1. Data Controller and Scope of this Notice
NETTU AI, commercially known as “Nettu,” with its address at Calle Sinaloa 230, Colonia Ciudad Obregón Centro, C.P. 85000, Ciudad Obregón, Cajeme, Sonora, Mexico, is responsible for the processing of personal data carried out through the nettu.ai website, the Nettu application, its artificial intelligence features, enabled channels, and integrations that the user chooses to connect.
This Notice covers processing activities carried out directly by NETTU AI as well as those performed by providers that process information on Nettu’s behalf in order to provide functions necessary for the Service. When the user voluntarily connects an external service, the specific conditions described for that type of integration will also apply.
For inquiries related to privacy and personal data protection, users may contact help@support.nettu.ai.
2. Personal Data We Process
The information processed depends on the features used. Creating an Account does not mean that Nettu collects every category described in this Notice for every user.
We may process identification and contact data, such as name, email address, telephone number, and profile information; information necessary to administer the Account and its authentication, such as user identifiers, sessions, associated devices, access logs, and security events; and technical data generated during the use of Nettu, including IP address, browser, operating system, language, device type, access dates and times, activity, diagnostics, errors, and performance metrics.
Due to the nature of the Service, the user may record financial or asset-related data associated with their personal finances, such as income, expenses, balances, budgets, goals, transactions, descriptions, dates, categories, savings, debts, or obligations. Manually recording this information does not require users to provide Nettu with login credentials for their bank accounts.
We may also process information that the user provides when using Nettu’s various features, including messages, instructions, notes, documents, files, images, audio, transcripts, reminders, and events. When the user connects an external service, we may access only the information covered by the permissions granted and necessary to provide the authorized feature.
To administer a Subscription, we may process information such as the subscribed Plan, applicable price and currency, Subscription status, subscription and renewal dates, billing country, transaction references, approved or declined payments, refunds, and chargebacks. When complete card information is entered directly into a payment provider’s interface, Nettu does not store the full card number or security code. If a CFDI is requested, we will additionally process the tax information necessary to issue it.
Nettu obtains information directly from the user, automatically during operation of the Service, and, when authorized, from integrations the user chooses to connect. We also retain preferences and records necessary to document decisions related to consents, permissions, cookies, and other privacy settings.
If the user enters personal data belonging to another person, the user must have the authorization, right, or sufficient legal basis to do so. Nettu will process that information only to the extent necessary to perform the requested function.
3. Purposes and Consents
Personal data is used to create, authenticate, administer, and protect the Account; store and organize information provided by the user; process instructions; provide requested artificial intelligence features; process text, audio, images, and documents; generate classifications, summaries, budgets, analyses, and reminders; operate events and authorized integrations; provide the Vault; administer Plans, limits, and Subscriptions; process charges, failed payments, cancellations, refunds, and inquiries; issue tax receipts when requested; provide support; diagnose errors; maintain the stability and security of the Service; detect fraud or unauthorized access; document transactions and authorizations; comply with legal, tax, and accounting obligations; and respond to valid requests from competent authorities.
Not all of these purposes involve all categories of information. When an optional feature requires access to data that is not necessary for the general operation of Nettu, the corresponding processing will begin when the user chooses to enable that feature or grant the required permission.
Financial and asset-related data receive special treatment. When the law requires express consent for their processing, Nettu requests it through a specific electronic mechanism separate from acceptance of the Terms and Conditions. Accepting the Terms, creating an Account, or continuing to browse does not substitute for such consent. The data subject may subsequently withdraw consent through the mechanisms described in this Notice, without retroactive effect on processing lawfully carried out before the withdrawal. Withdrawal may prevent the operation of features that necessarily depend on such information. Current Mexican law generally requires express consent for financial or asset-related data, subject to the exceptions provided by law.
Separately, Nettu may use optional technologies to measure website navigation and performance, attribute advertising campaigns, or conduct remarketing. These purposes are not necessary to use essential features and depend on the corresponding authorization. Users may reject them or later modify their choice through Configure Cookies.
Nettu’s ordinary features are not designed to deliberately request sensitive personal data relating to, among other matters, health, racial or ethnic origin, genetic information, religious beliefs, philosophical convictions, political opinions, or sex life. Users are advised not to provide such information when it is unnecessary and to remove or redact it from a document before uploading it if it is unrelated to the requested function. If a future feature intentionally requires sensitive personal data, Nettu will provide prior notice of the purpose and obtain the consent required under applicable law.
4. Artificial Intelligence and Automated Processing
Nettu uses artificial intelligence systems and other automated mechanisms to interpret requests, extract information, classify records, process content, and produce the requested responses or results. To perform these operations, necessary content may be processed by technology providers acting on Nettu’s behalf under the corresponding contractual and confidentiality obligations.
Nettu does not use conversations, financial records, documents, audio, images, or information obtained through integrations to train general-purpose artificial intelligence models for the benefit of third parties. Vault content is also not used for artificial intelligence training, advertising, remarketing, or commercial profiling.
