Nemvio is operated by State Alexandru and Lupu Alexandru. For any question about this policy or your data, write to us at contact@nemvio.co.

When you submit the contact form, we collect:

• Your name
• Your email address
• Your company name, if you fill it in
• The message you write

We don't use cookies and don't install third-party tracking scripts on this site. We use an analytics service that counts visits without cookies and without identifying anyone individually, only aggregate traffic numbers.

Solely to reply to your message and, if you become a client, to prepare and deliver the project you contacted us about. We don't use it for marketing you haven't asked for, and we don't sell it.

Submitted messages are stored in our database, hosted by Supabase, Inc., which acts as an infrastructure provider. Supabase doesn't use your data for its own purposes, it only stores it on our behalf.

In addition to the data above, collected directly on this site, we build and maintain systems (WhatsApp bots, panels, AI and email automations) that process the data of the end customers of the businesses we serve: the names, phone numbers, messages, and bookings of the people who write to them on WhatsApp or email.

In this case, the client business is the data controller, and Nemvio acts as a data processor, handling the data solely according to the client's instructions. The exact terms of this processing are set out in a data processing agreement (DPA), part of the signed contract with each client, not by this page, which only covers use of the nemvio.co website.

To deliver these systems, we work with the following sub-processors:

• Meta Platforms, Inc.: the official WhatsApp Business platform, for sending and receiving messages and for incoming calls
• OpenAI Ireland Limited: the artificial intelligence model that reads the end customer's message and composes the reply, and, for clients with an active voice agent, the real-time voice conversation. The data sent is not used to train models, and OpenAI may keep abuse-monitoring logs for up to 30 days
• Supabase, Inc.: the database and infrastructure
• Resend, Inc.: sending the automated emails, meaning confirmations, reschedules, cancellations, reminders
• Vercel Inc.: hosting the website and the admin panel
• OVH SAS: the server in France running the voice service, for clients with an active voice agent
• Google LLC: only for clients who enable Google Calendar sync or the Gmail inbox

Clients with an active voice agent receive calls answered by an automated system, not a person. When someone calls, their speech is streamed in real time, through our voice server in France, to the OpenAI model, which understands what the caller says, composes the reply, and speaks it.

We do not keep an audio recording of the call. What remains stored is the text transcript of the conversation, the caller's number, the time and length of the call, and the resulting booking, if one was made. The code contains an audio-saving feature used strictly for debugging, and it is switched off in production.

The bot says at the start of the conversation that it is an automated assistant. The caller can ask to speak to a person at any time.

Some of the sub-processors above are companies in the United States, and processing may take place on their servers. Where that happens, the transfer relies on the standard contractual clauses approved by the European Commission, or another mechanism provided for by the GDPR, through the contracts held with each provider.

Some clients use the platform to send their own campaigns on WhatsApp or by email to their own customers. Those messages come from that business, not from Nemvio, and the business decides who receives them. Every campaign email carries an unsubscribe link, and a WhatsApp message can be answered with STOP: in both cases the choice is recorded immediately and that number or address stops receiving campaigns from that business.

Each business's data is isolated from every other business's at the database level, not merely in the interface. Access to the panel requires two-step authentication for any account that can see end-customer data, reads and changes are written to an audit log, and privileged keys exist only on the server, never in code running in a browser. The full detail is at legal.nemvio.co/securitate.

Messages sent through the contact form on this site are kept for up to 24 months from your last message to us, unless we're actively working together or you ask us to delete them sooner.

For data processed on behalf of a client, the client sets the retention period, because the client is the controller. As a platform rule, conversations, bookings, and call transcripts are kept for as long as the account is active, the log of sent emails is kept for 12 months, and when the relationship ends the data is deleted at the client's request or within 90 days of the account being closed at the latest.

Under GDPR, you can ask us to:

• Show you what data we hold about you
• Correct it if it's wrong
• Delete it
• Restrict how we use it, or object to a specific use
• Send you a copy in a portable format

Write to us at contact@nemvio.co and we'll handle it directly. You can also file a complaint with the Romanian data protection authority, ANSPDCP (dataprotection.ro), if you think we've mishandled your data.

If this policy changes substantially, we'll update the date at the top of this page.