CRM service and Meta app “Nahua SaaS Services” · nahua.io

Privacy Notice

Last updated: November 6, 2026

The Spanish version is the official one; this is a translation.

1. Who Nahua is

Miguel Fernando Najera Aranzabal (“Nahua”), with an address at Corina 130, Del Carmen, Coyoacán, 04100, provides the CRM service described in this notice, runs the nahua.io website and owns the Meta app “Nahua SaaS Services” (app ID: 28727211870222883).

• Person or department in charge of personal dataDev
• Emaildev@nahua.io
• Phone+52 55 2914 4148
• Websitehttps://nahua.io

2. Nahua's roles

Processor. For the data of people who write to its clients, Nahua is a “processor” (persona encargada). It processes that data on behalf of each business, only to provide the service and according to its instructions (Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, art. 2 sec. XII; its Regulations, arts. 49 and 50). The business decides what that data is used for, and it is with the business that you exercise your rights. For example, if you wrote to Arte7, Arte7 receives your requests at info@arte7.net (its privacy notice: https://arte7.net/aviso-de-privacidad.html). Section 3 explains this.

Controller. For the data of its clients, of the people who use the CRM and of people who visit nahua.io or write to it, Nahua decides and answers directly. Section 4 explains this.

Towards Meta. Nahua is responsible for the Platform Data its app receives (tokens, identifiers and messages) and answers to Meta for how it is processed. That does not change the above: under Mexican law, it processes prospects' messages as the processor of each business, which decides what they are used for.

3. Data Nahua processes on behalf of businesses

3.1 From people who write to a business

Depending on the channel and on what the business connects:

• Messenger and Instagram:
  • your messages and what you send: photos, audio, videos, documents, shared posts, mentions and story replies;
  • the replies the business sends you;
  • your name and, on Instagram, your @handle;
  • the identifier Meta assigns to you in each of the business's accounts;
  • the date and time of each message;
  • if you came from an ad, the ad reference;
  • on Instagram, also the link to your profile picture.
• WhatsApp: your messages and what you send, your phone number and your profile name.
• The business's web forms connected to the CRM: name, email, phone, the product or program and the location you are interested in, and the campaign parameters of the link you came from. To limit how many submissions are made per minute, your IP address is used: it is stored transformed with a hash function, with no time limit for now, and it appears in the technical logs for 30 days. The form also checks Google's anti-bot verification (reCAPTCHA Enterprise), which today is only measured and does not block submissions.
• Email: the emails the business sends you from the CRM and, once the business turns on receiving, your replies.
• What the business's team adds: notes, stage in the sales process, appointments, closing reason and other follow-up data.
• Technical data:
  • copies of the notifications Meta sends to the CRM;
  • records to avoid processing the same message twice;
  • keys derived from your email, phone and identifiers, to recognize you across channels;
  • a change log, which keeps the previous values of your data and of the notes;
  • operating logs.

Today the CRM does not receive public comments. If that is turned on, it will store the text, your name or @handle and the post commented on, and this notice will say so beforehand.

When connecting an account, the business can bring its recent conversations into the CRM:

• on Messenger, the 50 most recent from each inbox;
• on Instagram, those with activity in the last 30 days, with their 20 most recent messages.

This may include people who only mentioned or replied to one of the business's stories.

Attachments are not downloaded: the CRM stores the link Meta provides, which expires within hours or days, and the file opens from Meta's servers.

Sensitive data. Nahua does not ask for it. If someone writes it in a message, or the business's team notes it down, it stays as part of the conversation. The terms of service forbid using the CRM to collect it without the express written consent the law requires (art. 8).

3.2 From businesses that connect their accounts

When a business connects its accounts, Nahua stores what Meta provides to operate them:

• the identifiers and names of its Pages, Instagram accounts and WhatsApp Business numbers;
• the permissions granted;
• the access tokens;
• depending on how the connection is made, the ID of its business portfolio and that of the person who authorized it.

It uses them only to provide the service to that business.

3.3 What it is used for

Only to provide the service to the business:

• receive the messages and show them to its team, with the account each one arrived at;
• send the replies its team writes, by email or through Messenger and Instagram (on these two, from the account you wrote to and within Meta's 24-hour window);
• recognize the same person when they write through several channels, to avoid duplicate records;
• organize the conversations in the business's sales process and order the work with its rules;
• notify the business by email, if it asks, of each new request that arrives through its web form;
• give it figures about its operation, such as messages per account or ads that brought conversations;
• keep the service secure and running.

3.4 The artificial intelligence assistant

It only works if the business authorizes it. The CRM sends a conversation to Anthropic, PBC, a United States company, when it has had no new messages for 15 minutes, or when someone on the team asks for it. With that, its Claude model suggests the stage, the interest and the next step.