We may use technical metrics, aggregated statistical information, or data that has previously been de-identified so that it no longer reasonably identifies an individual in order to analyze the stability, performance, errors, security, and operation of the Service.
Nettu does not currently use exclusively automated processing to grant credit, determine creditworthiness, or independently make decisions intended to produce legal effects on the user or otherwise similarly and significantly affect the user’s rights.
5. Google Calendar and Other Integrations
When a person connects Google Calendar, Nettu uses Google’s authorization mechanisms and requests only the permissions necessary for the features the user chooses to enable. The exact scope of those permissions is displayed during the authorization process. Depending on the authorized feature, these permissions may include calendar and event information such as identifiers, titles, descriptions, dates, times, time zones, locations, availability, or other fields necessary to provide the requested function.
Nettu may use this information to view the user’s schedule, provide context requested by the user, manage reminders, and, when sufficient authorization exists, create, modify, or delete events. Data obtained through Google Workspace is not used for advertising, remarketing, sale of information, creditworthiness assessment, or training or improving general-purpose artificial intelligence models.
Human access to information obtained through Google Workspace is not part of ordinary processing and is limited to circumstances permitted under applicable policies: when the user expressly authorizes the access necessary to address a specific request, when it is necessary to investigate security or abuse issues, or when a valid legal obligation exists. Google’s current policy requires transparency regarding the access, use, storage, and sharing of its data, minimization of permissions, and compliance with Limited Use restrictions.
The user may disconnect the integration through the mechanisms available in Nettu or revoke authorization through their Google account. Once authorization is revoked, Nettu stops obtaining new information through that authorization and deletes or stops using synchronized information that is no longer necessary, subject to legally applicable retention periods.
The use and transfer of information received from Google APIs is carried out in accordance with the Google API Services User Data Policy, including its Limited Use requirements. Google also requires applications to request only the permissions necessary for implemented features.
Other voluntary integrations are governed by the same principles of specific authorization and data minimization. If a new integration introduces data processing that is materially different from the processing described in this Notice, the corresponding information will be provided before such processing begins, and new consent will be requested when legally required.
6. Vault
The Vault is a separate feature intended for storing credentials, secrets, and private notes deliberately entered by the user. Its contents are used exclusively to provide operations specific to that feature, such as storing, retrieving, managing, or deleting the corresponding information.
Nettu does not use Vault content for advertising, remarketing, commercial profiling, artificial intelligence model training, or as ordinary context for the assistant.
The existence of the Vault does not mean that Nettu requests secrets through other channels. Nettu will not request a Vault password, banking PIN, CVV code, OTP code, dynamic token, recovery key, or other equivalent information by email, WhatsApp, support channels, or ordinary chat.
The user determines what information is stored. Because disclosure of certain credentials could have serious consequences, Nettu recommends that users not store banking PINs, CVVs, one-time codes, dynamic tokens, recovery keys, or other secrets in the Vault that would immediately allow a financial transaction to be performed or a particularly sensitive account to be recovered.
The technical characteristics of encryption, protection, and recovery are described in the public Security information according to the measures actually implemented. This Notice does not attribute technical properties to the Vault that have not previously been verified.
7. Providers, Processors, and Transfers
Nettu uses providers that perform functions necessary to operate the Service, including infrastructure and hosting, storage, databases, authentication, artificial intelligence and content processing, communications, payments, authorized analytics, monitoring, security, and support.
When a provider processes data on Nettu’s behalf as a data processor, it must do so within the scope of the instructions and obligations applicable to the contracted service. Mexican law distinguishes this processing on behalf of the data controller from transfers made to third parties other than processors and requires that the relationship with the processor contractually define the scope of its activities.
Certain third parties may process information under their own responsibilities when necessary to carry out an operation requested by the user or comply with their own obligations; for example, certain payment providers or external services voluntarily connected by the user. Information may also be disclosed to administrative, tax, or judicial authorities when there is a legal obligation or a valid request issued within their authority.
Certain processing activities may take place outside Mexico. Nettu will comply with the obligations applicable to the domestic and international disclosures or transfers involved. When a transfer to a third party requires consent and does not fall within a legally recognized exception, the data subject will receive the corresponding information and may accept or reject the transfer before it takes place. The LFPDPPP distinguishes transfers to third parties from processing carried out by data processors and establishes specific circumstances in which a transfer may be made without additional consent.
Nettu does not publish an inventory of technology providers in this Notice. The use of a specific provider may change during operation of the Service without, by itself, modifying the purposes, categories of data, or rights described herein. When a change involves a new processing activity that must be disclosed or consented to, the corresponding provisions of this Notice will apply.
8. Cookies and Similar Technologies
Nettu uses cookies, local storage, identifiers, and equivalent technologies when necessary to authenticate users, maintain sessions, protect accounts, retain settings, and provide essential features.
Optional technologies intended for analytics, campaign attribution, advertising, or remarketing will be activated only after the corresponding authorization has been obtained. Users may accept, reject, or configure these technologies and later modify their choice through Configure Cookies.
