Privacy Policy

NuovaCRM is software provided to clinics and service businesses so that they can manage their sales processes. The data of two different groups of people is involved: the organisation staff who use the service and that organisation's own leads.

For the data of leads, the organisation is the data controller; NuovaCRM is the data processor. That is, a clinic decides what happens to its own lead records, and we process them on its instructions.

For organisation staff: name, e-mail address, role, session records (IP address, browser information, time) and recognised devices.

For leads: the data the organisation collects itself — name, telephone, e-mail, messaging history, appointment and deal records.

For connections: the identifiers and access tokens of the Google and Meta accounts you connect. Tokens are stored encrypted and are never displayed back in the interface.

To provide the service itself: showing records, sending and receiving messages, writing appointments, reporting.

For account security: sign-in, two-step verification and notification of sign-in from an unrecognised device.

For accountability: audit records showing who changed what and when.

When an organisation connects its Google account, the openid, email and profile scopes are requested in order to sign in. Beyond these, the following permissions are requested only for the capabilities the organisation enables, and each one serves a single function:

• gmail.send — sending e-mail through the CRM
• calendar.events — creating, updating and cancelling appointments on the user's calendar, and keeping them in sync both ways
• calendar.calendarlist.readonly — listing the user's calendars so they can choose which ones sync

We do not request permission to read, list, label or delete the user's mail, and we do not request access to Google Drive or Google Tasks. A CRM follow-up is carried by the calendar event's own reminder.

Limited Use disclosure: NuovaCRM's use of information received from Google Workspace scopes adheres to the Google User Data Policy, including the Limited Use requirements.

The use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

In practice this means:

• We use the data only to provide the functions listed above, which are visible and prominent in the interface.
• We do not transfer the data to third parties — other than for a security review, a legal obligation, and transfers that take place with the user's explicit consent.
• We do not use and do not sell the data for advertising, targeting, remarketing or credit assessment.
• We do not use the data to train, develop or create artificial intelligence or machine learning models.
• Humans do not read the data. We list the exceptions: the user's documented explicit consent for us to view a specific message; security necessity (investigation of an error or of abuse); legal obligation; and the use of aggregated and anonymised data for internal business purposes.

You can remove the connection at any time; when it is removed, the access token is revoked and deleted from the vault. You can also withdraw access from your Google Account's security settings.

The Meta connection is used for three things: filing the records arriving from lead ad forms into the CRM, bringing Messenger/Instagram conversations into the organisation's inbox, and managing the organisation's own WhatsApp Business line from the CRM. No ad targeting is carried out.

The permissions requested and what each is for:

• leads_retrieval, pages_manage_ads — listing lead ad forms and retrieving the records submitted through those forms
• pages_show_list, pages_manage_metadata, pages_read_engagement — choosing which Page to connect to and setting up that Page's event subscription
• pages_messaging — receiving and replying to Messenger conversations
• instagram_basic, instagram_manage_messages — the conversations of the connected Instagram account
• business_management — listing the organisation's business assets
• whatsapp_business_management — managing the organisation's own WhatsApp Business Account and line: reading, creating, editing and deleting approved message templates; setting up the line's event subscription; deregistering the number when the line is removed
• whatsapp_business_messaging — messaging the customer from the organisation's own number: sending approved templates, sending free-form text and files while the 24-hour service window is open, receiving incoming messages and media

WhatsApp Business data

When an organisation connects its own WhatsApp line, the following data is processed. Each item is used only for the purpose written next to it:

• WhatsApp Business Account identifier (WABA ID) and its name — to show which account is connected
• Telephone number identifier (phone_number_id), display number and verified business name — to send from the correct line and to name the line on screen
• The line's quality rating and connection status — to show the organisation the health of the line
• The WhatsApp number of the person in the conversation (wa_id) and the WhatsApp profile name — to match the message with the correct customer record
• Message text and the media sent and received (image, audio, document) — so that the conversation appears in the organisation's inbox and is retained on the customer record
• Delivery and read statuses — to show the organisation whether the message arrived
• Approved message templates and their approval statuses — so that the organisation can manage its templates from the CRM

In Coexistence mode (the same number working both on the phone and in the CRM), copies of the messages the organisation sends from the phone and the last six months of conversation history transferred by Meta are also received — so that the customer record is not left incomplete.

WhatsApp data is not combined across organisations; each organisation sees only the data of its own line. This data is not used to train models.