• What is sent:
  • the text of up to the 40 most recent messages, up to 1,500 characters each, with who wrote each one (you or the business), on which channel and when;
  • the team's notes;
  • the recorded stage, interest, location and source;
  • for an attachment, only its type (for example, “sent an image”).
• What is not sent:
  • the name, email, phone, @handle and Meta identifier fields of your record;
  • WhatsApp messages.

  Emails and phone numbers written inside messages and notes are masked before sending. Anything else that is written is sent, including your name or an @handle if they appear in a greeting, in a reply from the team or in a note.

• Where: Anthropic may process the request in the United States or in other countries where it has infrastructure.
• What Anthropic does: it deletes what it receives and what it generates within 30 days at most, unless its safety systems flag it for possible abuse (it then keeps it for up to 2 years) or the law requires it to keep it. Its commercial terms forbid it from training its models on this data.
• Who decides: the suggestion is saved in the record and a person at the business reviews it and decides whether to apply it. The assistant does not reply, does not move records and does not decide anything about you.

3.5 What Nahua does not do

• It does not sell, rent or share this data with other businesses.
• It does not use it for its own purposes, for advertising or to build profiles.
• It does not train artificial intelligence models on it, nor does it let its providers do so.
• It does not use it to make automated decisions that significantly affect you, such as an admission, a price, a scholarship, a loan, a job, housing or insurance. The CRM's priorities and suggestions only order the team's work, and a person always decides.
• It does not combine data from different clients. Today the service has a single client, Arte7, with its two brands (Arte7 and Proyecto Arte 7); before adding another, Nahua will separate each one's data.
• It never asks for or stores Facebook, Instagram or WhatsApp passwords.

3.6 Who else processes it and where

These services process the data as processors, under their contracts, only to provide their service and keep it secure, and not for advertising or to train models. For Arte7, the current client, they are contracted in Arte7's name, and Arte7 authorizes Nahua to use them to provide its service.

• Google (Google Cloud and Firebase):
  • the CRM's database is in Querétaro, Mexico;
  • processing runs in Dallas, United States;
  • the accounts of CRM users (Firebase Authentication) are in the United States;
  • technical logs and keys are stored in Google data centers in several countries;
  • it runs the anti-bot verification of the forms.
• Anthropic, PBC (United States): the artificial intelligence assistant, only if the business authorizes it (section 3.4).
• Resend (United States): sends the emails and, once the business turns it on, handles receiving them. It keeps emails for 30 days.

Copy of the previous system. Supabase, Inc. (outside Mexico) holds a historical copy of the records of the system Arte7 used before, in an account of the provider that developed it. It receives no new data, and it will be deleted no later than November 26, 2026.

Meta. On Messenger and Instagram, Meta is the platform through which messages come in and go out, and it processes them under its own policies. On WhatsApp (Cloud API), Meta processes the messages on behalf of the business and keeps them for up to 30 days. What you delete on Meta is not deleted from the CRM, and what is deleted from the CRM is not deleted from Meta.

Whatever the business's team copies outside the CRM is under the business's control. For example, the notifications it receives in its email or a table it pastes into a spreadsheet.

Authorities. Nahua only hands data over to an authority when a duly grounded and reasoned order requires it. It checks that the order is lawful, hands over the minimum requested and keeps a record. It tells the business, unless the order forbids it.

3.7 How long it is kept

• Records, conversations, notes, change log and technical copies: today none of this expires on its own. It is kept while the business has the service, unless it asks for it to be deleted earlier or a request of yours is granted. Each deletion is carried out by a person at Nahua, who deletes everything about that person and keeps a record.
• When the service ends: the business can ask Nahua for a copy of its data, in JSON files. Nahua then deletes it from its systems within 60 days at most.
• Copies that expire on their own:
  • technical logs: 30 days;
  • database recovery copies: 7 days;
  • emails stored in Resend: 30 days;
  • what is sent to Anthropic: 30 days, with the exception in section 3.4.
• After deletion: deleted data leaves the CRM immediately, and Google finishes removing it from its systems within 180 days at most.
• Accounts that do not belong to a client: if an account that does not belong to a client authorizes the app, whatever arrives through it is held. It does not open records, and the business's team only sees that there is an account to review, without its messages. If it is confirmed that it does not belong to the business, Nahua deletes what arrived through it.

3.8 Your rights over this data

Since the business you wrote to is responsible, your rights of access, rectification, cancellation and objection (ARCO rights) are exercised with it. You can write to it directly or write to dev@nahua.io.

If you write to Nahua, within 3 business days at most it forwards your request to the business and lets you know it did. It then applies in the CRM what the business decides. For now, a copy of your data, an email correction or an objection is prepared by hand by a person at Nahua. If Meta forwards a request of yours to Nahua, it also passes it on to the business immediately.

