Nazca Labs
Español
Nazca Labs Privacy Policy
This policy explains what personal data we process, why, who we share it with, how long we keep it and how you can exercise your rights. It applies to nazca-labs.com, the client portal (portal.nazca-labs.com) and our services.
1. Who is responsible for your data
Nazca Labs E.I.R.L. ("Nazca Labs", "we" or "us"), a company incorporated in Peru.
Privacy contact: hola@nazca-labs.com (subject: "Privacy")
We process your data in accordance with Peru's Personal Data Protection Law (Law No. 29733) and its Regulations, approved by Supreme Decree No. 016-2024-JUS.
Data banks: your data is stored in the "Clients and portal users" and "Contacts and prospects" data banks, which will be registered with Peru's National Registry of Personal Data Protection. We will publish their codes here once registration is complete.
2. What data we process and why
| Purpose | Data | Why we may do it | How long we keep it |
|---|---|---|---|
| Replying to inquiries sent by form or email | Name, email, services of interest, message, source page or campaign if any | Steps you request before a contract | 12 months after last contact, if no contract follows |
| Creating and managing your portal account | Name, email, phone, job title, company, tax ID, country, address and hashed password | Performance of the contract | While the account is active and up to 12 months after closure |
| Providing and supporting the services | Projects, requests, tickets, messages and information you share with us | Performance of the contract | During the contract and up to 5 years afterwards, for warranties, claims and legal defense |
| Invoicing, collecting payment and meeting tax and accounting duties | Billing data, receipts, amounts, date, payment method and reference | Performance of the contract and legal obligation | At least 5 years, or longer if the law requires |
| Protecting accounts and preventing fraud or abuse | IP address, email used to sign in, failed attempts, sessions and activity log | Necessary for the security of data and of the service | Session: up to 7 days. Security logs: up to 24 months |
| Handling complaints and rights requests | Claimant details and case details | Legal obligation | At least 2 years after the case closes |
| Sending you news and advertising | Name and email | Only with your consent, separate and optional | Until you withdraw it |
If you do not provide the data marked as required on a form, we will not be able to reply to you or provide the service. Marketing data is always optional, and refusing does not affect your contract or support.
We do not ask for sensitive data such as health, religion or biometric data. Please do not include it in your messages. If a project requires it, we will address that in writing first.
3. Payments
We may accept bank transfers and, when available in the portal, online payment processors such as Stripe or similar providers. Before activating a processor, we will update this policy to identify it.
When you pay by card online, you enter your card details directly in the processor's system. Nazca Labs does not store your full card number or security code. We only keep the payment confirmation and, if the processor provides it, limited information such as card brand, last four digits and a reference identifier. The processor also acts as a controller of your data, under its own privacy policy, to execute the payment and prevent fraud.
4. Artificial intelligence
Our website and portal. They do not currently use artificial intelligence to make decisions about you or to build behavioral profiles.
Our services. We build AI agents, chatbots and automations. Depending on the project, we may use models and tools from specialized providers (for example, Anthropic, OpenAI or Google). We will tell you which ones apply to your project before processing personal data with them.
Our commitment: we do not use your data or your customers' data to train models, ours or third-party, without your written authorization.
Automated decisions. You have the right not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect you, subject to legal exceptions. If a service involves such a decision, we will tell you beforehand, explain its main criteria and allow you to request human intervention.
Client chatbots and agents. If you interact with an assistant we built for another company, that company decides how your data is used and is responsible for it. Nazca Labs acts on its behalf. Please send your requests to that company; if they reach us, we will forward them.
5. When we act on behalf of our clients
If a client gives us data about its own users for a project, the client is the controller and Nazca Labs is the processor. In that case we follow the client's instructions, do not use the data for our own purposes and return or delete it when the engagement ends. Where a legal reason or the contract allows retention, it will not exceed the applicable legal period.
6. Who we share your data with
We do not sell your data. We only share it with those we need in order to operate:
| Recipient | Purpose | Location |
|---|---|---|
| Hostinger | Website hosting, email and domain | European Union and other countries where the provider operates |
| Railway | Hosting for the portal, API and database | United States |
| Google Fonts and Fontshare | Delivering the website's fonts | United States and other countries |
| Payment processors (once activated) | Executing payments and preventing fraud | Depends on the processor |
| Project AI providers (when applicable) | Providing the contracted service | Depends on the provider, usually the United States |
| Accountants, lawyers and auditors | Meeting legal duties and defending rights | Peru |
| Authorities | When required by law or a valid order | Peru or another competent country |
These providers may only use your data to provide their services to us. If recipients change, we will update this list.
