Privacy Policy
Effective Date: September 18, 2026
At xcale, we take your privacy seriously. This Privacy Policy explains how we collect, use, and protect your information. Nevatal S.A.S., a company incorporated in Colombia and operator of the xcale platform, is the data controller of your personal data.
1. Information We Collect
We collect information you provide directly to us (such as account info and payment details), as well as information generated through your use of the platform (such as WhatsApp messages, customer interactions, and usage analytics).
2. How We Use Your Information
We use your data to provide our services, train and operate AI agents, improve our platform, process payments, and communicate with you.
3. Data Sharing
We do not sell your personal data. We share data only with trusted partners necessary to operate our service, including payment processors, Meta/WhatsApp for API access and advertising management, and hosting providers (such as Vercel and Digital Ocean).
4. Data Retention
We retain your data as long as your account is active. After account deletion, we retain data for up to 30 days before it is permanently deleted, unless required by law.
5. Meta Advertising Data
When a business connects its Meta Business Portfolio to xcale, we process advertising data that Meta makes available to us on that business's behalf: its ad accounts and their currency and spend limits; its campaigns, ad sets, ads and creatives; the performance metrics of those ads (spend, impressions, reach, clicks, conversations started and similar aggregates); the Facebook Pages, WhatsApp phone numbers, Instagram profiles and pixels the business shares with us; and the access token that authorises these calls, which is encrypted at rest and never shared with another business. We use this data for one purpose: so that the business's own AI agent can read and manage that business's campaigns, inside a daily spend limit the business sets and can change at any time, and so that we can send the business a daily summary of its own advertising. We do not use it to build profiles of individuals, we do not combine one business's advertising data with another's, and we do not sell it or share it with advertising networks or data brokers. We keep it while the connection is active. To request its deletion, a business can disconnect Meta Ads in its xcale dashboard, or remove xcale in Meta (Business Settings › Integrations › Connected apps, or Settings & Privacy › Settings › Apps and Websites for a personal account), or write to legal@xcale.app. Any of these deletes the connection and its access token, the spend limit, the daily summaries we sent and the stored performance metrics. We keep the record of what the business's own agent did with its advertising budget — which campaigns it created, activated or paused, and why — because it is the business's own operating record rather than data Meta holds about a person, and we keep a receipt of the deletion itself, which carries no personal data. Encrypted database backups may still contain deleted records until they rotate out of their retention window; they are never used to restore data that was deleted on request.
6. User Rights
In accordance with Colombian Habeas Data law (Ley 1581 de 2012), you have the right to access, correct, update, or delete your personal data. You may also request data portability.
7. Security Measures
We implement industry-standard security measures, including encryption in transit and at rest, and strict access controls to protect your information.
8. Cookies
We use essential cookies to keep you logged in and analytics cookies to understand how our platform is used.
9. Children's Privacy
Our service is not intended for users under the age of 18.
10. Changes to This Policy
We may update this policy from time to time. We will notify you of any significant changes via email.
Contact Us
If you have any questions, please contact us at legal@xcale.app.