Data received from Meta is not sold, is not used to enrich profiles and is not processed for surveillance purposes.

Meta users may make a data deletion request; how it works is set out on the Data deletion page. When you remove the app from your Facebook settings, the deletion request is forwarded to us automatically.

Organisation data is retained for as long as the organisation's subscription continues. When the organisation closes its account, its data is deleted.

Password reset links become invalid after one hour and invitation links after seven days, and both are single-use. Verification codes are valid for ten minutes.

Audit records are preserved for a period as a matter of accountability even if the record itself is deleted — so that it can be shown who deleted what.

How long WhatsApp and Meta data remains

These items are written out separately, because the sentence “retained for the duration of the subscription” does not describe what remains on the WhatsApp side. What is retained:

• The message itself — text, direction, timestamps, delivery and read status, Meta's message identifier (wamid), the other party's number and WhatsApp profile name.
• The media sent and received itself — image, audio, document — is held in object storage and linked by reference from the message record.
• The raw webhook payload — the body Meta sends, in two places: in the event ledger that prevents the same event from being processed twice, and in the copy alongside the message record. It is needed in order to tell a redelivery apart and to be able to resolve a fault afterwards.
• Line details — WhatsApp Business Account identifier, number identifier, display number and verified name. The access token is stored encrypted.

The line's quality rating is not retained: it is read live from Meta during the health check, converted into a “good / caution / red” status and shown on screen, and the value itself is not written down.

There is no automatic deletion by age. This is a deliberate choice: in a CRM the conversation is the customer record itself, and a history quietly shrinking in the background would mean the organisation losing its own data. Records remain until the organisation deletes them.

When the organisation account is deleted, all of the above goes in the same operation, through the database chain. Backups are retained for 30 days and are overwritten cyclically; deleted data also drops out of the backups within this period at the latest.

Removing only the WhatsApp line does not delete the conversation. The number is deregistered on the Meta side; the line, the chats and the raw event records are deleted; but the message history remains in the organisation's own records — the patient file is there.

Media files in object storage are deleted by an administrator by hand after the database record is gone. There is no scheduled job today that does this, and we are not writing as though there were.

The diagnostic ledger of incoming webhooks is separate: it keeps the first 400 bytes of each request's body and its outcome (signature rejected, body malformed, organisation could not be resolved, processed). This ledger is attached to the platform rather than to an organisation and remains even if the organisation is deleted; those 400 bytes may contain the first lines of a message. Without the ledger, “Meta never sent it” could not be told apart from “it sent it, we dropped it”.

A Meta data deletion request removes that Meta user's identity links and severs the connection; it does not delete the organisation's business records (contact, lead, conversation). Its scope and the reasoning are on the Data deletion page.

The main database, file attachments and backups are hosted on servers in Germany (Hetzner). The other parties used for the operation of the service: Resend for sending e-mail, Vercel for delivering the interface, Cloudflare for domain name resolution, and Google and Meta to the extent that you connect them.

We list one by one what each of them does, which country it is located in and which data it accesses on the Sub-processor List page. We do not use any third-party analytics, advertising or tracking service.

Two cookies are used and both are strictly necessary: the nuova_session cookie that carries the session and the nuova_locale cookie that holds the interface language. There are no advertising or tracking cookies. The details are in the Cookie Policy.

You have the right to access your data, to request its rectification or erasure, to object to processing, and to data portability. If you are a lead of an organisation, you must first address your request to the organisation concerned — it is the data controller.

The full list of rights under KVKK (Turkish Personal Data Protection Law No. 6698) and the GDPR, the legal grounds they rest on and the application procedure are in the KVKK and GDPR Privacy Notice.

Contact: gizlilik@nuovacrm.com

The obligations we undertake in our capacity as data processor — processing on instructions, security measures, breach notification, the right to audit and deletion at the end of the contract — are summarised on the Data Processing Agreement page.

The service is provided by: PLEKSON SAĞLIK VE TURİZM SANAYİ TİCARET ANONİM ŞİRKETİ, Merkez Mah. Kültür Cad. No:4 İç Kapı No:11, Gaziosmanpaşa / İstanbul, Trade registry no: 312908-5 · MERSİS no (Turkish central trade registry): 0730072962700001 · Tax office / tax ID: Gaziosmanpaşa Tax Office 7300729627

When this policy changes, the date above is updated; material changes are notified to organisation administrators by e-mail.