Novaru Privacy Policy

1. Who we are and how to contact us

Novaru is an AI-powered assistant that handles the messages businesses (clinics, barbershops, restaurants, real estate agencies and others) receive on WhatsApp, Instagram and Messenger. It can answer questions, book and remind appointments, take orders and hand the conversation over to a person at the business.

Novaru is a service of Viralith Digital LLC, a limited liability company organized in the State of Wyoming, United States (D-U-N-S 14-017-2114) ("Viralith", "we", "us").

• Privacy and data protection email: support@viralithdigital.com (use the subject line "Privacy"). This mailbox is handled by the Viralith team responsible for privacy.

Novaru is offered to businesses in Paraguay, Ecuador and other Latin American countries. Novaru is not offered in the United States.

2. Two different situations: when we decide and when the business decides

a) Viralith's own accounts (Viralith is the controller)

Viralith uses Novaru to handle its own WhatsApp, Instagram and Messenger accounts (for example, when you message us to learn about the service). In that case Viralith decides why and how your data is used and is the data controller. This policy applies directly.

Viralith is also the controller of the data of people who create a Novaru dashboard account on behalf of a business (name, email, role) and of those businesses' billing data.

b) Client business accounts (the business is the controller)

When you message a business that uses Novaru (for example, your clinic or your barbershop), that business is the controller of your data and Viralith acts as a data processor: we process the data only to provide the service to the business, following its instructions and the data processing agreement (DPA) that must be signed with it. The business must inform you about its own privacy policy.

If your request concerns data processed by a client business, you may contact the business or write to us: if you write to us, we will notify the business and help it respond (see section 11 and the Data deletion page).

3. What data we receive from each platform

We receive the data Meta delivers when a person writes to an account connected to Novaru, the content that person provides, and information the business uploads or connects to provide the service, as detailed below. We do not buy personal data.

Data you choose to give us in the conversation. To book an appointment or take an order, the assistant may ask for your name and, depending on the business, the service or product you want, the date and time, and a delivery address. We only ask for what is needed for that task.

Data entered by the business. The business may record appointments, internal notes about the conversation, tags, invoices and, for clinics, care notes in the dashboard. It may also import its own contact list and configure instructions, opening hours, services, catalogs, prices and other business information to guide the assistant. It must have authorization or a valid legal basis for any personal data it supplies.

Data of businesses that connect their accounts. When a business connects its WhatsApp, Instagram or Facebook Page, we receive the identifiers of those accounts (for example, the WhatsApp phone number ID and WhatsApp Business Account ID, or the Instagram account ID and username) and an access token, which we store encrypted. For the dashboard, we store the name, email, role and password (only as a cryptographic hash, never in plain text) of each member of the business's team.

Voice calls (optional feature, when the business subscribes to it). We store the number you call from, the call duration, its outcome and whether an appointment was booked. We do not store audio on our servers. A transcript is stored only if the business expressly enables it.

4. Why we use the data and on what legal basis

The applicable legal basis depends on the country, purpose and entity acting as controller. A client business acting as controller must define and document that basis. Ecuador's LOPDP and, where its territorial scope applies, the GDPR are relevant. Paraguay's Law 7593/2025 provides for entry into force twenty-four months after official publication; this policy does not present its future obligations as already enforceable or replace currently applicable rules.

5. Use of artificial intelligence and access to a human

Configuration for each business. The business configures the assistant's customer service role and supplies instructions and information about its operations, such as opening hours, services, catalog, prices and rules for handing queries to its team. Novaru, operated by Viralith Digital LLC, processes that configuration together with messages and conversation context to serve the customer according to those instructions.

Who processes information using AI. When external AI is enabled, Novaru sends the configured provider — Anthropic for Claude or OpenAI for GPT — the business instructions and relevant information, along with the query, necessary conversation history and task results needed to respond, using the pseudonymization measures described below. The provider processes that content and returns a response that Novaru integrates into customer service. This also happens when the business connects its own API key: Viralith still operates Novaru and the selected provider still processes the content sent to it.

What “training the assistant” means. In this service it means configuring its role, instructions and context for the business. This configuration does not modify or train the general Claude or GPT model. Novaru does not fine-tune those models using conversations or use one business's conversations to train a model shared across businesses. The AI provider's data use and retention conditions are also explained in sections 8 and 10.

