Who is who
Nouvico is a set of tools for agencies ("agencies"): requesting access to their clients' advertising, analytics and tag accounts, a CRM with messaging, forms, booking and invoicing, social media publishing, and website feedback. We provide the tools. The agency decides what it collects through them and why, and we process that data on the agency's behalf.
What we collect
- Agency accounts: name, work email, password (stored only as a salted hash), team members, billing status.
- Clients: the name, email and website you type into an access link, plus the name and email returned by the platform you log in with (Meta, Google, TikTok or LinkedIn).
- Platform tokens: OAuth access and refresh tokens, encrypted at rest, used only to grant, check and remove the access you chose. We never see or store platform passwords.
- Activity: a log of grants, revocations and account changes, and technical data such as IP address for abuse prevention.
- What an agency keeps in its other tools: contacts and their messages, form answers, bookings, invoices and payment records, email campaign recipients with opens and clicks, social media posts, comments, messages and reviews from the profiles it connects, and comments and page snapshots left in website feedback.
What we do with it
- Add the agency as a partner on the accounts the client selected, and remove that access on request.
- Re-check daily whether access is still in place, so the agency's dashboard is accurate.
- Notify the agency by email and, if configured, by webhook when access changes.
- Run the agency's other tools: store its contacts and conversations, send the emails and text messages it writes or schedules, publish the posts it schedules, and show it reports.
- When an agency uses the AI features, send the text or images involved (for example a comment it wants a reply drafted for) to an AI provider to produce the result.
- Secure the service, prevent abuse, and process subscription payments.
We do not sell personal data and we do not use client data for advertising.
Platform data
Data received from Meta, Google, TikTok and LinkedIn is used only to provide the features the agency or the client connected the account for: sharing access as described above, and, for social profiles an agency connects, publishing its posts, reading comments, messages and reviews so the agency can answer them, and reading statistics for its reports. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sharing
We share data with the agency the client chose to share access with, and with the service providers that run the product: hosting and file storage (Vercel), the database (Neon) and payments (Stripe), and, depending on the features an agency uses, email delivery (Resend), text messages (Twilio) and AI providers (Anthropic, OpenAI).
Retention and deletion
Client logins and tokens are kept, encrypted, while they may be needed to check or remove the access that was granted. They are deleted when the agency deletes the client. A client can ask for deletion at any time: see how to delete your data. The agency that holds the data decides on the request and carries it out. Removing the Easy Connect access app from your Facebook settings also triggers automatic deletion of the Meta login data that app holds. Agencies can delete their whole account: after a waiting period of seven days its data is removed from our systems. We keep a record that the deletion took place, and our payment provider keeps its own billing records.
Security
Tokens are encrypted at rest with AES-256-GCM, connections use HTTPS, and access to data is scoped per agency. No system is perfectly secure, but we design for the case where something goes wrong: encrypted secrets and revocable access.
Your rights
Depending on where you live you may have rights to access, correct, export or delete your personal data, and to object to or restrict its processing. Clients can start with the agency they shared access with; you can also use our deletion page or write to zapitischaris@gmail.com.
Changes
If we change this policy in a material way we will update the date above and notify agency account owners.