The Cookie Policy describes in greater detail the categories of technologies used, their purposes, and the mechanisms available to manage them.
9. Retention and Deletion
Nettu retains personal data for as long as necessary to provide the features used, fulfill the disclosed purposes, and address obligations or liabilities that continue after the relationship with the user has ended.
While an Account remains active, the information necessary for its operation is retained. When the user requests its deletion, the Account enters a 30-day recovery period during which the request may be reversed. Once that period ends, the permanent deletion process begins for information that is no longer required to be retained.
Certain records may be retained for additional periods when necessary to comply with tax, accounting, or legal obligations; address payments, refunds, chargebacks, or claims; investigate fraud or security incidents; document transactions or consents; or defend rights and responsibilities arising from the relationship with the user. Information retained for these reasons is limited to the purposes that justify its retention.
When an integration is disconnected, Nettu stops obtaining new information through it and deletes or stops using synchronized data once it is no longer necessary. Backup copies may temporarily retain information that has already been deleted from active systems until ordinary technical rotation and recovery cycles are completed.
Information that has been de-identified so that it is no longer reasonably attributable to an identified or identifiable individual may be retained for statistical, technical, or security purposes.
10. Security and Data Breaches
Nettu maintains administrative, technical, and physical measures designed to protect personal data against damage, loss, alteration, destruction, and unauthorized access or processing. The measures applied depend on the nature of the information, the risk associated with each processing activity, and the characteristics of the feature used.
No service connected to the Internet can guarantee absolute security. When Nettu identifies a security breach that must be communicated under applicable law, it will notify affected individuals in accordance with the applicable legal requirements and provide the information necessary for them to take measures to protect their interests.
Nettu investigates identified incidents and may adopt corrective or preventive measures, including terminating sessions, revoking access, or requiring additional verification when necessary. Suspected unauthorized access, loss of a device, compromised credentials, or another incident involving personal information may be reported to help@support.nettu.ai.
11. ARCO Rights, Withdrawal of Consent, and Limitation of Processing
Data subjects may request Access, Rectification, Cancellation, or Opposition regarding their personal data. They may also request the withdrawal of previously granted consent and use the available mechanisms to limit the use or disclosure of their information when applicable.
Requests may be sent to help@support.nettu.ai with the subject line “ARCO Rights.” They must include the data subject’s name and a means of receiving communications; the information necessary to verify their identity and, where applicable, the authority of any person acting on their behalf; a description of the data involved, except when general access is requested; and a sufficiently clear explanation of the right or action being requested. In the case of rectification, the requested changes must be specified and supporting documentation must be provided when necessary.
Nettu may request additional information only when necessary to verify identity, locate the data, or properly understand the request. The current LFPDPPP establishes a general maximum period of 20 days to communicate the determination made and, when the request is granted, an additional 15 days to give effect to the right. Both periods may be extended once under the circumstances permitted by law.
The exercise of ARCO rights is free of charge. Only reproduction, copying, or delivery costs permitted by law may be charged. When a request is denied in whole or in part, Nettu will communicate the corresponding reason.
Cancellation, opposition, or withdrawal of consent does not require the deletion of information that must continue to be processed due to a legal obligation, to fulfill responsibilities arising from a legal relationship, to address a claim, to prevent fraud, or under any other circumstance permitted by law.
Preferences relating to cookies and optional technologies may be modified through Configure Cookies. Requests concerning other limitations on the use or disclosure of information may be submitted to the same privacy email address.
When mandatorily applicable law recognizes additional data protection rights, those rights may be exercised through the same channel, without prejudice to any additional mechanisms that must be made available under such law.
12. Minors
Nettu is intended for individuals who are 18 years of age or older and is not designed for Account creation by minors.
If Nettu reasonably identifies an Account created in violation of this condition, it may restrict the Account and take appropriate action regarding the associated information, subject to any applicable legal retention obligations.
Any person who believes that Nettu has received personal data from a minor under circumstances inconsistent with this policy may report it to help@support.nettu.ai.
13. Amendments and Contact
Nettu may update this Notice when personal data processing activities, the features that give rise to them, or applicable legal obligations change. Editorial adjustments or clarifications that do not materially change the conditions of processing may be reflected by publishing a new version and updating the date shown at the beginning.
When an amendment materially changes the categories of data processed, the purposes, transfers subject to consent, or any other condition requiring a new decision from the data subject, Nettu will communicate it by email and an in-app notification before applying the new processing activity, where applicable. If the law requires new consent, it must be obtained before the affected processing begins.
Nettu may retain the records necessary to document which version of the Notice was made available to an individual and the specific authorizations granted.
For privacy inquiries, exercise of rights, or reports related to personal data:
NETTU AI
Calle Sinaloa 230, Colonia Ciudad Obregón Centro
C.P. 85000, Ciudad Obregón, Cajeme, Sonora, Mexico
nettu.ai
Use of this channel does not limit the data subject’s right to contact the competent personal data protection authority if they believe their rights have been violated.