• We tell you that you are talking to a virtual assistant. Novaru introduces itself as the business's virtual assistant from the first message. It does not pretend to be a person.
• You can always talk to a person. At any time, write «humano» or «persona» (for example, «quiero hablar con una persona»; the assistant currently operates in Spanish). The assistant pauses its replies and the conversation is passed to the business's team, which replies from the dashboard. Outside business hours, the human reply arrives when the business is back.
• How it works. Important actions (booking, cancelling, charging) are validated and carried out by our own system using fixed rules; a language model cannot carry out actions on its own. Depending on the business's settings, Novaru may reply using only predefined rules and flows, or may also use a language model to better understand what you write.
• If an external AI provider is used, we pseudonymize the text before sending it: we replace with placeholders (for example, "[PATIENT]") your name, your phone number, and the ID numbers, card numbers and email addresses we detect in the text, as well as your address and date of birth when they are stored in your record, and an automatic check blocks the request if it detects that any of the known data in your record is still present. The provider receives the content of the inquiry without those identifying details. Automatic detection is not perfect: data written in an unusual way might not be detected. We therefore recommend not sending information that is not necessary for your inquiry.
• Automated decisions. Novaru does not make decisions that have legal or similarly significant effects on you (for example, about credit, employment or diagnosis). It offers available time slots and records what you choose; any decision by the business is made by a person. If you believe an automated reply affects you, you can request human review.
• Novaru does not provide diagnoses or medical advice. In an emergency, the assistant will tell you to go to an emergency service.

6. Health data and other sensitive data

We treat health information as sensitive information and apply the protections required by the relevant rules. When Novaru serves a clinic or other healthcare provider:

• The clinic is responsible for obtaining your explicit consent or having another valid legal basis, and for telling you how it processes your data.
• Novaru only asks for what is needed to manage the appointment. We do not ask for medical history, test results or diagnoses by chat.
• Care notes the clinic records in the dashboard stay in that clinic's own database, separate from other businesses.
• We will not ask you for full payment card numbers, bank account numbers or ID documents over messaging. If someone sends a card number, the system masks it before any request to an AI provider.

Please do not send health information by chat that is not necessary to request or manage your appointment.

7. How long we keep data

When a business stops using Novaru, we delete or return its data as agreed in its contract and data processing agreement.

8. Who we share data with

The following services are involved depending on the features used by the business. Providers apply their commercial and data protection terms. Data processing agreements with businesses must identify the sub-processors and contracted functions.

Using the business's own API key does not prevent the selected provider from processing the text it receives. Pseudonymization reduces direct identification, but text can remain personal data; it is not anonymization or a guarantee of zero retention.

You can request information about the service and sub-processors applicable to your account at support@viralithdigital.com. International locations are explained in section 9.

Requests from public authorities

The Manager of Viralith Digital LLC coordinates requests from public authorities through support@novaru.app. Before disclosing data, we verify authenticity, review legality and scope, and document the decision and response. We seek clarification or challenge unlawful requests through the appropriate procedure, obtaining legal advice when there are doubts. Our procedure requires limiting any disclosure to what is legally necessary and obtaining express management approval; a request does not by itself authorize general database access.

Disclosures may also be necessary to defend rights in proceedings or in a corporate transaction, subject to the applicable legal basis, safeguards and notices.

9. International data processing

Novaru runs on its own infrastructure in Ecuador. Supabase backups have their primary region in Brazil. Cloudflare uses a worldwide network; R2's ENAM location is a regional storage reference, not a guarantee of processing exclusively within one country. AI providers may process data in the United States and other countries through infrastructure, affiliates and support. A storage region does not describe all remote access or all processing.

The scope depends on the service and configuration. See the information published by Cloudflare, Supabase, Anthropic and OpenAI. These sources describe potential provider locations; they do not mean that every conversation passes through every listed country.

The storage countries stated here are not an exhaustive list of international processing locations. We are verifying the additional inference, network and support scope for the configurations in use. You may request the available detail and its limitations at support@viralithdigital.com.

The relationship with each recipient must be assessed as a processing engagement or a transfer as appropriate under applicable law. Access from another country does not replace the legal basis, contractual, security and safeguard requirements that apply. This policy does not itself establish that specific clauses have been signed or promise exclusive residency or zero retention.

