Privacy policy

How Nerova handles data, and the responsibilities we share with the platforms we work with.

Last updated: 2026-10-16

Roles and responsibilities

Nerova is an API-first SaaS for platforms. The host platform keeps its customer relationship and its authoritative records. For end-customer data handled during a controlled operation, the host platform acts as the data controller and Nerova acts as a processor on its documented instructions. For account data belonging to platform teams with Nerova accounts, Nerova is the controller.

Data we process

The Testing environment runs against deterministic fixtures. Fixture data is synthetic; no real end-customer records are required to evaluate an integration.

Platform account data: names, work email addresses, and authentication records for the people who operate a Nerova integration.
Operational data: conversation context, service and availability lookups, appointment requests, and the explicit outcomes returned to the host platform.
Diagnostic data: request logs and error records used to keep operations verifiable.
WhatsApp channel data: when a business connects the WhatsApp Business Platform, we process WhatsApp phone numbers, message content, and delivery metadata to run receptionist conversations. The business owns its WhatsApp Business Account, and this data is exchanged with Meta Platforms under Meta's WhatsApp Business terms. End-customer messaging happens only after the end customer starts a conversation or has opted in through the business, and WhatsApp channel data follows the same use and retention rules described here.

How we use data

We use operational data to execute the capabilities a platform has declared, to return explicit outcomes, and to produce the receipts that verification depends on. We do not sell personal data or use end-customer data for advertising.

Retention

Operational records are retained for the period defined in the platform's operational contract, then deleted or de-identified. Account data is retained while an account remains active and removed on verified deletion requests, subject to legal holds.

Subprocessors

We use a small number of infrastructure subprocessors to run the service. A current subprocessor list, including processing locations, is available to platforms on request and is provided during Production review.

Your rights

Platform team members can access, correct, or delete their account data by contacting us. End customers should direct requests to their booking platform first, which holds the authoritative record, and we support the platform in fulfilling them within processor timelines.

Data deletion

You can ask us to delete your data at any time. There are three ways to do it.

When Meta sends us a request, we check its signature and record it. We then give Meta a confirmation code and a link to a status page that shows the date we received the request. If the request matches a customer whose WhatsApp messages we store, we erase that customer's messages, conversations and remembered details, and redact personal fields in outcome and booking records. If we cannot match it to stored data, we follow up on it ourselves using the confirmation code.

Account data is removed on verified deletion requests, subject to legal holds. We respond to verified requests within 30 days.

Ask us directly: use the contact form, select the privacy topic, and tell us what to delete.
In Nerova: a business owner can disconnect WhatsApp in the Nerova companion or console. This deletes the stored WhatsApp access token and account record and releases the number.
On Facebook: go to Settings & privacy, then Settings, then Apps and websites, and remove Nerova Systems. Meta then sends a data deletion request to Nerova.

Contact

For privacy questions and requests, contact us and select the privacy topic. We respond to verified requests within 30 days.

This policy summarizes our privacy posture in plain language. The executed data processing agreement between Nerova and a host platform governs where the two differ.

This page needs JavaScript to show its interactive parts.