1. Scope
This Privacy Policy applies to the Nuvareq public website, account and customer portal, onboarding and assistant-configuration workflows, administrative operations, and related voice, SMS, billing, and support services.
2. Information we collect
Depending on how you use Nuvareq, we may collect:
- Account and contact information, such as name, business name, email address, role, and login-related records.
- Business configuration, including services, hours, locations, FAQs, lead questions, booking and transfer rules, disclosures, and other onboarding answers you provide.
- Call and messaging information, such as provider identifiers, caller details collected under your configured workflow, timestamps, duration, outcomes, structured quality summaries, consent and delivery state, and related operational records. Retained full call recordings and full transcript text are disabled for the current launch posture.
- Usage and subscription information, including plan, included and used minutes, billing-cycle dates, subscription state, invoices or checkout references, and overage records. Stripe processes payment-card information through its hosted services; Nuvareq does not ask you to send full payment-card details through the website or support email.
- Technical and security information, such as IP-derived request information, browser and request metadata, rate-limit records, session records, audit events, errors, and provider webhook status.
- Lead, appointment, and workflow records, including contact details, requested services or times, status, provider identifiers, and the configuration or integration used for the workflow.
- Demo and public inquiry information, including preview inputs, business details, contact information, consent, rate-limit, and anti-abuse records.
- Privacy, consent, suppression, compliance, and support records, including rights requests, opt-outs, complaints, registration evidence, legal-acceptance records, and operational decisions.
- Sales and support inquiries, including the information submitted through the contact form or email.
Nuvareq does not request sensitive personal information through public signup or support channels. The service is not designed for intentional collection of health, biometric, precise geolocation, financial-account, children’s, or other sensitive information unless a separately approved workflow and lawful basis exist. Customers remain responsible for notices, consent, minimization, and instructions when their configuration could collect sensitive information.
3. How we use information
We use information to provide and secure accounts; preserve tenant boundaries; configure, review, publish, and operate assistants; process subscriptions and usage; provide lead, call, appointment, SMS, workflow, and activity views; support team and notification controls; respond to inquiries and privacy requests; detect abuse and errors; maintain audit history; and improve the reliability and usability of the service. Nuvareq does not make credit, employment, housing, insurance, healthcare, government-benefit, legal, or other high-impact eligibility decisions, and we do not use customer content to provide legal, medical, financial, emergency, or other licensed professional advice.
We collect information directly from you, your business, callers or recipients through configured workflows, service providers, customer-selected integrations, and automated interactions with the service. For customer-configured data, the customer generally determines the purposes and means of processing and is responsible for its notices, instructions, lawful basis, and responses to data-subject requests.
4. Service providers and integrations
Nuvareq relies on service providers to operate the product, including cloud hosting and database services, Stripe for billing, voice and AI providers such as Vapi, communications providers such as Twilio and Telnyx, email or notification services such as Resend, and workflow, calendar, or customer-selected integration providers where configured. For customer-configured caller and business information, the customer generally determines the purposes and means of processing and may be the controller or business, while Nuvareq may act as a service provider or processor where applicable. The allocation depends on the service and applicable law. Information is shared with these providers only as needed for the relevant service, subject to their own terms, privacy practices, retention settings, and acceptable-use rules.
Nuvareq does not sell personal information for monetary consideration and does not share personal information for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics or for purposes beyond those permitted by applicable law. Necessary cookies, session cookies, and browser storage may support authentication, security, preferences, rate limiting, and vendor-neutral product analytics events; disabling them can affect functionality. Optional analytics, if enabled, are limited to disclosed product-improvement events. Third-party providers may use their own cookies or similar technologies under their own policies. The public site does not intentionally use third-party advertising pixels; browser settings can restrict cookies, although some functionality may stop working.
5. Caller information, recording, and SMS
Nuvareq customers control the business-specific information, disclosures, collection fields, and escalation rules used by their assistant. Customers are responsible for providing legally required notices and obtaining required consent for recording, data collection, outbound calling, commercial email, and messaging in the jurisdictions where they operate and where callers or recipients are located. If a customer configures outbound communications, the customer must maintain the applicable lawful-purpose, consent, sender-identity, suppression, quiet-hours, and opt-out records. SMS follow-up is available on eligible plans only after required business registration, compliance review, carrier approval, and sender activation. Payment or plan eligibility alone never activates messaging.
6. Retention
We retain information for as long as reasonably needed to provide the service, maintain billing and audit records, resolve disputes, protect security, and meet applicable obligations. Retention decisions consider the data class, service purpose, provider settings, account status, legal holds, backup limits, and the time needed to investigate or defend a claim. The current launch posture does not retain full call recordings or full transcript text; structured call quality, lead, appointment, workflow, consent, and activity records may still be retained according to the applicable account, provider, and operational settings. Provider systems may apply their own retention periods, and deletion from Nuvareq may not immediately remove copies held by a provider or backup. Where applicable law requires notice of a security incident, Nuvareq will provide notice through the required process and timing.
7. Security
Nuvareq uses role-based and tenant-scoped authorization, separate customer and platform-admin access, server-side plan and entitlement checks, masked provider credentials, reviewed publishing, rate limits, and authenticated provider event paths. No internet service can guarantee absolute security. Do not send passwords, API keys, full payment-card details, or unnecessary sensitive caller content through email or the public contact form.
8. Your choices and requests
Depending on your location and applicable law, you may have rights to request access to, correction of, deletion of, or a copy of personal information, or to opt out of certain processing. Those rights may include opting out of sale, sharing, targeted advertising, certain profiling, or processing of sensitive data, as well as appeal or universal opt-out rights where a law provides them. You can update business configuration through the customer portal, manage supported billing settings through Stripe, and contact Nuvareq to start an account-information, correction, access, or deletion request. Current self-service privacy execution supports verified account closure and deletion intake; other request categories may require additional verification and a supported lifecycle workflow before execution. Some records may need to be retained for billing, security, legal, or audit reasons. We may need to verify identity and account authority before acting on a request. Where a privacy law provides a response deadline, appeal process, authorized-agent process, universal opt-out signal, or right to nondiscrimination, Nuvareq will follow that law's requirements where applicable. We may require an authorized agent to use the supported verification and authorization process and may decline an unverified request. A customer-configured caller or lead should generally direct a request to the business that collected the information; Nuvareq will assist that customer where the applicable contract and law require it.
9. Children
Nuvareq is a business service and is not directed to children. Customers should not configure the service to intentionally collect children's information unless they have established an appropriate lawful and operational basis.
10. U.S. processing and international access
Nuvareq is designed for the current U.S. launch scope. If you access the service from another country or configure an international workflow, information may be processed in the United States or in locations used by the applicable providers, subject to provider terms and any separately approved data-processing or transfer terms. International or cross-border processing is not enabled by this policy alone.
11. Changes to this policy
We may update this policy as the product, providers, or legal requirements change. We will post the revised effective date on this page. Material changes may also be communicated through the service when appropriate. If Nuvareq is involved in a merger, acquisition, financing, reorganization, sale of assets, or insolvency proceeding, information may be transferred as part of that transaction subject to applicable confidentiality, security, and legal requirements. Generic browser “Do Not Track” signals are not a universal opt-out by themselves; legally recognized opt-out signals will be handled where applicable law requires.
12. Contact
For privacy questions or requests, use the contact form or email nuvareq@nuvareq.com. Include the business name and enough information to identify the account, but do not include secrets or payment-card details.