Privacy Policy

011. Two roles, two sets of rules

Almost every question about privacy here depends on whose data is being discussed, so it is worth being precise before anything else.

• For data about our customers — the people and companies who sign up for nulvless — we are the controller. We decide why and how it is processed, and this policy governs it.
• For data about our customers’ End Users — the people who sign in to products built on nulvless — we are the processor. Our customer is the controller. We process that data on their documented instruction, not for our own purposes.

If you are an End User of a product built on nulvless and you want your data corrected or deleted, the company running that product is who to contact. We cannot act on that data without their instruction, because the decision is not ours to make.

022. Data we hold as controller

When you create a nulvless Account we collect your name, email address, and the organization details you provide. If you take a paid plan, our payment processor collects billing details directly; we retain invoices and the last four digits of the payment method, never the full number.

We record how you use the Console — pages visited, features used, actions taken, and the IP address and browser from which you connect — to operate the product, support you, secure the Account and understand what to improve. We keep a record of support conversations.

Our legal bases are performance of our contract with you, our legitimate interest in operating and securing the Service and in understanding product usage, compliance with legal obligations such as tax record-keeping, and consent where the law requires it.

033. Data we process for our customers

What the platform holds about an End User depends on how our customer configures it. It can include:

• Identifiers — email address, phone number and country code, username, and the profile fields our customer chooses to store.
• Credentials — passwords stored only as salted hashes, multi-factor secrets, and single-use recovery codes.
• Linked accounts — the identifier returned by a social identity provider when an End User signs in through it.
• Session records — an IP address, the browser and operating system, the device vendor, model and type, the CPU architecture, and a hash derived from these used to recognise the device.
• Approximate location derived from the IP address — city, region, country, coordinates and time zone. This comes from an offline lookup table, not from device GPS or any location permission.
• Authentication context — the methods used to sign in, the assurance level reached, sign-in times, and whether a session has been elevated.
• Activity and audit — a record of what changed, by whom, on what target and when.
• Delivery records — that a message was sent, to which channel, and its delivery outcome.
• Custom metadata our customer chooses to attach.

We process this to provide the Service: to authenticate people, decide what they may reach, deliver the transactional messages those flows require, protect against abuse, and give our customer the record they need.

We do not sell Personal Data, we do not share End User data for advertising, and we do not use End User data to train machine-learning models.

044. Request logs

Requests to the platform pass through our API gateway, which records the method, path, host, response status, response size, timing, the client IP address, the user agent, and the Project, Environment, session and identity the request belongs to.

Credentials in query strings — tokens, one-time codes and API keys — are masked before the entry is written, leaving only the final four characters. Request bodies are not logged; only the body of an error response is captured, and it is truncated.

These logs are available to the customer whose Project the request belongs to, through the Console and the log query, and are retained according to the plan in force.

055. Website visitors

Our public website sets cookies that are strictly necessary to serve the pages and to remember your theme and language.

Where we use analytics or advertising technologies, they are described in the Cookie Policy, and we ask for consent before any non-essential cookie or tag is set in jurisdictions that require it. You can change or withdraw consent at any time from the cookie settings.

Where those technologies involve sharing identifiers with an advertising partner, that may constitute "sharing" for cross-context behavioural advertising under California law. Section 11 explains how to opt out.

066. Sub-processors

We use the third parties below to run the Service. Each is bound by contract to protect the data it handles and to process it only on our instruction. Changes are notified as described in the Data Processing Addendum.

Customers may configure their own delivery providers instead of ours. When they do, data flows to that provider on their instruction and under their agreement with it, and it is not our sub-processor.

Social identity providers are a different case. When someone signs in with a Google, Apple or other account, what happens to the data that provider holds is decided by the provider, under its own privacy notice. We receive only what the person authorises it to share.

077. International transfers

Personal Data may be processed in countries other than yours, including the United States, as the table above shows.

Where data leaves a jurisdiction that restricts transfers, we rely on an approved mechanism. For the European Economic Area, Switzerland and the United Kingdom that is the Standard Contractual Clauses, together with the UK Addendum where applicable. For transfers subject to the LGPD, we rely on the mechanism permitted under article 33 that applies to the transfer.

We assess the laws of the destination country and apply supplementary measures where required, including encryption in transit and minimising what is transferred.