International transfers
Several providers are located outside Peru, so your data may travel to other countries. When the destination does not have a recognized adequate level of protection, we use contractual safeguards that require the recipient to meet obligations equivalent to those under Peruvian law. We also carry out transfers that are necessary to perform our contract with you. You can request more information at hola@nazca-labs.com. We will report these transfers to Peru's National Authority for Personal Data Protection as its regulations require.
7. Cookies and similar technologies
We only use what is needed for the website and portal to work and to remember your preferences:
| Name | Where | Purpose | Duration | Type |
|---|---|---|---|---|
nl_session | Portal and admin panel | Keeping you securely signed in | Up to 7 days | Strictly necessary cookie |
lang, nz-lang | Website and portal | Remembering your language | Until you delete it | Local storage preference |
sound | Website | Remembering whether sound is on | Until you delete it | Local storage preference |
| Portal theme | Portal | Remembering your chosen appearance | Until you delete it | Local storage preference |
utm | Website | Identifying the source campaign if you submit the form | Until the tab closes | Session storage |
We do not currently use advertising or analytics cookies. If we add them, we will ask for your consent first and let you refuse just as easily.
When the website loads, your browser connects to outside providers, for example to download fonts, and they may receive your IP address. You can delete or block cookies and local data in your browser, but you cannot use the portal without the session cookie.
8. Your rights
You can exercise these rights free of charge by writing to hola@nazca-labs.com with the subject "Privacy":
| Right | What it allows | Maximum response time |
|---|---|---|
| Information | Knowing how and why we process your data | 8 business days |
| Access | Getting a copy of your data | 20 business days |
| Portability | Receiving the data you gave us in a structured, commonly used, machine-readable format, and transmitting it to another controller where technically feasible | 20 business days |
| Rectification, update and inclusion | Correcting or completing your data | 10 business days |
| Cancellation or erasure | Asking us to delete your data when no longer needed or if you withdraw consent, unless we must keep it by law | 10 business days |
| Objection | Objecting to processing on legitimate grounds | 10 business days |
| Objective processing | Not being subject to the automated decisions described in section 4 | 10 business days |
Time limits run from the day after your request. Except for the right to information, they may be extended once by an equal period if we justify it.
Include your name, the right you wish to exercise and a way to verify your identity. If you act for someone else, attach proof of your authority. We will only ask for what is needed to handle your request.
Withdrawing consent. You can do this at any time without giving a reason. It does not affect prior processing. For advertising, use the unsubscribe link in the email or write to us; we will act within 10 business days at most.
If you are not satisfied. If we deny your request, do not respond on time or our response does not satisfy you, you may file a complaint with the National Authority for Personal Data Protection of Peru's Ministry of Justice and Human Rights.
9. Security
We apply technical and organizational measures proportionate to the risk, such as encrypted connections (HTTPS), hashed passwords, protected session tokens, organization-level access control and activity logging. No system is infallible. If a security incident occurs, we will act as the law requires: we will notify the authority where applicable within 48 hours of becoming aware of it, and tell you if it affects your rights.
You are responsible for protecting your password and for telling us if you suspect unauthorized access.
10. Minors
Our services are aimed at businesses and adults. We do not knowingly collect data from anyone under 18. If you believe a minor gave us their data, write to us and we will delete it.
11. People outside Peru
European Economic Area and United Kingdom. If the GDPR or UK GDPR applies to you, the legal bases are those in section 2: contract, pre-contractual steps, legal obligation, legitimate interest in security, and consent. You also have the right to restrict processing and to complain to your supervisory authority. Transfers are protected by standard contractual clauses or another valid safeguard where required.
California (USA). We do not sell personal data or share it for cross-context behavioral advertising, as those terms are defined in California privacy law. Requests to access, correct or delete data may be sent to the email above. We will not discriminate against you for exercising your rights.
Other countries. If the law of your country gives you additional rights, write to us and we will honor them where applicable.
12. Changes to this policy
We may update this policy if our services, providers or the law change. We will post the new version here with its date and, for important changes, notify you by email or in the portal before it takes effect. If a change requires your consent, we will ask for it.
13. Contact
Nazca Labs E.I.R.L., Peru
hola@nazca-labs.com
This English version is provided for convenience. If there is any difference from the Spanish version, the Spanish version prevails unless mandatory law provides otherwise.