To ask for deletion, follow the steps in Data deletion.

4. Data Nahua is responsible for

4.1 What data

• Clients:
  • name of the business and of its representatives, position, email and phone;
  • for invoicing, tax data: RFC, legal name, tax regime, postal code and invoicing email;
  • whatever they write to support.
• People who use the CRM:
  • name, email, role, location and whether the account is active;
  • if you sign in with a password, Google stores it only as a hash, not in readable text;
  • if you sign in with Google, what Google shares when you sign in: name, email and photo;
  • the sign-up date and the last access date;
  • the IP address and browser you use the CRM with.

  If you sign in with Google without having been invited, a record of your account is created with access to nothing. What you do in the records (what you captured, answered, moved, merged or discarded, and when) stays in each business's change log, which is part of its data (section 3).

• Visitors to nahua.io and people who write to it:
  • technical data about each visit (IP address, browser, date and time), logged by the service that hosts the site;
  • if you write through the contact form, including a quote request: name, email, message, the service you are interested in, the language, the page you wrote from and the date. The message goes through an automatic spam filter, reaches the site administrator by email and is kept until you ask for it to be deleted;
  • if you download a file: the download is added to a count per file and per day, which stores no IP address or anything else that identifies you. To curb abuse, the server uses your IP only in its memory, at most until the end of the day, and does not store it in the database or in the logs. If the server reaches its daily download limit or cannot deliver the file, some free downloads are delivered from Nahua's Google Drive, and in that case Google handles that download's data under its own privacy policy;
  • if you use the free tools that query Mexico's Official Gazette (the DOF search and the exchange rate): your browser connects directly to the public SIDOF service (sidof.segob.gob.mx), which receives your IP address and what you look up and handles them under its own policies. nahua.io neither receives nor stores those searches;
  • the technical browser signals checked by the protection against automated traffic (section 4.5).

  Purchases and support are paid outside nahua.io, on the platform linked on each page (for example Polar, Stripe, Mercado Pago or PayPal), which handles your data under its own privacy policy. nahua.io never sees or stores your card number.

• People who publish downloads on nahua.io: downloads are published through an API that only the site administrator uses. Its audit log records each action with the publisher's truncated IP address and browser, and each record is deleted automatically after 365 days. Failed attempts to access the API are kept in the technical logs with the truncated IP for 30 days and are reported by email to the site administrator.
• Team workspace (nahua.io/apps/integrador): a private tool for school teams invited by the administrator. When you sign in, with your Google account or with a link sent to your email, Firebase Authentication records your email, and also your name if you use Google. If you are part of a team, the site also stores your section preferences, the files and answers you upload, your votes and comments, the messages you send in the team chat (text, photos, voice notes and PDFs), and a timestamped log of each action. Voice notes are recorded only when you tap the microphone and allow it in your browser. While the team is voting or working, you receive a progress summary by email (daily at 8 p.m. by default; the administrator can change how often or turn it off). If you use GeoGebra for a figure, your browser downloads that tool from geogebra.org (GeoGebra GmbH) while you use it; the figure and its image are saved with your answer. If you add the area map, your browser downloads those map tiles from OpenStreetMap (tile.openstreetmap.org, run by the OpenStreetMap Foundation). If you ask to join, your request (name and email) is kept until it is accepted or dismissed. Only your team members and the administrator can see it. It is kept in Firebase (Google Cloud) for up to six months after the team's last deadline, or sooner if you ask for deletion at Data deletion.

Nahua does not process sensitive data of these people. The CRM's providers are those in section 3.6; sign-in is processed by Google (Firebase Authentication) in the United States. nahua.io, its database and its download files are on Google (Firebase and Google Cloud), in the United States, and the form notifications are sent by Resend.

4.2 What it is used for

• Giving you access to the CRM with the role your business assigns you, and keeping it secure.
• Providing, charging for and invoicing the service, and meeting tax obligations.
• Handling support and telling you about changes, incidents or communications from Meta that affect the service.
• Meeting what Meta requires of technology providers, such as keeping the list of Nahua's clients with their contact details.
• Serving and protecting nahua.io, delivering its downloads and replying to people who write through its form. The API audit log is used to know who published or changed each download and to detect misuse.

All of them are necessary for the service:

• With Nahua's clients, they derive from the contract, so they do not require consent (art. 9 sec. IV of the law).
• With people who use the CRM on behalf of a client, they do. Consent is understood to be given if you use the CRM after learning about this notice, which is linked on the sign-in screen (art. 7).
• With people who visit nahua.io or write through its form, consent is also understood to be given if you use the site or send the form after learning about this notice, which the form links to (art. 7).

Nahua has no purposes that require separate consent, such as advertising or marketing. If it ever had any, it would ask for your consent first.

