NexHub AI

Privacy Policy

In force from 17 August 2026 · version 1.0

In this document

Who we are
What we collect
Why we process it, and our lawful basis
About the AI agents
Who we share it with
Where your data is held
International transfers
How long we keep it
Security
Your rights
Cookies
Children
Changes
Contact and complaints

1. Who we are

NexHub AI is a trading name of GRUPO GAROTO PROPAGANDA, a company registered in Brazil under national company number (CNPJ) 15.357.885/0001-58.

We say this plainly rather than bury it: we are a Brazilian company. We are not registered in the United Kingdom or in any EU member state. What we do have is our infrastructure inside the EU — the servers holding your data are in France, as set out in section 6.

We are the controller for personal data of people who contact us directly through this website, our WhatsApp or our platform.

Where we build and run an AI agent for one of our clients, that client decides what is collected and why. In that case the client is the controller and we act as their processor. If you spoke to an agent on a clinic's or a shop's WhatsApp, that business is responsible for your data and is who you should contact — we can help pass a request on.

2. What we collect

When you contact NexHub AI

Identity and contact details: name, email address, WhatsApp number, company name.
The content of your messages, including any audio, images or documents you send. Audio is transcribed into text so the agent can understand it.
Business information you give us so we can quote: sector, volume of enquiries, what you want to solve, timescale.
Technical records: date and time of messages, a conversation identifier and, in the website chat, the page you wrote from. We also count messages per period to prevent abuse.

If you use our platform

Email address, password (stored only as an irreversible hash, never in readable form) and sign-in records.

We do not ask for special category data and we do not need it. Please do not send our agents card numbers, passwords, health information or identity documents — none of that is needed to prepare a quote. If you send it anyway, we delete it.

3. Why we process it, and our lawful basis

Purpose	Lawful basis (Art. 6 UK/EU GDPR)
Replying to you and preparing a quote	Steps prior to entering a contract — Art. 6(1)(b)
Delivering the service and supporting you	Performance of a contract — Art. 6(1)(b)
Security, fraud prevention, abuse control	Legitimate interests — Art. 6(1)(f)
Improving the quality of our service	Legitimate interests — Art. 6(1)(f)
Following up and marketing messages	Consent — Art. 6(1)(a)
Accounting and tax records	Legal obligation — Art. 6(1)(c)

Where we rely on legitimate interests, we have weighed our interest in running and protecting the service against your rights. You can object at any time — see section 10.

We do not use your conversations to train AI models — neither ours nor anyone else's. Your content is used to serve you and nothing further.

4. About the AI agents

The agent identifies itself and does not pretend to be a person.
To produce a reply, the content of your message is sent to the model provider named in section 5.
The conversation is stored so the agent can follow the thread — without it, it would start from nothing each message.
You can ask for a human at any point and the conversation is handed over.
No decision producing legal effects or similarly significant effects on you is taken by the agent alone. Contracts, prices and terms go through a person. This means Art. 22 automated decision-making does not apply to our service.

We do not sell personal data and we do not pass it to third parties for their own advertising. We share only with the processors that make the service work:

Who	What for	Where they process
Hosting provider	Hosting — the server the system runs on and where data is stored	France (EU)
Large language model provider	Generates the agent's replies, transcribes audio, produces speech	United States
Content delivery and security provider	Serves and protects this website	Global network
Meta Platforms	WhatsApp itself, the channel the conversation travels on	United States and elsewhere

We may also disclose data where we are under a legal obligation to do so.

6. Where your data is held

The system runs on a server in France, inside the European Union. Backups are held in the same environment. Your data is not stored in Brazil.

Our team administers the system from Brazil, which means staff there can access it. That access is an international transfer, covered in the next section.

7. International transfers

Two transfers happen outside the UK and the EEA:

To the United States, when message content is sent to our large language model provider to generate a reply.
To Brazil, when our team accesses the system to operate and support it.

These transfers are made under the safeguards in Art. 46 UK/EU GDPR, including Standard Contractual Clauses (and, for the UK, the International Data Transfer Addendum) with the providers concerned. You may request further information about the safeguards in place using the contact details in section 14.

8. How long we keep it

Data	Retention
Conversations with enquirers who did not become clients	up to 24 months from last contact
Client data	for the duration of the relationship
Accounting and tax records	as required by law, generally 5 years
Platform sign-in records	6 months
Backups	up to 90 days, then overwritten

After that, data is deleted or anonymised. A deletion request may take up to one full backup cycle to propagate to every copy.

9. Security

HTTPS encryption on all pages and integrations.
API keys and passwords stored encrypted, never in readable form.
Authenticated platform access, with clients able to see only their own data.
Rate limiting against abuse and automated misuse.
Daily verified backups.

If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and tell you where the law requires it.

10. Your rights

Under the UK GDPR and the EU GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased in the circumstances the law allows;
restrict how we process it;
data portability — receive your data in a machine-readable format;
object to processing based on legitimate interests, and to direct marketing at any time, with no reason needed;
withdraw consent where we rely on it, without affecting what was lawful beforehand.

Write to [email protected]. We respond within one month. We may ask for information to verify your identity — that protects you, it is not an obstacle. Exercising these rights is free.

11. Cookies

This site uses only what is strictly necessary to work and to stay secure — no advertising cookies and no third-party tracking. If that ever changes, we will ask for your consent first, and you will be able to refuse without losing access to the site.

12. Children

Our services are aimed at businesses and at adults. We do not knowingly collect data from children. If we find that we have, we delete it.

13. Changes

We may update this policy. The date at the top shows the version in force. We will tell you about significant changes through the channels you use to reach us.

14. Contact and complaints

GRUPO GAROTO PROPAGANDA (trading as NexHub AI)
CNPJ 15.357.885/0001-58 — Brazil
Data protection contact: [email protected]

If you are unhappy with our response you can complain to your data protection authority. In the United Kingdom that is the Information Commissioner's Office (ICO), at ico.org.uk. In the EU it is the supervisory authority of the country where you live.