Privacy Policy

1. Who we are and how to reach us

Nelum Digital Intercoms is the trade name of R.P. Desenvolvimento de Software LTDA., the entity responsible for processing the personal data described in this policy (the "data controller").

For questions, requests, or to exercise your rights over personal data, contact us at contact@nelum.pro.

2. Who this policy covers

• ·Property managers and front-desk staff who use the admin panel on behalf of a property;
• ·Residents who use the web portal or mobile app to answer calls and manage their access;
• ·Visitors who use the virtual call pad through a QR code, without creating an account;
• ·People invited during the sign-up process for an organization, unit, or property.

3.1 Account and profile data

When you create an account (as property staff or a resident), we collect your name, email, password (stored encrypted) and, where applicable, phone number, role/title, and the access permissions assigned to you within the organization. If you choose to sign in with Google or Apple, we receive the basic profile information those providers share (name and email).

3.2 Property and organization data

Administrators register information about the property (name, address, type), its units, blocks, and the team's permission structure. This data is treated as the contracting organization's data, processed by us on its behalf.

3.3 Call data

We log metadata for every call placed through the system: origin (visitor, unit, or gate), destination unit, timestamp, duration, and status (answered, missed, ended). Audio and video travel in real time through our real-time communications provider, GetStream, and are not recorded or stored by Nelum.

3.4 Visitor data

Visitors don't create an account. When using the virtual call pad, we collect only the name or identification provided at the time of the call, the QR session token used, and the time of access — the data needed to log and route the call to the correct unit.

3.5 Technical and device data

We automatically collect technical data such as IP address, device type, operating system, push-notification identifiers (in the mobile app), and technical error logs, used to keep the service secure, performant and stable.

3.6 Cookies and local storage

We use only local storage essential to the service's operation, such as the authentication tokens that keep your session active. We do not use advertising or tracking cookies, and we do not share browsing data with ad networks.

4. How we use data and our legal bases

We use personal data to: operate the digital intercom and route calls; authenticate users and enforce access permissions; send invitations, notifications and operational communications; maintain audit and security logs; and diagnose and fix technical issues.

Depending on the case, processing relies on the performance of a contract or pre-contractual steps, our legitimate interest in keeping the service secure and functional, compliance with a legal or regulatory obligation, and, where applicable, your consent — for example, when you choose social login.

5. Sharing data with third parties

We do not sell personal data. We share data only with processors that help us provide the service, under contractual confidentiality and security obligations:

• ·GetStream — real-time video/voice calling and chat infrastructure;
• ·Amazon S3 — file storage, such as QR code images;
• ·Resend — transactional email delivery (invitations, password resets, notifications);
• ·Google and Apple — social sign-in, only when you choose that login method;
• ·Sentry — technical error monitoring for the application;
• ·Public authorities, when required by law, court order, or to protect rights, safety, or property.

6. International data transfers

Some of the processors listed above may process data outside your country of residence. In those cases, we use contractual safeguards intended to ensure an adequate level of protection for the transferred data.

7. Data retention

We keep account data while the account is active, plus any additional period needed to meet legal, contractual, or audit obligations. Call metadata and audit logs are kept for a limited period sufficient for security and dispute-resolution purposes, after which they are anonymized or deleted. Visitor QR session data is retained only for the duration of the session and a short period after it expires or is revoked.

8. Security

We apply technical and organizational controls to protect data, including per-organization data isolation (multi-tenant), token-based authentication (JWT), role- and permission-based access control, encryption in transit, and audit logging of actions taken in the admin panel.

9. Your rights

Depending on where you live, you may have rights to: confirm whether we process your data; access it; correct incomplete, inaccurate, or outdated data; request anonymization, blocking, or deletion of unnecessary data; request data portability; be informed about who we share your data with; and withdraw consent, where applicable. To exercise any of these rights, contact us at contact@nelum.pro. If you are a resident or visitor of a property, some requests may also need to be directed to the property's administrator, who also acts as a controller for certain data.

10. International use

Nelum may be used by properties and users outside Brazil. Regardless of where you access the service from, we process personal data based on the principles described in this policy. Where local law applicable to you grants additional rights, we will make reasonable efforts to honor them — contact us to raise a specific request.

11. Children's data

Nelum is not directed at individuals under 18, and we do not knowingly collect data from children. If we learn that a child's data was collected without appropriate authorization from a legal guardian, we will take steps to delete it.

12. Changes to this policy

We may update this policy periodically to reflect changes to the service or applicable law. The "last updated" date at the top of this page indicates the current version. Material changes will be communicated by email or an in-product notice.

13. Contact

For anything related to this policy or how we process your personal data, contact: contact@nelum.pro.