4.3 Transfers

Nahua only transfers this data in two cases, which the law allows without asking for your consent (art. 36):

• to Meta Platforms, the list of its clients with their contact details, when Meta asks for it. Meta requires it from technology providers so that their clients can use its platform;
• to an authority, when a duly grounded and reasoned order requires it.

4.4 How to limit the use of your data or revoke your consent

Write to dev@nahua.io and Nahua will reply in writing within the deadlines in section 6. If you revoke consent for something the service needs, Nahua may have to remove your access to the CRM. If you use the CRM for a business, you can also ask its administrator to remove you.

4.5 Cookies and similar technologies

• The CRM uses no advertising or analytics cookies. To keep your session, Firebase stores the session data in your browser. If you delete it, you will have to sign in again.
• When you open the CRM, your browser downloads fonts from Google Fonts, and Google receives your IP address.
• On nahua.io:
  • there are no first-party cookies and no analytics or advertising tools;
  • the site stores in your browser the last language you used, so it opens in that language next time. It does not identify you and does not leave your browser;
  • to curb automated traffic, the site uses Google's reCAPTCHA Enterprise, through Firebase App Check. reCAPTCHA checks technical browser signals and may set a technical Google cookie, and Firebase stores a technical token from that check in the browser's storage. If you block it, the contact form may not work;
  • some pages show videos and images from other services, such as YouTube (videos in its privacy-enhanced mode, youtube-nocookie.com). When they load, your browser connects to that service, which applies its own privacy policy;
  • the legal pages, like this one, use no cookies or scripts.

  You can delete or block this data in your browser settings.

5. Security

• Data travels encrypted, and Google stores it encrypted.
• A personal account is needed to enter the CRM, and each person only sees and does what their role allows.
• Changes to records go through Nahua's server and are kept in a log that no one can modify from the CRM.
• Tokens and keys are stored in Google's Secret Manager, and only Nahua's server processes use them.
• Those with access to the data at Nahua must keep it confidential, even after their relationship with Nahua ends.
• If a security breach occurs that significantly affects your rights, Nahua reports it immediately:
  • to the responsible business, so that it can inform you;
  • to you directly, when Nahua is responsible for your data (art. 19);
  • to Meta, through its reporting channel, if it involves data from its platform.
• To report a vulnerability: dev@nahua.io.

6. How to exercise your rights with Nahua

This section applies to the data in section 4. For data Nahua processes on behalf of a business, see section 3.8.

Write to dev@nahua.io with:

1. Your name and a way to reply to you.
2. Something that proves your identity:
   • if you write from the email you use to enter the CRM or the one you hired Nahua with, that is enough, unless there are reasonable doubts;
   • if not, a copy of your official ID;
   • if you act on behalf of someone else, also the document that proves the representation.
3. Which right you want to exercise and over which data (for access you do not need to say which).
4. Whatever helps find it.
5. If you ask for a correction, what needs changing and the document that supports it.

Deadlines.

• Nahua communicates its reply within 20 business days at most.
• If the request is granted, it carries it out within the following 15 business days.
• If information is missing, it asks for it only once within 5 business days of your request, and you have 10 business days to send it.
• Only if the case justifies it is a deadline extended, once and for the same period, and you are told why.
• When cancelling your data is granted, it is first blocked: no one uses it and it is kept only to answer for possible liabilities, for the period stated in the reply. It is then erased and you are notified. If there is nothing to keep, it is erased at once.

Cost. It is free. Only reproduction or shipping costs could be charged, if there were any.

Authority. If you disagree with Nahua's reply, you can file a data protection request with Mexico's Secretaría Anticorrupción y Buen Gobierno within 15 business days of being notified of it. If you get no reply, you can file it as soon as the reply deadline expires (arts. 40 and 41 of the law).

7. How to ask for your data to be deleted

Follow the steps in Data deletion: it explains what you will be asked for, what is deleted and how long it takes.

Removing “Nahua SaaS Services” from your Facebook or Instagram cuts off the app's access, but does not delete what is already in the CRM. If, when removing it on Facebook, you also ask for your data to be deleted, Meta forwards the request to Nahua and it is handled like an email. Otherwise, write to dev@nahua.io.

8. Minors

The CRM is a service for businesses and is not directed at minors. Nahua does not ask for the age of people who write to its clients. If you are a minor, your mother, father or guardian can exercise your rights for you.

9. Changes to this notice

Each version is published on this page, with its date. If a change affects what data is processed, why or with which providers, Nahua announces it by email, before it takes effect, to the administrators of each client business and to the people who use the CRM.

10. Governing law

This notice is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (published in the Diario Oficial de la Federación on March 20, 2025) and its Regulations, insofar as they do not contradict it.

Miguel Fernando Najera Aranzabal · Corina 130, Del Carmen, Coyoacán, 04100 · dev@nahua.io