia.ai/en/docs/artigos/15230128-how-to-manage-api-keys-in-nuvia) 4. [How to deactivate and reactivate a user](https://nuvia.ai/en/docs/artigos/16497565-how-to-deactivate-and-reactivate-a-user) 5. [Security, privacy, and LGPD at Nuvia](https://nuvia.ai/en/docs/artigos/14576039-security-privacy-and-lgpd-at-nuvia) 6. [How to create and manage teams in Nuvia](https://nuvia.ai/en/docs/artigos/15649230-how-to-create-and-manage-teams-in-nuvia) ## Still need help? Customers reach support through the chat inside the platform. Not a customer yet? Talk to our team. [Talk to support in the platform](https://app.nuvia.ai) [I'm not a customer yet](https://nuvia.ai/en/contact) --- Source: https://nuvia.ai/en/docs/artigos/14576039-security-privacy-and-lgpd-at-nuvia