Personal data processing policy
Legal draft: this text is provisional and must be reviewed by a lawyer before the service opens to the public.
1. Who is responsible
NexiLabs is the controller of the personal data it receives through Webs NexiLabs, under Colombian Law 1581 of 2012 and Decree 1377 of 2013. Company name, tax ID, address, email and phone: to be completed.
2. What data we process
The public data of the Instagram profile you give us (name, bio, links, profile picture, recent photos and posts, and any contact details you publish there); what you publish on the public pages linked in your bio (your link page such as Linktree, your website and your online or PDF menu): contact details, address, hours, menu with prices, photos of your place and booking or delivery links; the data and files you upload by hand; your email, name and password (stored encrypted) when you create your account; and the domain holder and billing details when you buy. We do not ask for sensitive data.
3. What we use it for
To create the preview and your business website; register and manage your domain in your name; publish, host and maintain your website; give you access to the editor; charge for the service and issue your invoice; answer your requests; and meet legal obligations. We use artificial intelligence to suggest your type of business, describe your photos and write texts from what you already published. We do not sell your data. To know which of our ads work, we measure on tuweb.app (not on your website) visits, whether you created a preview, which plan you chose and whether you paid (see section 5).
4. Third-party profiles
By requesting a website from an Instagram profile you declare that you own it or are authorized by its owner. If someone used your profile without permission, write to us and we will delete the preview and its data.
5. Providers and international transfers
To provide the service we share only what is strictly necessary with providers acting on our behalf: OpenAI (United States), texts and photos for artificial intelligence; Cloudflare (United States, global network), hosting of the websites and their photos; Namecheap (United States), holder details to register the domain; Scrape Creators (United States) and Apify (European Union), reading the public Instagram profile; Google (United States), only your website address for Search Console; Meta Platforms (United States), through its pixel and Conversions API, the pages you visit on tuweb.app, the preview created, the plan chosen and the purchase (amount and, when you pay, your email irreversibly hashed) to measure our ads on Facebook and Instagram. The pixel uses Meta cookies; you can block them in your browser without losing any feature. We use Microsoft Clarity (United States) to understand how tuweb.app is used (clicks and scrolling), with an anonymous recording of the visit in which form fields are masked; more information at https://privacy.microsoft.com/privacystatement. Payments are processed by Mercado Pago and Wompi in Colombia. By accepting this policy you authorize these international transfers and transmissions.
6. Payments
Payments are processed by Mercado Pago (or Wompi, depending on the gateway shown when you pay). We never see or store your card or bank account details.
7. Your rights
You can access, update and correct your data; ask for proof of your authorization; learn how we have used it; revoke your authorization or ask us to delete it when there is no legal duty to keep it; access it free of charge; and file complaints with the Superintendence of Industry and Commerce (SIC) after making your request to us.
8. How to exercise them and response times
Write to the NexiLabs contact email (to be published) with your name, the @ or the email of your account and what you are asking for. We answer inquiries within 10 business days (extendable by 5 more business days, with notice) and claims within 15 business days (extendable by 8 more business days, with notice), as required by Law 1581.
9. How long we keep it
Previews that are not purchased, with their photos and the copied profile, are deleted automatically after 30 days without use. Your website data is kept while the service is active, and billing data for as long as accounting and tax rules require. Purchase-funnel measurements (how far each visit got) are anonymous, with no name, email or IP, and are deleted after 13 months.
10. Security
We use encrypted connections (HTTPS), store passwords encrypted, limit sign-in attempts, and only authorized NexiLabs staff can see your data.
11. Messages from visitors to our clients' websites
The messages visitors send through forms (and orders) on our clients' websites are stored on behalf of the business, which is the controller of that data. We use them only to deliver them to the business and delete them automatically after 12 months.
12. If the service ends or changes hands
If NexiLabs ends the service we will notify you at your account email; during the notice period you can ask us for a copy of your texts and photos, and when it ends we delete your data, except what the law requires us to keep (for example, billing records). If the project passes to another company, your data passes to it only to keep providing you the service under this same policy, and we will notify you by email.
13. Changes to this policy
If we change this policy we will publish the new version on this page with its date. Effective date: pending.
To be completed by NexiLabs: company name, tax ID (NIT), address, contact email and phone, and effective date.