Privacy Policy

1. The roles: who is responsible for your data

If you are a client of a business that uses Neralda: that business is the data controller — it decides to record your data and to use it to serve you. We are the data processor: we process your data solely on behalf of the business, so that the platform works. You exercise your rights over your data before the business that serves you; we help it comply.

If you are a platform user (staff or professionals of the business) or a visitor, we are the controller of your account data or your business contact data.

2. Which data is processed

• If you are a client of a business: identification and contact details (names, national ID number, phone, email, date of birth, gender), appointments, notes and tags the business records about your care (for example, treatments performed, allergies or skin conditions), before/after photos and documents the business uploads, recorded payments (amount and method; we do not store card data), and your WhatsApp messages with the business's assistant.
• If you are a user of the business: name, email, phone, role and activity in the system.
• If you are a visitor or business contact: the data you send us through WhatsApp or forms.

Some of this data — such as treatment records, allergies, skin conditions and before/after photos — may constitute health data, which is sensitive data under Ecuador's Organic Law on Personal Data Protection (Ley Orgánica de Protección de Datos Personales, LOPDP). As a precaution, we process it with the reinforced protection the law gives to sensitive data.

3. What it is used for

Exclusively so that the business serving you can manage its service: booking and reminding you of appointments over WhatsApp, communicating with you, keeping the record of your care, issuing the receipt for what you pay and running its operation. We never sell data, we never use it for advertising, and we never use it to train artificial-intelligence models.

If the business uses a connected accounting system, the data the invoice requires (name, national ID or RUC, phone, email and the detail of what was charged) is sent to that system when a payment is recorded for you. It is the same data that would go on any invoice, and it goes to the accounting of the business that serves you — not to ours.

4. Artificial intelligence

The platform uses artificial intelligence in two places, and the difference matters:

• The assistant that replies to you on WhatsApp. When you write to the business, what you write is read by an artificial-intelligence system to understand you and reply — to book, move or cancel your appointment, and to answer your questions. That text is processed through the API of the provider OpenAI, on servers located in the United States.
• Internal tools for the business (activity summaries and a daily brief for the team). The staff uses them, not you.

What travels to that provider. Only your first name, the latest messages of the conversation and, from your appointments, the date, time, who serves you, the branch, the treatment and the status.

What does not travel. Your phone, your national ID number, your email and your address are not sent.

Under that provider's terms, data sent through the API is not used to train its models and may be kept transitorily and in a limited way — up to 30 days — for abuse control, and is then deleted.

Artificial intelligence only assists: decisions about your care are always made by the business's staff, and no decision that affects you is made in an automated way.

5. Where the data is stored and who else processes it

We use first-tier technology providers, some located in the United States:

• Supabase — database and files (encrypted)
• Vercel — application hosting
• OpenAI — artificial-intelligence features
• Meta (WhatsApp) — messaging with the business that serves you
• Upstash — temporary memory of the WhatsApp assistant
• Resend — system emails (invitations and account notices)

Those providers are in the United States, a country that the Ecuadorian authority has not declared as having an adequate level of data protection. We say it plainly because the law requires us to inform you: it means that, once there, your data is not covered by a declaration of equivalence with Ecuadorian protection.

The transfer relies on article 60 of the LOPDP: it is necessary to perform the service you contracted with the business (item 4) — without it there would be no calendar, no reminders and no history — and, when you record your consent, you give it informed of the above (item 2).

In addition, and as reinforcement, each provider has signed a data processing agreement with us that contractually obliges it to protect the information, to use it only on our behalf and not to use it for its own purposes.

Also, if the business that serves you has its accounting system Contífico connected (an Ecuadorian company, with servers in Ecuador), the data the invoice requires is sent there to issue your receipt. That information then falls under the control of the business and its accounting, with the retention obligations that tax law imposes on it.

6. How it is protected

Isolation of each business's information, encryption in transit and at rest, role-based access control (each user sees only what their function requires), short-lived file links, signed authentication between system components, periodic backups and internal security audits.

7. How long it is kept

While the business that serves you keeps its account active, and during the return period after its contract ends. Once that period expires, the data is deleted from active systems. You can also ask the business to delete your data at any time (see section 8).

In more detail, by type of data:

• Your file (name, contact, care history): while you are a client of the business. After a period without returning — the business decides how long, and our recommendation is 2 years — your file is anonymized: the name and contact details are erased and only the part the business needs for its accounting remains. The business that serves you decides when to do it, because it is the controller of your data; the platform shows it which files have passed the deadline and gives it the tool to anonymize them.
• Photos and files of your care: while you are a client. They are deleted immediately if you ask.
• Sales receipts and payment records: 7 years. This is not a decision of the business or ours — it is the minimum retention period required by Ecuadorian tax regulations, and it is the same period during which the tax authority may review a past fiscal year.
• Conversations with the WhatsApp assistant: 12 months.
• The record of your consent (when you gave it, through which channel and which version of this policy you accepted): 5 years from the end of the relationship. It is kept precisely to be able to prove that your data was processed with your permission.

8. Your rights

Under the LOPDP you have the right to access, rectify, update, delete, object to the processing of and request the portability of your data, among others.

• Clients of a business: exercise these rights directly before the business that serves you (the controller); the platform gives it the tools to attend to you — it can hand you a copy of your data or delete it at your request.
• Users and contacts: write to us at soporte@jwautomatizations.com.

Timeframe: your request is handled within a maximum of 15 days from receipt. If the request is complex and more time is needed, you are informed within that period with the reason.

A limit worth knowing. If you ask for your data to be deleted, it is deleted from the system — but tax regulations oblige the business to keep sales receipts for 7 years. The data that already appeared on an issued invoice (your name, your national ID number and what you bought) is kept because of that legal obligation, not because the business wants to. It is the only exception, and the LOPDP expressly provides that processing required by law cannot be erased on request.

If you believe your rights were not attended to, you may turn to Ecuador's Personal Data Protection Superintendency (Superintendencia de Protección de Datos Personales).

9. Minors

Data of clients who are minors is recorded by the business with the consent of their legal representatives, in accordance with the LOPDP.

10. The public website (neralda.com)

This section is only about the public website. If you never signed in to the system and only looked at the website, this is all that was recorded about your visit.

Our own measurement, without cookies. We note which page was viewed, one word about where you came from (for example google, instagram or direct), whether you came from a phone or a computer, and isolated moments such as clicking to write on WhatsApp or opening the demo. No cookies or advertising trackers are used, and your IP is not stored: the server sees it for an instant to prevent abuse and discards it without recording it. To link the steps of one visit, a random number is used that lives in the browser tab and is erased when you close it. These signals go to an internal JW Automatizations panel and are deleted automatically after 12 months.

Hosting provider measurement. The website is hosted on Vercel, which also keeps its own aggregate visit count (Vercel Web Analytics), also without cookies.

The assistant demo. If you write in the website's trial chat, it works differently and you should know it: the browser stores a random identifier that does survive closing the tab, so that when you come back you continue in the same conversation. What you write and your IP address are sent to the service that operates the assistant, to be able to reply and to limit abuse. It is a public demo: do not write real personal data there, yours or anyone else's, nor health information.

Since the measurement stores nothing that could identify you, this website shows no cookie notice. If at some point something that does identify you is added, your consent will be requested first.

11. Changes to this policy

We will publish updates on this same page with their date. Relevant changes will be announced within the platform.