Data deletion instructions · CRM and Meta app “Nahua SaaS Services”

Data Deletion

Last updated: October 12, 2026

Nahua runs a CRM that other businesses use to handle the messages they receive on Messenger, Instagram and WhatsApp. This page explains how to ask for your data to be deleted from that CRM, what you will be asked for and how long it takes to get an answer. The privacy notice explains what data is processed and why.

Asking is free. Each request is handled by a person on Nahua's team, who deletes everything about you and keeps a record.

• A. If you wrote to a business on Messenger, Instagram or WhatsApp, follow part A.
• B. If you connected your business's accounts or use the CRM, follow part B.

A. If you wrote to a business

The business you wrote to is responsible for your data; Nahua stores it on the business's behalf. You can ask for deletion in two ways:

• To the business, through the channels in its privacy notice. If it was Arte7, at info@arte7.net.
• To Nahua. Nahua forwards your request to the business and does in the CRM what the business decides.

The same applies if you gave your data to the business through a web form or by email.

Step 1. Write to Nahua

Send an email to dev@nahua.io with the subject “Borrar mis datos” (Delete my data). Include:

1. Your name and an email or phone number where you can be answered.
2. Which business you wrote to and where: Messenger, Instagram, WhatsApp, web form or email.
3. How to find you: your name on Facebook, your Instagram @handle or your WhatsApp number, and roughly when you wrote.
4. What you want deleted: everything, or something in particular.
5. If you ask on behalf of someone else, the document that proves you represent them. If it is your minor child, the one that proves parental authority or guardianship.

Step 2. Nahua checks that the account is yours

So as not to delete or hand over someone else's data, Nahua asks you for one of these two things:

• A code from your account. Nahua sends you a short code and you write it to the business from the same Messenger, Instagram or WhatsApp account you wrote from, or you reply from the same email, if you gave it one. A person at the business confirms to Nahua that the code came from your account, and that message is deleted along with the rest.
• A copy of your official ID, if you do not want to write to the business or no longer have that account. It is used only for this and is deleted when your request is closed.

Step 3. Deadlines

• Within 3 business days at most Nahua confirms that it received your request and forwards it to the business.
• If something is missing, it asks for it only once within the following 5 business days, and you have 10 business days to send it.
• When the business confirms, or if within 5 business days it does not object on a legal ground, Nahua deletes your data from the CRM within 10 business days at most and lets you know.
• In no case do more than 20 business days pass before you are told whether the request is granted, or more than 15 business days after that to carry it out. Only if the case justifies it can one of these deadlines be extended once for the same period; you would be told beforehand, with the reason.

The business can only refuse on the grounds set by law. For example, if you are its client and it needs some data to fulfill a contract, or if a law requires it to keep the data (art. 25 of Mexico's Federal Law on the Protection of Personal Data Held by Private Parties). In that case it tells you what it keeps and why, and that data is blocked: no one uses it, and it is erased as soon as it is no longer needed.

What is deleted from the CRM

Everything related to you at that business:

• your record, including duplicates and records that were merged into yours;
• your messages and the links to what you sent;
• the team's notes, the assistant's suggestions and the follow-up data;
• your comments and the stored emails;
• the technical copies of the notifications Meta sent and the records used to recognize you across channels;
• your data inside the change log;
• the copy in the previous system (Supabase), while it exists.

Only two things are kept:

• your request and Nahua's reply, as a record that it was handled;
• figures that do not identify you, for example how many messages an account received.

What expires on its own

Some copies are not deleted one by one, but disappear on their own:

• server technical logs: 30 days;
• database recovery copies: 7 days;
• emails stored by the email provider (Resend): 30 days;
• anything sent to the artificial intelligence assistant (Anthropic): 30 days, or up to 2 years if its safety systems flagged it for possible abuse.

Google finishes removing deleted data from its systems within 180 days at most.

What is not in Nahua's hands

• Meta. Your conversation remains in Messenger, Instagram or WhatsApp; to delete it there, use each app's options. And the other way around: if you delete or unsend a message or a comment on Meta, the copy that already reached the CRM is not deleted automatically. Ask for it to be deleted.
• The business's copies outside the CRM, such as notifications in its email, spreadsheets or the WhatsApp on its phones. The business deletes those. When Nahua forwards your request, it reminds the business.

B. If you connected your business's accounts or use the CRM

Remove the app's access

You can do this yourself at any time. Menu names vary by version:

• Facebook: Settings & privacy > Settings > Business integrations (or “Apps and websites”) > “Nahua SaaS Services” > Remove.
• Business portfolio (Meta Business Suite): Business settings > Integrations > Connected apps > “Nahua SaaS Services” > Remove.
• Instagram: Settings > Apps and websites (in some versions, inside Accounts Center) > “Nahua SaaS Services” > Remove.

When you remove it, “Nahua SaaS Services” loses the access you gave it. If your business also uses another app connected to the same CRM, tell Nahua so it can disconnect it. Removing it does not delete what is already in the CRM, nor the tokens Nahua has stored: they are destroyed when you ask, in the next step.

If, when removing it on Facebook, you also asked for your data to be deleted, there is no need to write: Meta forwards the request to Nahua and it is handled like an email.

Ask for deletion

Write to dev@nahua.io. To delete the business's data, do it from its administrator's email; to delete only your account, from the email you use to enter the CRM. Say what to delete:

• Everything about the business: connected accounts, tokens, records, conversations and user accounts. If you want a copy of the data, Nahua delivers it before deleting, in JSON files.
• One connected account: its tokens and its settings. If you ask, also the records and conversations that arrived through it.
• Your CRM user account: your access and your profile data. What you did in the records stays in the business's change log, which is its record of who did what. The business, which is responsible for it, decides about that part: Nahua forwards your request.
• A record created by signing in with Google without an invitation: it is deleted entirely.

Deadlines:

• Tokens: within 3 business days at most, and you are told that your request was received.
• What the business's administrator asks about its accounts, records and conversations: within 10 business days at most, and you are notified.
• Your user account: Nahua replies within 20 business days at most and, if granted, deletes it within the following 15 business days.
• If you end the service, everything is deleted within 60 days at most, after delivering the copy if you asked for it.

Questions

dev@nahua.io · +52 55 2914 4148

If you disagree with the reply of the party responsible, you can file a data protection request with Mexico's Secretaría Anticorrupción y Buen Gobierno within 15 business days of that reply. If it does not reply, you can file it as soon as its deadline expires (arts. 40 and 41 of Mexico's Federal Law on the Protection of Personal Data Held by Private Parties). In part A, the party responsible is the business you wrote to; in part B, Nahua.