Privacy Policy

1. Who we are

This website (nodensgrowth.com) is owned and operated by LUNA WEB3 CONSULTING LLC, a Florida limited liability company (United States), which owns the Nodens brand and its business assets. Services engaged by clients in Brazil are provided and invoiced by ANDRE CAETANO LUNA LTDA (CNPJ 47.729.358/0001-13), licensed to operate the Nodens brand in Brazil. In this policy, “Nodens”, “we” and “us” refer to the entity responsible for your data — the entity that engages you:

2. Data we collect

Information you provide

• Contact details you type into the contact form or the revenue calculator (name, email, phone number) and any information you choose to share;
• Conversations held over WhatsApp, email or phone with our team.

Information collected automatically

• PostHog (product analytics): pages viewed, interactions, approximate location derived from IP address, device and browser information;
• Meta Pixel: standard events for ad measurement, if you arrived at this site through Facebook or Instagram advertising;
• Form submissions are stored in a spreadsheet via Google Apps Script (Google Workspace).

3. How we use your data

• Respond to your inquiry and provide our services — legal basis: execution of a contract or pre-contractual measures (LGPD art. 7, V);
• Measure and optimize marketing campaigns — legal basis: consent (LGPD art. 7, I); you may opt out at any time;
• Improve the website and its content — legal basis: legitimate interest (LGPD art. 7, IX);
• Comply with legal and tax obligations — legal basis: legal obligation (LGPD art. 7, II).

4. Who we share data with

We do not sell personal data. We share data only with service providers (data processors) that help us operate, under contractual data-processing terms:

• PostHog — product analytics;
• Meta Platforms — ad measurement (Meta Pixel) and business messaging infrastructure (see section 5);
• Google — corporate email and spreadsheets (Google Workspace / Apps Script);
• Cloudflare — hosting, CDN and security.

We may also disclose data when required by law or to protect our rights.

5. Platform integrations (Meta and Google)

WhatsApp and Instagram (Meta)

When we operate AI attendants and communication flows for clinic clients on WhatsApp or Instagram:

• The clinic is the data controller of its patients’ data; we act as data processor on the clinic’s behalf;
• Message content, contact identifiers (name, phone number) and conversation metadata are processed to deliver the service. Conversations with clinics may include health data (sensitive personal data, LGPD art. 11), processed under the legal basis applicable to healthcare procedures, under the responsibility of the clinic as controller;
• Data is transferred to Meta Platforms as a sub-processor, through the WhatsApp Business Cloud API and Instagram messaging infrastructure, which are required to deliver messages;
• Platform permissions we use include whatsapp_business_messaging, whatsapp_business_management, business_management, instagram_business_basic and instagram_business_manage_messages;
• Clinics are responsible for obtaining patient consent; we support clinics in handling access, export and deletion requests (see Data Deletion Request);
• The processing we perform on behalf of clinics is governed by a data processing agreement (DPA) signed with each client.

For user accounts of clinic teams on our platform (operator emails, authentication data), the responsible Nodens entity acts as data controller.

Google Calendar

When a clinic connects its Google account through our platform (OAuth consent), we request the following permissions and use them only to operate scheduling features:

• openid and https://www.googleapis.com/auth/userinfo.email — identify which Google account is connected;
• https://www.googleapis.com/auth/calendar.events — create, update and cancel appointment events on the clinic’s calendar, on the clinic’s behalf;
• https://www.googleapis.com/auth/calendar.events.freebusy — check the clinic’s calendar availability before proposing appointment times, to avoid double-booking.

We do not use Google data for advertising or profiling, and we do not share it beyond Google itself. You can revoke access at any time at Google Account → Security → Third-party access, or by disconnecting the calendar in your platform settings. Our use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

6. Cookies and tracking

This site loads fonts from Google Fonts and uses PostHog for analytics and the Meta Pixel for ad measurement. Essential cookies are not required for the site to function. You can:

• Opt out of Meta ad personalization in Ad Preferences;
• Opt out of our own WhatsApp communications at any time by replying STOP;
• Block our website analytics and cookies through your browser settings (including Do Not Track and privacy extensions);
• Every marketing email we send includes an unsubscribe link.

7. Security

We apply technical and organizational measures to protect personal data:

• Encryption in transit (TLS) and at rest;
• Access restricted to personnel who need it to operate and support the service, under the principle of least privilege;
• Logging of access and administrative activities;
• Regular backups and continuous monitoring.

Our personnel access clinic data only to provide the service or support, at the clinic’s request, or to keep the platform secure.

8. International data transfers

Your data may be transferred to and processed in the United States and other countries where our providers operate (Meta, PostHog, Google, Cloudflare). Safeguards include contractual data-processing agreements, standard contractual clauses where applicable, and the security measures described in section 7.

9. Data retention

• Lead and contact data: kept for up to 24 months after our last interaction, or until you request deletion;
• Conversation content processed for clinic clients: copies of raw message content are kept for up to 12 months after the last conversation activity, in accordance with our internal retention policy; structured business data (contacts, appointments) remains available to the clinic until deletion is requested;
• Platform user account data: authentication records are kept for up to 12 months and audit trails for up to 24 months;
• Client contract and billing records: kept for 5 years, as required by Brazilian tax and commercial law;
• Analytics data: kept according to the retention settings of each analytics provider.

10. Your rights

Under the Brazilian LGPD (art. 18 and art. 20) and, where applicable, the GDPR, you have the right to:

• Confirmation that we process your data and access to it;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary data;
• Portability of data provided to another provider;
• Information about with whom your data has been shared;
• Revocation of consent and opposition to processing based on legitimate interest;
• Review of decisions taken solely by automated means that affect your interests, including the criteria used (LGPD art. 20).

To exercise any right, email andre@nodensgrowth.com or use our Data Deletion Request page. We respond within 15 days. Brazilian residents may also file a complaint with the ANPD (www.gov.br/anpd).

11. Children

This website and our services are directed at businesses and are not intended for minors. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at andre@nodensgrowth.com and we will delete it.

12. Contact and changes to this policy

Data Protection contact (DPO): Andre Luna — andre@nodensgrowth.com · LUNA WEB3 CONSULTING LLC, 7901 4th Street North, STE 300, St. Petersburg, FL 33702, USA · +1 (727) 307-3244.

We may update this policy to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page always shows the current version.