Privacy Policy

1. Data Controller

The Noria platform is operated by Nelson Kuchar Junior, a sole trader registered as self-employed (the Portuguese “recibos verdes” regime) in Portugal, who is the controller of the personal data of platform users (account holders and authorised users). If the business is later incorporated as a company, this section will be updated with the company number and registered office, with 30 days’ notice on this page.

• Controller: Nelson Kuchar Junior (self-employed sole trader)
• Trade name: Noria
• Tax ID (NIF): available on request at contacto@noria.pt
• Place of business: Portugal
• Email: contacto@noria.pt
• Website: www.noria.pt

For matters relating to personal data protection, exercising data-subject rights under the GDPR, or contacting the Data Protection Officer (DPO), please write to contacto@noria.pt with the subject line “GDPR”.

2. Personal Data We Collect

2.1. Account holders and users

2.2. Data processed on behalf of the customer

Noria acts as a processor for these data under Article 28 GDPR. The customer is the data controller and must ensure it has a valid legal basis for processing the personal data of its own customers and contacts.

3. Data Sharing

Your data may be shared with:

• Meta Platforms (WhatsApp Business API): for sending and receiving messages — EU/EEA-hosted
• Google (Calendar API): for scheduling features — under EU Standard Contractual Clauses (SCCs)
• OpenAI: for natural-language processing — under SCCs, with prior anonymisation where feasible
• Infrastructure providers: under Article 28 GDPR data-processing agreements
• Customer-configured integrations: CRM, payment gateway, etc.
• Competent authorities: when required by law, court order or regulator

Noria does not sell, rent or share personal data with third parties for direct-marketing purposes.

The complete and up-to-date list of subprocessors, with their location and the legal basis for international transfers, is available at noria.pt/legal/subprocessors.

4. International Data Transfers

When personal data are transferred outside the European Economic Area (EEA), we apply the safeguards required by Chapter V of the GDPR, namely:

• European Commission adequacy decisions
• EU Standard Contractual Clauses (SCCs) approved by the Commission
• Transfer Impact Assessments (TIA) where necessary

5. Data Security

We implement appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing, as well as the risks for the rights and freedoms of natural persons:

• Multi-tenant isolation: each customer's data are fully isolated at the data layer (automatic per-tenant filters)
• Role-based access control (RBAC): granular per-user permissions with least-privilege defaults
• Encryption in transit: TLS 1.2+ enforced on every connection
• Encryption at rest: databases, files and backups encrypted with AES-256
• Pseudonymisation and anonymisation: applied where technically and functionally feasible
• Secret management: encrypted vault with key rotation and per-environment credential segregation
• Audit logs: immutable record of every sensitive operation
• Verified webhooks: HMAC signature validation on all integrations
• Resilience and availability: encrypted backups, disaster-recovery plan and periodic restore tests
• Breach notification: documented procedure to notify the supervisory authority within 72 hours (Art. 33) and data subjects when applicable (Art. 34)
• Periodic review: regular testing of the effectiveness of security measures (Art. 32(1)(d))

6. Data Retention

• Account data: contract term + 5 years
• Access and audit logs: 12 months
• Messages and history: as configured by the customer
• Financial records: 10 years (Portuguese Corporate Income Tax Code, Art. 123)

After contract termination, data are made available for export for 30 days and permanently deleted thereafter, save where a legal retention obligation applies.

7. Data-Subject Rights

Under Articles 15–22 GDPR you have the right to:

• Access — obtain confirmation and a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data (“right to be forgotten”)
• Restriction — limit processing in certain circumstances
• Portability — receive your data in a structured, commonly used format
• Objection — object to processing based on legitimate interest
• Automated decision-making — not be subject to solely automated decisions with significant legal or similar effects

To exercise any of these rights, write to contacto@noria.pt with the subject “GDPR”. We respond within 30 days, extendable by 60 days for highly complex requests (Art. 12(3) GDPR), with prior notice to the data subject.

You also have the right to lodge a complaint with the Portuguese supervisory authority — Comissão Nacional de Proteção de Dados (CNPD): www.cnpd.pt · Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa, Portugal — or with the supervisory authority of your habitual residence.

8. Cookies and Similar Technologies

In compliance with Article 5(3) of the ePrivacy Directive (transposed in Portugal by Law 41/2004) and the GDPR, we only use cookies and similar technologies when strictly necessary or with your prior, free, specific, informed and unambiguous consent.

8.1. Cookies and local storage

Primary authentication uses HttpOnly, SameSite=Strict cookies set by the application proxy. Strictly necessary cookies do not require consent. Meta cookies only after explicit user action in the WhatsApp connection flow.

8.2. We do not use

• Advertising or retargeting cookies
• Behavioural analytics or profiling
• Social-network pixels
• Third-party marketing trackers

8.3. Manage your preferences

You can accept, reject or change your preferences at any time. Your choice is recorded with a timestamp, policy version and anonymous identifier, as required by Article 7(1) GDPR (ability to demonstrate consent).

Manage cookies

You can withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

9. Artificial Intelligence and Automated Decisions

In line with Article 22 GDPR and the EU AI Act (Regulation (EU) 2024/1689):

• AI agents operate within the guardrails configured by the customer.
• No solely automated decision produces legal or similarly significant effects on the data subject without the option of human review.
• Automatic handoff to human operators is triggered when the AI is uncertain or when the data subject explicitly asks for it.
• Data subjects are informed when they interact with an AI system (Art. 50 AI Act) and may request human review of any interaction.
• The logic underpinning automated processing is explainable and documented.
• We do not perform profiling for social scoring, subliminal manipulation or any practice prohibited by Article 5 of the AI Act.

10. Google Calendar Data

When the Customer connects their Google account to the Platform (scheduling integration), Noria accesses Google Calendar data through the Google Calendar API, using OAuth 2.0 authentication and only after explicit consent on Google's authorization screen:

• Data accessed: events and availability of the connected calendar (titles, dates/times, attendees) and the Google account e-mail address
• Sole purpose: checking availability and creating, rescheduling or cancelling appointments requested by the Customer's clients through the assistant — no other use
• We never sell data obtained from Google APIs, nor use it for advertising, ad profiling or AI model training
• OAuth access tokens are stored encrypted (AES-256) and never exposed to third parties
• You can revoke access at any time in the Platform settings (Settings → Google Calendar) or at myaccount.google.com/permissions; upon revocation, tokens are deleted

Noria's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. Children

The platform is intended for professional use by businesses and is not directed at children under 16. We do not knowingly collect personal data of minors. Where the customer uses the platform to communicate with minors, the customer is responsible for obtaining parental consent under Article 8 GDPR and Article 16 of Portuguese Law 58/2019.

12. Data Protection Impact Assessments (DPIAs)

Noria carries out Data Protection Impact Assessments (DPIAs) under Article 35 GDPR for processing operations that pose a high risk to the rights and freedoms of data subjects, in particular for automated decision-making with AI and large-scale processing of communications data.

13. Changes to this Policy

Material changes are communicated 30 days in advance via email and/or in-product notification. The current version is always available at noria.pt/legal/privacy.

14. Contact and Data Protection Officer

Data controller: Nelson Kuchar Junior (self-employed sole trader) — see section 1.

Data Protection Officer (DPO): Nelson Kuchar Junior — contacto@noria.pt

Single contact point (general, GDPR and DPO): contacto@noria.pt

Please use one of the following subject lines to route your request: “GDPR — access”, “GDPR — erasure”, “GDPR — portability”, “DPO” or “Support”.

Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt · Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa, Portugal · Tel.: +351 213 928 400