Comprehensive Privacy Notice

1. Controller and scope

Hillflare, S.A.P.I. de C.V. ("Hillflare", "NuTalk", "we", "us") is the controller of personal data it processes to operate the website, create and administer accounts, bill, provide support, and deliver NuTalk services directly. Our address and contact details appear at the end of this Notice.

NuTalk is a business platform for building and operating artificial-intelligence agents, telephony, messaging, campaigns, CRM, appointment scheduling, calendars, and integrations. This Notice applies to nutalk.ai, NuTalk applications, the dashboard, APIs, widgets, and related services.

When a customer uses NuTalk to process data about its own contacts, patients, prospects, employees, or end users, the customer normally determines the purposes and is the controller; Hillflare acts as a processor following its instructions. The customer must provide its own notice, obtain required consents, and configure the Service lawfully.

2. Personal data we process

3. Sources of data

• Directly from you when you register, purchase, configure the Service, contact us, or connect an account.
• From the organization that invites you to or administers your workspace.
• From customers that upload contacts or connect channels, CRM, calendars, and other platforms.
• From people who interact with an agent, number, widget, or campaign operated through NuTalk.
• Automatically from the Service and, at your direction, from providers such as Google, Microsoft, Meta, Stripe, telephony providers, and CRM platforms.

4. Purposes of processing

5. Artificial intelligence and automated processing

NuTalk may transcribe audio; generate responses, speech, and summaries; classify interactions; extract tasks; evaluate agents; and execute configured actions. Relevant content may be sent to local models or contracted AI providers, subject to access controls, confidentiality, and customer instructions.

AI output can be wrong. Customers must apply appropriate human oversight, especially in health, employment, credit, professional services, and other high-impact uses. NuTalk is not designed to make decisions by itself that produce legal effects or significantly affect rights without human review.

We do not use customer content or Google Workspace data to train general-purpose AI models without separate, express authorization. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

6. Google Calendar and Microsoft Outlook data

• Availability: we read free/busy periods to avoid conflicts when presenting a host’s bookable times.
• Appointment management: we create events and, when the host selects it, invitations and Google Meet or Microsoft Teams links; we update or delete only events tied to appointments managed by NuTalk.
• Per-host authorization: connections, grants, and tokens are isolated by organization and host. We do not let another customer use the host’s connection.
• Restricted use: we do not sell calendar data or use it for advertising, ad profiles, surveillance, or training general-purpose AI, and humans do not read it except when needed for security, user-requested support, legal compliance, or with consent.
• Control: the host may disconnect in NuTalk and revoke access in Google or Microsoft security settings. Once disconnected, synchronization stops and tokens are deleted or blocked according to technical and legal retention periods.

7. Consent and legal grounds

We process data to perform the legal relationship and requested Service, comply with legal duties, protect security, and—where law requires—with express or implied consent after making this Notice available. Consent may be withdrawn without retroactive effect by contacting privacy@nutalk.ai.

Financial or property data is processed with express consent unless a legal exception applies. Sensitive personal data requires express written consent or an equivalent authentication mechanism unless law permits otherwise. A customer that determines such processing is responsible for obtaining and documenting that consent.

8. Processors, third parties, and transfers

We may engage providers for infrastructure, databases, hosting, security, operational analytics, email, payments, AI, speech, telephony, and support. They may include Supabase, Vercel, Cloudflare, Stripe, OpenAI, ElevenLabs, Twilio, Telnyx, and email providers. We also transmit data to Meta, Google, Microsoft, Cal.com, HubSpot, Kommo, or another integration when the customer activates it. The applicable list depends on selected features.

Processors receive only what is needed for their function and are subject to contractual confidentiality, security, and processing instructions. We do not sell or rent personal data.

Data may be processed in Mexico, the United States, and other countries where our processors or selected integrations operate. We use reasonable contractual and technical safeguards and communicate this Notice and the purposes when required.

9. Retention and deletion

We keep data only as long as needed for the stated purposes, the contractual relationship, customer retention settings, and legal periods. We then delete, anonymize, or block it while liabilities remain enforceable.

• Account and workspace data: while active and for a limited period after termination for closure, recovery, security, and claims.
• Messages, recordings, transcripts, contacts, and campaigns: according to the plan, configuration, and customer instructions; customers may request export or deletion subject to legal duties.
• OAuth tokens: while the connection is active; revoked or deleted after disconnection, termination, or loss of authorization.
• Appointments and events: during calendar operation and afterward as part of scheduling records, based on settings and applicable obligations.
• Tax records, contracts, and commercial data messages: for periods required by tax and commercial law; certain business records may be retained for ten years.
• Contract-default data: deleted after seventy-two months from the default as required by the LFPDPPP.
• Backups: removed on secure cycles and not used for ordinary operations.

10. Security and confidentiality

We maintain administrative, technical, and physical measures proportionate to risk, including encryption in transit, encryption or added protection for credentials and tokens, role-based access, tenant isolation, audit records, backups, secret management, and monitoring. No system is infallible.

Personnel and providers involved in processing have confidentiality obligations. If a breach significantly affects your property or moral rights, we will notify you without undue delay so you can take protective steps.

11. ARCO rights and privacy controls

You may request Access to your data and processing conditions; Rectification of inaccurate data; Cancellation after any applicable blocking period; or Objection for a legitimate reason, including certain automated processing that significantly affects you. You may also withdraw consent or limit use and disclosure.

Send your request to privacy@nutalk.ai with: your name and a channel for notices; documents proving identity or representation; a clear description of the data; the right you seek to exercise; and details that help us locate the data. For rectification, state the correction and attach support. We verify identity before disclosing data.

We will communicate our determination within twenty business days of receipt and, if granted, implement it within the following fifteen business days. Each period may be extended once for an equal time where circumstances justify it. Exercise is free except for legally permitted reproduction or delivery costs.

If you are dissatisfied, you may file a data-protection request with Mexico’s Secretaría Anticorrupción y Buen Gobierno under the current LFPDPPP.

12. Cookies and similar technologies

We use strictly necessary cookies for authentication, security, language, and session continuity. We may use functional or analytics measurement to understand performance. You can block cookies in your browser, but necessary cookies are required to sign in and use the dashboard. We do not respond uniformly to “Do Not Track” signals because no single applicable standard exists.

13. Third-party platforms

Connected accounts and services are also governed by their providers’ notices and terms. NuTalk receives and uses authorized data to deliver the integration but does not control the independent practices of Google, Microsoft, Meta, Stripe, telecommunications carriers, CRM platforms, or other third parties. Review their policies and grants before connecting them.

14. Children

NuTalk is a business service and is not directed to people under 18. We do not knowingly collect data from minors to create accounts. If a customer uses the Service in a context involving minors, it must obtain authorization from a parent or guardian and follow applicable rules. Contact us if you believe we received a minor’s data without authorization.

15. Changes to this Notice

We will post changes here and update the date. When a change is material or needs new consent, we will provide notice by email, in the Service, or by another suitable channel before it applies. Use for an undisclosed, incompatible purpose will require the applicable consent.

16. Personal Data Department

Hillflare’s Privacy Department receives ARCO requests, withdrawals, limitations, questions, and reports at privacy@nutalk.ai. For operational support or Service complaints, you may also use support@nutalk.ai, the telephone number, and the address below.