088. How long we keep data

End User data is kept for as long as our customer keeps it. They can delete an individual record at any time through the Console or the API, and deletion propagates to our systems.

When a customer closes their Account, data remains available for export for thirty days and is then deleted from production systems. Backups follow their own expiry cycle, after which the data is gone from those too; until then it remains subject to the same protections.

Request logs and audit records are retained according to the plan in force, and the retention window is shown in the Console.

We keep what the law requires us to keep, such as invoices and tax records, for the period it requires, and information needed to establish or defend legal claims for as long as that need exists.

099. Security

Data is encrypted in transit using current TLS. Passwords are stored as salted hashes using an adaptive algorithm with a configurable work factor — bcrypt or PBKDF2, selectable per Project — and are never recoverable in plaintext.

Each Project is isolated from every other, and each Environment within a Project holds its own data and its own credentials, so a development environment cannot read production.

Access to production is limited to personnel who require it, and every administrative action is recorded in the audit trail. Credentials in request URLs are masked at the gateway before any log entry is written.

Rate limits and optional bot protection sit in front of the authentication, recovery and lookup endpoints.

No system is perfectly secure. If a breach affects Personal Data we hold as controller, we will notify you and the relevant authority within the time the law requires. Where we are the processor, we notify our customer as described in the Data Processing Addendum.

We do not currently hold a SOC 2 or ISO 27001 certification. This section will be updated when that changes, rather than implying it beforehand.

1010. Your rights

Depending on where you live, you may have the right to access the Personal Data we hold about you, to correct it, to delete it, to receive a portable copy, to object to or restrict processing, to withdraw consent, and not to be discriminated against for exercising these rights.

To exercise these rights over data we hold as controller, write to [email protected]. We will verify your identity before acting, and respond within the time the applicable law allows.

If you are an End User of a product built on nulvless, direct your request to that product’s operator, who is the controller. If they instruct us to act, we will.

You may complain to your supervisory authority. In Brazil that is the ANPD; in the European Union it is the authority for your country; in the United Kingdom it is the ICO.

1111. Regional disclosures

European Economic Area and United Kingdom — the legal bases are set out in section 2. You may object to processing based on legitimate interest, and we will stop unless we can show compelling grounds that override your interests.

Brazil — we process Personal Data under the LGPD on the bases of contract performance, legitimate interest, legal obligation and consent, as applicable. Requests are answered within fifteen days.

California — the categories we may collect are identifiers, commercial information, internet activity and approximate geolocation, as described in sections 2 to 5. We do not sell Personal Data. Where advertising technologies are enabled, identifiers may be "shared" for cross-context behavioural advertising; you may opt out from the cookie settings on our website, and Global Privacy Control signals are honoured once there is something to opt out of. You may also request access, deletion, correction, and the categories of Personal Data disclosed.

1212. Automated decision-making

The Service applies automated rules that our customers configure — rate limits, bot checks and authentication requirements — which can block or challenge a sign-in attempt.

These are security controls rather than profiling to evaluate personal aspects, and they do not produce legal effects on their own. The decision to admit or refuse a person to a product remains the customer’s.

We do not carry out automated decision-making producing legal or similarly significant effects on the Personal Data we hold as controller.

1313. Children

The Service is not directed at children under 13 — the threshold set by the Children’s Online Privacy Protection Act in the United States — and we do not knowingly collect Personal Data from them as controller. If you believe a child has provided us Personal Data, write to the privacy contact and we will delete it as soon as possible.

Where a higher age applies to you, that age governs. In the European Economic Area, article 8 of the GDPR sets 16 unless your country has lowered it, and it may not be lowered below 13. In Brazil, the LGPD requires specific and highlighted consent from at least one parent or legal guardian to process the data of a child, meaning someone under 12.

Our customers may build products used by children. Meeting the requirements that apply to those products — age verification, parental consent, and the best-interest principle — is their responsibility as controller, not ours as processor.

1414. Changes to this policy

We may update this policy. Where a change is material, we will notify customers by email or in the Console before it takes effect.

1515. Contact

Write to [email protected], or to NULVLESS CLOUD LTDA, R. Amélia Rodrigues, Cond. Vila Olímpica 1, CEP 44.430-716, Santo Antônio de Jesus, BA, Brazil.

For data protection matters specifically, our contact is [email protected].