Legal
Platform privacy
Last updated: 3 October 2026
It explains how we handle personal data when you use the platform and when your agent answers calls.
1. Two different roles
- Data controller: Nauva Era Technology, Unipessoal Lda. (NIF 519055799), for your account data (name, email, billing, platform usage).
- Processor: Nauva, for the data of the people who call your business. In that case you are the controller and the DPA applies.
2. Data we process
- Account data: name, email, phone, company, plan and billing.
- Configuration data: business information, schedules, teams, locations and services.
- Call data: the caller's number, recording, transcript, summary and data the person provides (for example name and reason for the call).
- Technical data: IP address, device and usage logs, for security and to improve the service.
- Communications: messages you send us by email or through forms.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Providing the service and managing the account | Performance of the contract | While the account is active |
| Call recordings and transcripts | Performance of the contract (on behalf of the customer) | 90 days by default, configurable by the customer |
| Contact and lead data | Performance of the contract (on behalf of the customer) | Up to 3 years after the last contact |
| Billing and tax obligations | Legal obligation | 10 years |
| Security and abuse prevention | Legitimate interest | Up to 3 months |
| Communications about the service and news | Legitimate interest or consent | Until you withdraw consent |
4. Calls and recording
The agent identifies itself as AI and informs that the call may be recorded. You, as controller, decide whether to keep recordings and transcripts and you can view, export or delete calls on the platform.
5. Sharing and sub-processors
We use service providers strictly to provide the service, under contracts that require adequate protection of the data. The categories are hosting, voice and telephony, payments and analytics. We do not sell personal data.
The updated list of sub-processors is available on request, at contact@nauva.ai.
We only disclose personal data to public authorities when a legally valid request requires it, after checking its validity, and we limit the disclosure to what is strictly necessary.
6. Location and international transfers
Some of our providers process data outside the European Economic Area, in the United Kingdom and the United States. Those transfers use adequate safeguards provided for in the GDPR, such as adequacy decisions and standard contractual clauses. The list of sub-processors is available on request at contact@nauva.ai.
7. WhatsApp
When the WhatsApp channel is available, Meta, which operates WhatsApp, will process messages as a sub-processor. Conversation data follows the same rules as calls, and you can ask for it to be deleted through Data deletion.
8. Security
We apply appropriate technical and organisational measures, such as access control, encryption in transit, audit logs and separation between customer accounts.
If there is a personal data breach, we notify the CNPD within 72 hours when the law requires it and inform affected customers without undue delay.
9. Your rights
You can request access, rectification, erasure, restriction, objection and portability, and withdraw consent where that is the legal basis. Write to contact@nauva.ai. We reply within 30 days.
If the data belongs to someone who called your business, we forward the request to you, as the controller. You can also lodge a complaint with the Comissão Nacional de Proteção de Dados (cnpd.pt), the Portuguese data protection authority.
10. Minors
The platform is intended for people who are at least 18 years old and we do not knowingly collect data from minors. If we become aware that this has happened, we delete the data.
11. Artificial intelligence
The agents use AI to talk to people. How they work and their limits are described in Transparency and AI.
12. Website privacy
The processing of data of people who visit the site is in the website Privacy Policy and cookies are in the Cookie policy.
Questions about this document? Write to contact@nauva.ai.