Privacy Policy

1. Data controller

This Privacy Policy describes how The NMD SpA, Chilean tax ID (RUT) 78.129.741-0 (hereinafter, "The NMD Studio", "we", or "the company"), collects, uses, stores, and protects the personal data of those who use nomad os (hereinafter, "the Platform" or "the Service"), the agency-management application available at app.thenmdstudio.com.

For any question about this policy or the handling of your data, you can reach us at emilia@thenmdstudio.com.

2. Who this policy applies to

This policy applies to two types of Platform users:

• Team accounts: people who work at The NMD Studio and use the Platform to manage the agency's work.
• Client accounts (portal): people from The NMD Studio's client brands who are given access to a limited view of their own information (content, reports, meetings).

3. Data we collect

3.1 Account data. First name, last name, email address, and password (stored encrypted, never in plain text) so you can sign in.

3.2 Data from connected platforms (only if you choose to connect them). When a user voluntarily authorizes the connection of an external account, we only access the data necessary for the function that connection enables:

• Google Calendar: your calendar's events, times, and guests, so we can show and create meetings/blocks from the Platform. The connection is individual — each person connects their own Google account, it is never shared with the rest of the team.
• Meta (Facebook) Marketing API: performance data from advertising campaigns (spend, results, metrics) for the ad accounts the user chooses to connect, to generate reports.
• Instagram (API with Instagram Login): basic data from the connected professional profile (username, follower count, media count), reach/engagement statistics, and the ability to publish content (photos and videos) on that account's behalf, always by the user's explicit action.

We do not access private messages, comments, or any other information from these platforms beyond what is strictly necessary for the functions described above.

3.3 Content you upload to the Platform. Photos and videos for the content calendar, meeting summaries and action items, comments, client onboarding documents, and profile/banner photos.

4. What we use your data for

• To provide the Service: authenticate you, display your information and your team's/clients', and carry out the functions you request (publishing content, syncing a calendar, generating a report).
• To send you notifications within the Platform (mentions, assigned tasks, new comments) and operational transactional emails (for example, to reset your password).
• To keep accounts secure and prevent unauthorized access.
• To comply with legal obligations where applicable.

We do not use your data for advertising purposes, we do not sell it, and we do not share it with third parties for marketing purposes.

5. Who we share data with

We use external providers to operate the Platform, who process data on our behalf under their own security policies:

• Supabase — database and authentication.
• Vercel — application hosting.
• Brevo — sending transactional emails (e.g. password recovery).
• Google, Meta, and Instagram — only when you choose to connect those accounts, and only for the functions you explicitly authorize.

None of these providers is authorized to use your data for purposes other than providing the service we've contracted them for.

6. International data transfers

Some of our providers (Supabase, Vercel, Brevo, and the Google/Meta platforms) process information on servers located outside of Chile. By using the Platform, you consent to this transfer, which is carried out solely to provide the Service and under each provider's security standards.

7. Data retention

We retain your data while your account is active. If you request that your account be deleted, we delete or anonymize your personal data within a reasonable timeframe, unless we must retain certain information for a legal obligation.

8. Security

We apply reasonable technical and organizational measures to protect your data: encrypted passwords, third-party account access tokens encrypted in the database, encrypted connections (HTTPS), and role-based access control (a client account can never see information belonging to other clients or to the internal team). No system is 100% foolproof, and we actively work to maintain these standards.

9. Your rights

Under Chile's Law No. 19,628 on the Protection of Private Life, and in line with the standards introduced by the new Law No. 21,719 (which modernizes personal data protection in Chile), you have the right to:

• Access: know what data of yours we hold.
• Rectification: correct inaccurate or outdated data.
• Cancellation/Deletion: request that we delete your data.
• Objection: object to a specific use of your data.
• Portability: request a copy of your data in a usable format.
• Revoke access to any connected external account (Google, Meta, Instagram) at any time, from the Platform's Settings section or directly from that external platform.

To exercise any of these rights, write to us at emilia@thenmdstudio.com.

10. Cookies and session

We only use cookies that are strictly necessary to keep you securely signed in. We do not use advertising cookies or third-party tracking cookies.

11. Minors

The Platform is intended for professional/business use and is not directed at anyone under 18 years of age. We do not knowingly collect data from minors.

12. Changes to this policy

We may update this policy from time to time to reflect changes to the Platform or to applicable regulations. We will indicate the date of the last update at the top of this document.

13. Contact

The NMD SpA — RUT 78.129.741-0
Email: emilia@thenmdstudio.com