Privacy Policy

1. Who we are

NACHO is provided by Hotbyte s. r. o., Hornostavská 5023/24, 949 01 Nitra, Slovak Republic, company ID (IČO) 57 862 125, registered in the Commercial Register of the District Court Nitra, section Sro, entry 71289/N.

For privacy questions or requests, contact hello@hotbyte.sk.

2. Scope and privacy roles

This policy applies to getnacho.com, NACHO accounts and NACHO integrations with services such as Facebook, Instagram, WhatsApp, email, calendars, payment services and AI providers.

Hotbyte is generally the controller of account, subscription, security, support and website data. When a business customer uses NACHO to manage its leads, contacts and conversations, that business normally decides why and how those records are used and is the controller; Hotbyte processes them on its behalf as a processor. Questions about a conversation with a particular business should normally be directed to that business first.

3. Personal data we process

Depending on how NACHO is used, we may process:

• Account and business data: name, business name, email address, telephone number, role, authentication records, settings and support communications.
• Customer relationship data: contact details, inquiries, messages, attachments, call or message history, notes, quotes, bookings, invoices, consent records and sales-pipeline activity supplied by users or their customers.
• Connected-service data: account identifiers, granted permissions, access credentials, connection status and data received from integrations a customer chooses to enable.
• Billing data: plan, subscription, payment status, invoices and transaction references. Full payment-card details are handled by the payment provider and are not stored by NACHO.
• Technical and security data: IP address, browser and device information, timestamps, request and audit logs, error reports, session and security events.
• Usage and AI data: feature usage, automation activity, prompts, relevant business context, generated responses and token usage where AI features are enabled.

4. Facebook, Instagram and other Meta integrations

A NACHO business customer may choose to connect Facebook Pages and Instagram professional accounts. NACHO requests only the permissions needed to discover authorised business assets, connect messaging, subscribe to message events and reply through the connected account. These may include pages_show_list, pages_manage_metadata, pages_messaging, pages_read_engagement, instagram_basic, instagram_manage_messages and business_management.

Through these integrations we may process:

• Facebook Page, Instagram account and business portfolio identifiers, names and usernames;
• the permissions granted and encrypted Page access tokens;
• sender and recipient identifiers, profile name or username, avatar URL where available, message identifiers, message text, attachments and timestamps;
• messages sent by the connected business through NACHO and delivery or error status.

We use this data to show authorised accounts, receive and organise conversations, create or match CRM contacts, allow the connected business to reply, and run customer-configured follow-up or AI-assistance workflows. We do not use Meta Platform Data to build unrelated advertising profiles and we do not sell it.

Short-lived OAuth codes and discovery results are used to complete the connection. Temporary account-discovery data is normally removed automatically after approximately ten minutes. Stored access tokens remain encrypted until the connection is removed, expires or is deleted.

5. Purposes and legal bases

We process data to provide and administer NACHO, authenticate users, deliver connected messaging and CRM functions, process payments, provide support, prevent abuse, maintain security, comply with law and improve reliability.

Where Hotbyte acts as controller, the legal basis is typically performance of a contract or steps requested before a contract, compliance with a legal obligation, our legitimate interests in operating and securing the service, or consent where the law requires it. Where Hotbyte acts as processor, processing is carried out under the business customer’s instructions and data-processing terms.

6. Sharing and service providers

We disclose personal data only where needed to provide the service, follow customer instructions, comply with law, protect rights and security, or complete a business transaction subject to appropriate safeguards.

Recipients may include infrastructure and hosting providers, Meta and other connected communication platforms, OpenAI or other configured AI providers, Stripe for payment processing, email and SMS providers, calendar providers, professional advisers and public authorities where legally required. Each connected provider also processes data under its own terms and privacy policy.

7. Retention and security

We keep data for as long as needed to provide the service and fulfil the purposes above. Account and CRM data is generally retained while the customer account is active. Some billing, contractual, security and audit records may be kept longer where required by law or necessary to establish, exercise or defend legal claims.

Disconnecting a Meta account removes the local connection and stored access token and stops new messages from being collected. Existing contacts and conversation history remain in the customer’s CRM until the customer deletes them or requests their deletion. Backups are removed on their normal protected rotation unless longer retention is legally required.

We use access controls, encryption of integration credentials, signed webhook validation, logging and other organisational and technical safeguards. No internet service can guarantee absolute security.

8. Cookies, pixels and similar technologies

NACHO uses essential cookies and local storage for login, security, language and interface preferences. Public forms or pages operated by a NACHO customer may also use Meta Pixel, Meta Conversions API or Google Ads tags when that customer enables them. These tools can process browser, device, page-view and conversion data and, for configured conversion events, hashed contact information. The business operating the page is responsible for providing any notice and obtaining any consent required by law.

9. Your privacy rights

Subject to applicable law, you may request access, correction, deletion, restriction or portability of your personal data, object to certain processing, and withdraw consent without affecting earlier lawful processing. You may also lodge a complaint with the competent supervisory authority, including the Office for Personal Data Protection of the Slovak Republic.

If your data is held in a NACHO workspace belonging to one of our business customers, we may forward your request to that customer or assist it in responding. We may need to verify your identity before acting on a request.

10. Facebook and Instagram data deletion

You can request deletion of data received through Facebook, Instagram or another Meta product as follows:

1. Email hello@hotbyte.sk with the subject “Meta data deletion request”.
2. Identify the Facebook Page or Instagram account involved, the business you contacted, and the name or username needed to locate the conversation. Do not send passwords or access tokens.
3. We or the relevant NACHO business customer may ask for reasonable proof of identity or authority.
4. After verification, data under our control will be deleted or anonymised unless retention is required by law or needed for security or legal claims. We will confirm completion or explain any permitted exception.

11. International data transfers

Some service providers may process data outside Slovakia or the European Economic Area. Where required, we rely on an adequacy decision, standard contractual clauses or another lawful transfer safeguard, together with appropriate supplementary measures.

Children

NACHO is a business service and is not directed to children. We do not knowingly invite children to create NACHO administrator accounts.

12. Changes and contact

We may update this policy when the service, integrations or legal requirements change. The effective date above identifies the current version. Material changes will be communicated where required.

Questions and privacy requests can be sent to hello@hotbyte.sk or by post to Hotbyte s. r. o., Hornostavská 5023/24, 949 01 Nitra, Slovak Republic.