Privacy Policy

This Privacy Policy ("Policy") applies to:

• Customers and their personnel who use our services
• Individuals whose personal data we process in the course of delivering services to our customers, to the extent we act as a service provider or processor on their behalf

This Policy does not apply to third party websites, services, or platforms that we do not control, even if they are linked from our website or used in our integrations.

Controller. For most activities described in this Policy, Nuko Nova Dynamics LLC (doing business as Miami Web AI) is the controller of your personal information. When we process personal information on behalf of a customer in connection with services we provide, the customer is the controller and we act as a service provider or processor.

If you have questions about this Policy, see the Contact us section below.

The information we collect depends on how you interact with us. We may collect the following categories of information.

We use personal information for the following purposes:

To provide and operate our services

• Delivering projects, automations, and implementations
• Managing user accounts and access
• Setting up, configuring, and maintaining integrations

To process financial data

• Enabling secure financial account linking via regulated third-party aggregation providers
• Verifying account ownership and availability of funds
• Displaying account information, balances, and transaction history in customer dashboards
• Categorizing transactions to support budgeting, analytics, and cash flow tools
• Supporting payment processing and account verification, strictly in accordance with your explicit consent and the scope of services you have requested

To communicate with you

• Responding to inquiries and support requests
• Sending service related messages and updates
• Scheduling and conducting calls or meetings

To manage our business relationship

• Preparing and administering Contracts and statements of work
• Processing payments, invoicing, and accounting
• Collecting amounts owed and addressing disputes

To improve and develop our services

• Analyzing how our website and services are used
• Testing and improving user experience, workflows, and performance
• Developing new offerings and features

For security and fraud prevention

• Protecting the integrity and security of our systems and services
• Detecting, investigating, and preventing fraud or abuse

For legal and compliance purposes

• Complying with legal obligations and regulatory requirements
• Enforcing our Terms of Service and Contracts
• Protecting our rights, property, and the safety of us and others

For marketing and business development

• Sending you information about services, features, or content we think may interest you
• Running campaigns, events, or webinars
• Managing your communication preferences and consent where required

We do not sell personal information.

If you are located in the European Economic Area, the United Kingdom, or a similar jurisdiction that requires a legal basis for processing, we process your personal information on one or more of the following bases:

• Contract: To enter into and perform our Contract with you or the organization you represent.
• Legitimate interests: To operate and improve our services, communicate with you about our offerings, maintain security, and prevent fraud, where these interests are not overridden by your rights and interests.
• Consent: Where required by law, for example for certain marketing activities or non essential cookies. You can withdraw consent at any time.
• Legal obligation: To comply with laws, regulations, or court orders.

We use only essential cookies and storage mechanisms necessary to operate our website and remember your preferences. We do not currently use non-essential cookies for analytics, advertising, or tracking.

You can control cookies at the browser level by adjusting your settings to refuse or delete cookies. If you disable essential cookies, some website features may not function properly.

If we add any non-essential cookies in the future, we will update this table and, where required by law, present a cookie banner to obtain your consent.

We may share personal information with the following categories of recipients, as necessary for the purposes described above:

Service providers and vendors

Companies that help us operate our business and deliver services, such as:

• Hosting and infrastructure providers
• Email and communication tools
• Payment processors (for example Stripe)
• Analytics and monitoring services
• Project management and CRM platforms

Subcontractors and collaborators

Independent contractors and partner firms who help us deliver specific projects or services, under appropriate confidentiality obligations.

Professional advisors

Lawyers, accountants, auditors, and other professional advisors, where necessary for the services they provide to us.

Business transfers

In connection with a merger, acquisition, financing, sale of assets, or similar transaction involving our business. In such cases, personal information may be transferred as part of the transaction, subject to appropriate safeguards.

Legal and safety reasons

When we believe in good faith that disclosure is necessary to:

• Comply with a law, regulation, or legal request
• Protect the rights, property, or safety of Miami Web AI, our customers, or others
• Detect or address fraud, security, or technical issues

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We do not sell personal information, and we do not share it with third parties for their own independent marketing purposes.