10. What we do not do with your data

• We do not sell, rent or license personal data or data received from Meta.
• We do not use WhatsApp, Instagram or Messenger data for advertising, to build advertising profiles, or share it with ad networks.
• We do not use your conversations to train artificial intelligence models, our own or anyone else's. We do not authorize using conversations for training. Anthropic and OpenAI commercial APIs do not use data for training by default; their terms and additional settings must be checked, including when a business connects its own key. This does not mean that a provider retains no data to deliver, protect or audit its service.
• We do not combine data across businesses. Each business has its own database. If you write to two businesses that use Novaru, each one sees only its own conversation.
• We do not use data to make decisions about credit, employment, housing or insurance, or for surveillance.

11. Your rights and how to exercise them

You have the right to:

• Access: know whether we process your data and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Objection: object to processing, in particular to receiving promotional messages.
• Portability: receive your data in a structured, commonly used format.
• Restriction or suspension of processing, where the law provides for it.
• Not be subject to decisions based solely on automated processing and request human review.
• Withdraw your consent at any time, without affecting what was done before.

How to exercise them

1. In the chat, immediately: write BAJA or STOP to stop receiving messages. Write, in Spanish, «borra mis datos» ("delete my data") and confirm with SÍ BORRAR to erase your data from that account. Details are at novaru.app/data-deletion.
2. By email: write to support@viralithdigital.com with the subject "Privacy", stating which right you want to exercise, the name of the business you wrote to, the channel (WhatsApp, Instagram or Messenger) and the number or account you wrote from.

To protect your data, we may ask you to confirm that you are the data subject, for example by sending a code or a message from the same number or account. We will never ask for your password.

Response times

Exercising your rights is free of charge. We acknowledge your request within 5 business days and respond within 15 days at most. If applicable rules require earlier action, that shorter deadline prevails. This service commitment does not depend on the future entry into force of Paraguay's Law 7593/2025. If your request concerns data of a client business, we coordinate with that business within the same period.

Complaints to the authority

If you are not satisfied with our response, you may file a complaint with the data protection authority in your country:

• Ecuador: Superintendencia de Protección de Datos Personales (SPDP), spdp.gob.ec.
• Paraguay: the National Personal Data Protection Agency established by Law 7593/2025, once it is operational.
• European Union: the supervisory authority of your Member State.

12. Minors

Novaru is a service for businesses and is not directed at minors. We do not seek to process data of children under 16. If a minor writes to a business, processing their data requires authorization from their parent or legal guardian under the law of their country (including applicable age, capacity and representation rules). We do not profile minors or send them advertising. If you believe we are processing a minor's data without authorization, write to us and we will delete it.

13. Security and incidents

We apply technical and organizational measures proportionate to the risk, including:

• Verification of Meta's signature on every incoming message; encrypted connections (HTTPS).
• A separate database for each business.
• Access tokens for business accounts stored encrypted (AES-256-GCM).
• Dashboard passwords stored only as a cryptographic hash; per-person roles and permissions; phone numbers masked for team members without the owner role.
• Pseudonymization before using external AI providers; usage limits against abuse and spam; audit logs.
• Encrypted backups.

No system is invulnerable. If a security incident affects personal data, we will contain it, notify the responsible business without delay, and notify the competent authority and affected individuals where the law requires and within its deadlines. We will also notify Meta when the incident involves data from its platforms.

14. Client dashboard and website

The Novaru dashboard uses strictly necessary cookies to keep you signed in and to protect the Instagram account connection, and the browser's local storage to remember team access settings. We do not use advertising cookies in the dashboard. The dashboard loads the Facebook SDK only on the screen where the business connects its WhatsApp, with automatic event logging disabled.

The novaru.app website is published on the Bitrix24 platform, which may use its own technical cookies to display the site. We do not add advertising cookies, pixels or third-party tracking tools to the site. You can block or delete cookies from your browser settings.

15. Changes to this policy

We may update this policy when the service or the law changes. We will publish the new version on this page with its date. If the change is significant, we will notify client businesses at least 30 days in advance and, where applicable, ask for new consent.

If there is any discrepancy between the Spanish and English versions, the Spanish version prevails.