neuri.bots privacy policy

1. Who is responsible

This notice is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Diario Oficial de la Federación on March 20, 2025 and in force since March 21, 2025, and also considers the US laws that apply to Neuri LLC.

• Neuri LLC is the controller for the data of businesses that sign up (owners) and of visitors to neuri.tech. Address: [Neuri LLC postal address — pending], Phoenix, Arizona, USA. Privacy contact: [Legal contact name and email — pending] and hola@neuri.tech.
• Each business is the controller for the data of its customers (the people who message it). For that data Neuri acts as a processor: it handles it only to answer on the business's behalf and according to its settings. If you messaged a business that uses neuri.bots, you can exercise your rights with that business or email us and we'll pass it on.

2. What data we handle

From people who message the business (Instagram, Messenger and WhatsApp)

• The text of the messages you send the business and the replies sent to you (we keep up to 1,000 characters per message).
• The ID assigned by Meta (on Instagram and Messenger) or your WhatsApp number (wa_id). We use it to reply; in our message log it is stored as a one-way hash, not the ID or number.
• Your profile name, only if Meta includes it with the message.
• If you comment on a post or mention the business (for example, to get a link by private message): the text of the comment or mention and its ID.
• If you ask not to be messaged (“stop”): that flag, so we don't reply to you again.

Appointments

If you book an appointment by chat: the service, day and time, status (confirmed, awaiting deposit or canceled), the network you used and, if you join a waitlist, the day you wanted. If the owner logs an appointment by hand, they may type your name. Any deposit is paid through the business's own payment link: Neuri does not receive or see payment details.

Orders

If you place an order by chat: the items, quantities, total, pickup or delivery, the delivery address you give, notes (“no spice”), the time it will be ready and its status. Payment is made to the business; Neuri doesn't process it.

From the business using neuri.bots (owners)

• Sign-up data: your name, email, WhatsApp, business name and type, hours, where and how you deliver, payment methods, FAQs and what the assistant should answer.
• Connections: your Facebook Page, Instagram account or WhatsApp Business number ID and the access tokens Meta provides, stored encrypted.
• If you connect Google Calendar: see section 4.
• If you link a Google Sheet: the published link of your catalog or menu sheet (we read it as CSV) and, if you paste it, your Apps Script web app link so we can send you orders and leads. That app runs in your Google account; we have no access to your Google Drive.
• Plan billing: Stripe stores your card; we only receive the subscription and payment status.
• Support and audit log: what you ask us from My assistant and the log of changes made to your account.

Sensitive data: we don't ask for or look for sensitive data. Please don't send it by chat; if it arrives in a message, it is only used to reply and is deleted with the message log.

3. Why we use it

Purposes needed for the service

• Answer, on behalf of the business, questions about availability, price, location, delivery and payment methods; hold items; book, change or cancel appointments; take orders.
• Notify the owner (by email and in My assistant) of holds, appointments, orders and conversations they should handle in person, and send orders and leads to their sheet if connected.
• Send appointment reminders on the same channel, within Meta's rules (on WhatsApp, outside the 24-hour window, only with approved templates).
• Bill the plan, provide support, prevent abuse and meet legal obligations.

Optional purposes (you can say no)

• Send owners weekly and monthly reports, the satisfaction survey and the keyword summary. Every such email has an unsubscribe link; opting out doesn't affect the service.
• Measure, in aggregate, how many messages are answered and what it costs, to improve the product.

We don't sell personal data, use it for advertising or use it to train artificial intelligence models.

4. Google Calendar and Google's user data policy

If the owner connects Google Calendar, we request a single permission: https://www.googleapis.com/auth/calendar.events (view and edit events). We use it only to:

• Read busy times: for events from today through the last bookable day we read only their ID, start and end — never the title, description or guests. We store only those start/end blocks, and they are replaced each time they're read again. They keep the assistant from offering times when the owner is busy.
• Write appointments: we create one event for each appointment the assistant books (service, customer name or short code, and “Appointment booked by your Neuri assistant”) and delete it if the appointment is canceled.

The Google refresh token is stored encrypted; the access token lives only in memory. It is never included in the data download or in logs. You can remove access at any time from My assistant or in your Google Account → Security → Third-party apps.

neuri.bots' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: Google Calendar data is used only for the scheduling you see in My assistant; it is not transferred to third parties (including Anthropic or any AI model) except as needed for security, to comply with the law, or as part of a merger, acquisition or sale of assets; it is not used for advertising, not sold and not used to train AI models; and no person reads it unless you allow it, for security (investigating a bug or abuse), or as required by law.

5. AI-written replies

What the fixed rules don't cover is drafted by Anthropic's Claude model, acting as our service provider: it receives the customer's message and the business data needed to answer (catalog, hours, policies). Under its commercial terms Anthropic does not use this data to train its models. By default, the first reply to each person says it's an automated assistant, and you can ask to talk to someone at the business.

6. Who we share it with (subprocessors)

We use these providers to run the service. They handle the data only for that and under contract. They are in the US, so data is transferred internationally to that country; under the LFPDPPP, disclosures to processors don't require your consent.

If the owner connects their own AI assistant (for example Claude or ChatGPT) to their account, the data that assistant reads goes to that provider by the owner's choice and under its terms. Beyond that, we only share data if a competent authority requires it by law.

7. How long we keep it

• Message log: deleted automatically after 90 days.
• Reused replies: a general answer to a repeated question is kept at most 24 hours, without the question text and without personal data.
• “Stop messaging me”: honored while the log exists; if you write again after 30 days, or write “start”, the assistant replies again.
• Google Calendar busy blocks: replaced on each read and deleted on disconnect.
• Appointments and orders: while the business has its account (the latest 500 orders and 200 waitlist entries are kept), so the owner can look them up.
• Business data: while it has its account. If it cancels, data is kept so it can come back, until it asks for deletion (section 8). [Pending: automatic deletion period after cancellation]
• Backups: 7 daily copies of account data (without the message log), replaced automatically.
• Anything the law requires us to keep (such as billing records) is kept only for the legal period; what Stripe keeps about payments lives at Stripe.

8. How to download or delete your data

• If you messaged a business on Instagram or Messenger: remove the app from your Facebook or Instagram settings (Settings → Apps and websites). Meta sends us the deletion request and we delete the messages tied to your account across all businesses; you get a confirmation code and a page to check the status.
• If you wrote on WhatsApp (or prefer not to use Meta's option): email hola@neuri.tech and we'll do it by hand. To stop the assistant replying, just write “stop”.
• If you own a business: in My assistant you can download all your data as a JSON file (no keys or tokens) and disconnect Google Calendar (Meta and WhatsApp are disconnected by removing the app from Facebook, Instagram or WhatsApp Business, or by emailing us). After canceling, you can delete everything from My assistant: sign-up, settings, message log, appointments, orders and connections with their tokens. Only one anonymous line (hashed code, dates and plan) remains for accounting.

9. Your rights (ARCO) and how to use them

You can request Access to your data, Rectification, Cancellation (deletion) or Opposition to its use, and you can revoke your consent or limit how your data is used (for example, stop receiving report emails).

• How: email hola@neuri.tech (or [legal contact email — pending]) with your name, a way to reply, what you're asking for and, if you're a customer of a business, which one and on which network you messaged it. We may ask you to verify your identity (or your representative's).
• Timing: we reply within 20 business days and, if it applies, carry it out within the next 15 business days. [Confirm timeframes under the new LFPDPPP in legal review]
• If you're a customer of a business: the business is the controller. You can ask it directly or email us and we'll pass it on right away.

Authority (Mexico): since March 21, 2025, the former INAI's functions over personal data held by private parties belong to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance). If you believe your request wasn't handled, you can go to it.

10. Security

Connections are encrypted (HTTPS); Meta, WhatsApp and Google tokens are stored encrypted; the IDs of people who message are stored as hashes in the message log; My assistant links are signed and expire; and only the Neuri team can open the admin panel, which keeps an audit log. If a breach significantly affects your rights, we'll tell you without delay.

11. If you're in the US

• We don't sell or “share” personal data for targeted advertising.
• If there's a data breach, we'll notify affected people under Arizona law (A.R.S. § 18-552, within 45 days) and other applicable state laws.
• Commercial email under CAN-SPAM: reports, the survey and summaries identify Neuri LLC, include our postal address and a one-click unsubscribe link, and we honor opt-outs within 10 business days (in practice, immediately). Service emails (billing, connection, appointment and order notices) keep arriving.
• neuri.bots is for businesses and is not directed to children under 13; we don't knowingly collect their data.

12. Visits to neuri.tech

To know how many people visit the site and which pages help, we use PostHog (US servers) in anonymous mode: no cookies and nothing stored in your browser, your IP address is not used to identify you (only to estimate the country), no screen recording, and it is never used for ads. We count visits, button clicks and which sign-up step someone reached, without your name, email, phone or anything you type. If your browser has “Do Not Track” turned on, nothing is counted.

13. Changes to this policy

We'll post any change on this page with its date and, if it's important, email owners. If a change needs new consent, we'll ask for it.

14. Contact

Neuri LLC · [Postal address — pending], Phoenix, Arizona, USA · Legal contact: [name and email — pending] · hola@neuri.tech

15. References

• Google API Services User Data Policy (Limited Use)
• Google Cloud: OAuth verification and the Limited Use disclosure
• LFPDPPP — current text (Mexican Chamber of Deputies)
• EY Mexico: the new LFPDPPP and the transfer of INAI's functions to the Secretaría Anticorrupción y Buen Gobierno
• FTC: CAN-SPAM Act compliance guide
• A.R.S. § 18-552 (Arizona breach notification)

Draft for legal review. Not legal advice.