When we share personal information with service providers, we require them to use it only for the purposes we specify and to protect it appropriately.

We retain personal information only as long as needed to fulfill the purposes described in this Policy. Specific retention periods vary by data category:

When personal information is no longer needed for these purposes, we delete it or take steps to anonymize it, unless we are required by law to keep it longer.

Users may request earlier deletion of their personal information, subject to our legal, tax, accounting, and security retention obligations. See §10 (Your Rights and Choices) for the request process.

If we process personal information on behalf of a customer, we retain and delete that information in accordance with our Contract with the customer.

We implement technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. These measures include:

• TLS 1.2 or higher encryption for all data in transit
• AES-256 encryption at rest for all customer data, via Convex and Vercel managed encryption
• Multi-factor authentication on all internal administrative systems
• Principle of least privilege for staff and contractor access to customer data
• Hosting on SOC 2 Type II certified infrastructure (Vercel, Convex); note that Miami Web AI is not independently SOC 2 certified
• Regular review of dependencies, security practices, and access controls

For a detailed description of our security posture, see our Security page.

However, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security.

You are responsible for maintaining the security of your own systems and credentials, and for promptly notifying us if you suspect any unauthorized access to accounts related to our services.

In the event of a data breach affecting your personal information, we will notify you and any required regulatory authorities in accordance with applicable law, typically within 72 hours of becoming aware of the breach.

The notification will describe, to the extent we are permitted to disclose:

• The nature and scope of the incident
• The categories of personal information affected
• The steps we have taken to contain and remediate the incident
• Recommended actions you can take to protect yourself
• Our contact information for further questions

This notification obligation does not apply to information that has been encrypted or otherwise rendered unreadable in a manner that provides equivalent protection, where the encryption key or other access mechanism was not compromised.

We are based in the United States and use service providers that may process information in the United States and other countries.

If you are located outside the United States, your information may be transferred to and processed in a country that may not provide the same level of data protection as your home jurisdiction.

Where required by law, we implement appropriate safeguards for such transfers, such as standard contractual clauses or equivalent measures.

Your rights may depend on where you live and how you interact with us. Subject to applicable law, you may have the right to:

• Access personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information
• Object to or request restriction of certain processing
• Withdraw consent where processing is based on your consent
• Receive a copy of your personal information in a portable format where technically feasible (data portability)

You can exercise these rights by contacting us using the details in the Contact us section. We may need to verify your identity before fulfilling your request.

If we process personal information on behalf of a customer, we may redirect your request to that customer where appropriate, since they are the controller of that data.

You also have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal information violates applicable law. We encourage you to contact us first so we can try to resolve your concerns.

This section provides additional disclosures and rights for residents of US states with comprehensive privacy laws. These rights are provided to the extent required by applicable law and, where not currently required, as a matter of policy.

Our website and services are designed for business and professional use and are not directed to children.

We do not knowingly collect personal information from children under the age of 16. If we become aware that we have collected personal information from a child under 16 without appropriate consent, we will take steps to delete it.

If you believe a child has provided personal information to us, please contact us.

Our website and services may contain links to third party websites, applications, or services. We are not responsible for the privacy practices of those third parties.

We encourage you to review the privacy policies of any third party sites or services you use.

We engage the following categories of service providers to help us deliver our services. Each provider processes personal information only for the purposes specified, subject to appropriate confidentiality and security obligations.

This list may change as our infrastructure evolves. Material changes will be reflected in an updated version of this Policy with a new "Last updated" date. A dated changelog is available upon request to privacy@miamiweb.ai.

We may update this Privacy Policy from time to time.

When we make changes, we will revise the "Last updated" date at the top of the Policy. If changes are material, we may also provide additional notice, such as by email or through our website, where appropriate.

Your continued use of our website or services after an updated Policy becomes effective means you acknowledge the changes.

If you have any questions or requests regarding this Privacy Policy or our handling of personal information, contact us at: