Privacy Policy

1. Introduction

This policy explains how Nuv Tools handles personal data: which data, why, on what legal basis, who it is shared with, how long it is kept and how you exercise your rights. It covers the nuvtools.com site, Nuv Tools Account (account.nuvtools.com) and the Nuv Tools products, and follows Brazil's General Data Protection Law (LGPD, Law 13,709/2018). Cookies are covered in detail in the Cookie Policy, which complements this one.

2. Who we are

Nuv Tools Technology Brasil Ltda, CNPJ 38.129.015/0001-27, builds cloud software: Nuv Tools Account, the single account for all of our products; Data Provider, a data API platform; and the Clinuv and LivCar products. For the data described here we are the controller, except where this policy says we act as a customer's processor.

3. Definitions

• Personal data: information about an identified or identifiable natural person.
• Data subject: the person the data is about.
• Processing: any operation on personal data, such as collecting, using, storing, sharing and deleting it.
• Controller: whoever decides how the data is processed.
• Processor: whoever processes data on the controller's behalf.
• Data protection officer (encarregado): the channel between the controller, data subjects and Brazil's National Data Protection Authority (ANPD).

4. Data we process

4.1. Site visitors

The site is informational: it has no forms, asks for no registration and uses no analytics or advertising tools. The hosting provider records technical data about each request (IP address, browser, page address and time) to serve and protect the site; we do not use these records to identify visitors. If you pick a language with the switch at the top, that choice is kept in your browser only.

4.2. People who contact us

When you write to us by e-mail or WhatsApp, we process what you send: your name, e-mail address or phone number, company and the content of the message.

4.3. Nuv Tools Account

• Account data: first and last name and e-mail, whether the e-mail is confirmed, when the account was created and when you last signed in.
• Credentials: your password, stored only as an irreversible hash; the public keys of your passkeys; your authenticator app key and recovery codes, when you turn on two-step verification.
• Linked sign-ins: when you sign in with Microsoft or Google, the identifier that provider gives your account, and the name and e-mail it shares. For a work account, the Microsoft Entra tenant identifier.
• Organizations: the organizations you belong to, your role in each and the invitations you send or receive, including the invited e-mail.
• Security records: your account's security events (sign-ins, failed attempts, password and two-step verification changes, tokens issued to the products), each with its source IP address.

4.4. Products

The products use your Nuv Tools Account to know who you are and record how your organization uses them, such as calls to the Data Provider APIs, for billing, usage limits and security. Data your organization puts into a product to process other people's data (patients, customers, vehicles) belongs to it: in those cases the organization is the controller and Nuv Tools acts as its processor, under the contract with the customer.

We do not process payment data on the site or in Nuv Tools Account, we do not use personal data for advertising and we do not sell it.

5. Purposes

• Serving and protecting the site and the services.
• Answering people who contact us and running the business relationship that follows.
• Creating and keeping your account, signing you in to our products and letting you manage your organizations.
• Sending the messages the service needs, such as e-mail confirmation, password reset and invitations.
• Providing the contracted services, measuring their use and billing for it.
• Protecting accounts and services: limiting attempts, detecting abuse and investigating incidents.
• Meeting legal and regulatory obligations and exercising rights in legal proceedings.

6. Legal bases

• Performance of a contract and pre-contractual steps (art. 7, V): account, sign-in, service messages, providing the products and answering contact requests.
• Legitimate interest (art. 7, IX): security of the site, accounts and services, and technical access records.
• Legal or regulatory obligation (art. 7, II): keeping records and answering authorities when the law requires it.
• Exercise of rights (art. 7, VI): defense in judicial, administrative or arbitration proceedings.

7. Data sharing

The following providers process data on our behalf, only for the purposes above:

• Microsoft Azure: hosts the site, Nuv Tools Account, the products, the databases, the keys and the logs.
• Twilio SendGrid: delivers the service's e-mails.
• Microsoft 365: receives and stores the e-mails you send us.
• Microsoft and Google authenticate you only when you choose to sign in with them; their privacy policies apply to that sign-in.

Otherwise we share personal data only when the law, a court order or a competent authority requires it.

8. International transfers

Nuv Tools Account and the products run in Microsoft Azure regions in the United States, and Twilio SendGrid delivers e-mail from there. These transfers follow art. 33 of the LGPD, with providers bound by contract to protect the data at a level compatible with Brazilian law.

9. Information security

Traffic is always encrypted. Databases are reachable only from our private networks, signing keys and certificates are kept in key vaults, passwords are stored only as hashes and every sign-in method can be protected by a second step. Staff access to the environments is restricted, personal and logged.

10. Retention and disposal

• Account data, credentials, linked sign-ins and organization memberships: for as long as the account exists.
• Nuv Tools Account security records: 90 days.
• Contact messages: for as long as they are needed for the request and the business relationship.
• Database backups: 7 days after the data leaves the database.

When the period ends, the data is deleted or anonymized, unless the law allows or requires it to be kept longer.

11. Your rights

Under art. 18 of the LGPD you can ask us at any time for:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of data that is unnecessary or processed unlawfully;
• portability of your data;
• deletion of data processed with your consent, including the whole account;
• information about who we share your data with;
• review of decisions made solely by automated processing.

Write to privacy@nuvtools.com, preferably from your account's e-mail; we may ask you to confirm your identity first. Your name, password, passkeys, two-step verification and linked sign-ins can be changed at any time on your account's security page. You can also lodge a complaint with the ANPD.

12. Limits on these rights

Some requests can be met only in part when the law requires us to keep the data, when it is needed to exercise rights in legal proceedings, or when meeting the request would expose other people's data or trade secrets. In those cases we explain why. Requests about data a customer organization puts into a product are passed on to that organization, which is the controller.

13. Cookies and similar technologies

The site uses no cookies. Nuv Tools Account uses only the cookies it needs to keep you signed in and to protect sign-in. We use no analytics or advertising cookies. The details are in theCookie Policy.

14. Security incidents

If a security incident may cause relevant risk or harm to data subjects, we notify the ANPD and the people affected, as art. 48 of the LGPD requires, stating what happened, which data was involved and what was done about it.

15. Data protection officer (DPO)

The Nuv Tools data protection officer is reached at privacy@nuvtools.com, the channel for data subjects and for the ANPD.

16. Changes to this policy

We review this policy whenever we change how we handle data. When it changes in substance, the date at the top changes and, if the change affects how your Nuv Tools Account data is used, we tell you by e-mail.

17. Contact

Nuv Tools Technology Brasil Ltda · CNPJ 38.129.015/0001-27
Privacy and data protection officer: privacy@nuvtools.com