Privacy Policy

1. Who We Are

NovaCiel LLC ("NovaCiel", "we", "us", or "our") is an AI consulting and business automation agency based in Orlando, Florida, United States. We operate the website novaciel.tech and provide consulting, diagnostic, implementation and managed-system services to businesses.

If you have questions about this policy, contact us at: corp@novaciel.tech

2. The Two Roles We Play

This policy covers two different situations, and the rules are not the same for each one.

• —When we decide. If you visit novaciel.tech, contact us, or hire us, NovaCiel decides how your information is used. In that situation we are the controller of your data.
• —When our client decides. If we build or operate a system for one of our clients — a WhatsApp assistant, a voice agent, an automation — that system handles data belonging to that client's own customers. NovaCiel does not decide what happens to that data; the client does. In that situation we act only as a processor following the client's instructions (Encargado del Tratamiento under Colombian Law 1581 of 2012).

Sections 3, 4 and 12 describe the first situation. Sections 5, 6 and 13 describe the second.

3. Information We Collect

We collect information you provide directly to us:

• —Contact information: Name, email address, phone number, and company name when you book a meeting or contact us.
• —Meeting data: Information collected through Calendly when you schedule a diagnostic session.
• —Business information: Details about your company and operations shared during the diagnostic process.
• —Usage data: Standard web analytics including pages visited, time on site, and device information.

4. How We Use Your Information

We use the information we collect to:

• —Schedule and conduct diagnostic sessions and consultations
• —Deliver services and deliverables agreed upon in our engagement
• —Send confirmations, updates, and information relevant to your project
• —Improve our services and website
• —Comply with legal obligations

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

5. Data We Process on Behalf of Our Clients

Our clients hire us to build and operate systems that speak with their customers. Depending on the service, those systems may handle a customer's name, phone number, email address, the content of the conversation, appointment or booking details, and any information the customer provides in order to be served.

This data belongs to the client, not to us. Our commitments regarding it:

• —We process it only on the documented instructions of the client who owns it.
• —We do not use it for our own purposes, we do not sell it, and we never add it to our own marketing lists.
• —We do not use it to train artificial intelligence models, and we contract our providers on terms that prohibit them from doing so.
• —We never share one client's data with another client.
• —Access is nominal and restricted to the NovaCiel personnel who operate that specific system.

Every engagement of this kind is governed by a written data processing agreement with the client, which defines the scope, the purposes, the security obligations, and what happens to the data when the engagement ends.

If you are a customer of one of our clients and want to exercise a right over your data, the business you dealt with is the one responsible for it, and contacting them directly is normally faster. You may also write to us and we will forward your request to that business within five business days.

6. WhatsApp Business Platform and Meta

Some of our clients ask us to operate their customer service on WhatsApp. In those cases NovaCiel acts as the technology provider for the business, and the business remains responsible for its own customers' data.

Messages are transmitted, and may be stored, by Meta Platforms, Inc. under Meta's own terms and privacy policy. When you write to a business on WhatsApp, the system we operate on that business's behalf may access your phone number, your WhatsApp profile name, and the content of the messages you exchange with that business — solely to answer you, to keep a record of the conversation for the business, and to complete what you asked for.

• —Automated assistants always identify themselves as assistants. They never present themselves as a human being.
• —We send promotional messages only to people who gave prior, express and informed consent. We keep a record of that consent, including the date, the time, and the exact text that was accepted.
• —You can stop promotional messages at any time and free of charge by replying with the opt-out word published in the conversation (for example STOP or BAJA). This does not affect messages about a booking or order already in progress.
• —We do not use WhatsApp data for advertising, we do not sell it, and we do not share it with other clients.

Your use of WhatsApp is also subject to WhatsApp's Privacy Policy and to Meta's WhatsApp Business Messaging Policy, over which NovaCiel has no control.

7. Google User Data and API Services

When a client authorizes us, NovaCiel accesses certain data from their Google Account through Google APIs, strictly to operate the specific service the client requested. This may include Google Business Profile data (business locations and customer reviews) to read reviews and post replies on the business's behalf, and Google Sheets data to read and record information (such as leads or promotions) in spreadsheets the client shares with us. We only access the data needed to provide the requested service, and we never use it for advertising or sell it.

Limited Use. NovaCiel's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google user data to provide or improve the user-facing features the client requested, and we do not transfer or sell it to third parties except as necessary to provide the service, comply with the law, or as part of a merger or acquisition.

8. Third-Party Services and Sub-Processors

We rely on the following providers to operate our business and the systems we build. Each one processes data only to the extent its function requires:

• —Calendly: Scheduling meetings. Subject to Calendly's own privacy policy.
• —Notion: Delivering diagnostic reports and project documentation.
• —Google Analytics: Website analytics. Data is anonymized and aggregated.
• —Meta Platforms, Inc.: Transmission and delivery of WhatsApp messages for clients who use that channel.
• —AI model providers (such as Anthropic and OpenAI): Generating assistant responses. We contract them under terms that do not permit training on the data we send.
• —Hosting and automation infrastructure: Servers and workflow tools under our control, used to run the systems we build.
• —Telephony providers: Call routing and transcription for clients who use a voice agent.

On request, we give each client an up-to-date list of the specific sub-processors used in their project.

9. International Data Transfers

NovaCiel LLC is established in the United States. Information we handle may be transferred to, stored in, and processed in the United States and in other countries where our providers operate, which may have data protection rules different from those of your country.

For clients and end users in Colombia, these transfers are carried out under Law 1581 of 2012 and Decree 1377 of 2013. Where NovaCiel acts as processor, the transfer is governed by a written transmission agreement (contrato de transmisión de datos) with the controller, which sets out the scope of the processing, its purposes, the security obligations, and the duty to preserve the rights of the data subject.

We apply the same protections to this information regardless of where it is processed.

10. Data Retention

We keep information only as long as there is a reason to keep it:

• —Enquiries and website contacts: up to 24 months after the last contact, unless you ask us to delete them sooner.
• —Client engagement records: for the duration of the engagement and up to 3 years afterwards, to meet legal, tax and contractual obligations.
• —Data processed on behalf of a client: only for as long as that client instructs. When an engagement ends we return it or delete it within 30 days, unless the law requires otherwise.
• —WhatsApp and voice conversation content: for the period the client defines, and by default no longer than 12 months.
• —Consent and opt-out records: for as long as needed to prove that consent was given and that the opt-out was honoured. A withdrawal of consent is recorded, not erased.

Copies held in routine backups are purged on the normal backup cycle, within a maximum of 90 days.

11. Security

We take data security seriously. All client deliverables are shared through access-controlled environments. Access to the systems we operate is nominal and restricted to the people who need it, protected with two-factor authentication wherever the platform supports it. We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, or disclosure.

12. Your Rights

You have the right to:

• —Access the personal information we hold about you
• —Request correction of inaccurate or incomplete data
• —Request deletion of your data
• —Opt out of any marketing communications
• —Withdraw a consent you previously gave, at any time
• —Lodge a complaint with the competent data protection authority. In Colombia, this is the Superintendencia de Industria y Comercio (SIC).

To exercise any of these rights, contact us at corp@novaciel.tech.

13. How to Request Deletion of Your Data

When we delete your data we remove it from our active systems and from the systems we operate for the client concerned. We may retain the minimum necessary to comply with a legal, accounting or tax obligation, and the record proving your request was handled. Copies held in backups are removed on the normal backup cycle, within a maximum of 90 days.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the date at the top of this page. Continued use of our services after any changes constitutes acceptance of the updated policy.

15. Contact

For any questions about this Privacy Policy, please contact us at: