AGGLO PRIVACY POLICY

United States and Puerto Rico

Effective Date: October 9, 2026
Version: 1.1
Published at: agglo.cloud/us/privacy

1. INTRODUCTION AND SCOPE

1.1 Who We Are. This Privacy Policy is issued by Naydiris LLC, a Puerto Rico limited liability company with its principal place of business at 1654 Calle Tulipán, Ste 100, San Juan, PR 00927-6242, USA ("Naydiris," "we," "us," or "our"). Naydiris owns and operates the software platform marketed under the name Agglo, available at agglo.cloud and its subdomains (the "Platform"), together with the related websites, client portals, storefronts, communications and support (collectively, the "Services").

1.2 Purpose. This Privacy Policy describes the categories of Personal Information we collect, the sources from which we collect it, the purposes for which we use it, the categories of persons to whom we disclose it, the period for which we retain it, the measures by which we protect it, and the rights and choices available with respect to it.

1.3 Application. This Privacy Policy applies to Personal Information processed in connection with the Services by or on behalf of Naydiris in the United States, including the Commonwealth of Puerto Rico. A separate privacy notice, published at agglo.cloud/mx/privacy, governs Business Customers that have contracted for the Services under the Mexico version of our terms and the individuals whose data we process in connection with them.

1.4 Exclusions. This Privacy Policy does not govern the privacy practices of any Business Customer or of any third-party service that a Business Customer elects to connect to the Platform, each of which is governed by its own privacy notice and terms (see Sections 3 and 9).

2. DEFINITIONS

For purposes of this Privacy Policy, the following capitalized terms have the meanings set forth below:

(a) "Business Customer" means a business, organization or individual acting in a commercial capacity that has entered into an agreement with Naydiris for the use of the Services.

(b) "Authorized User" means an owner, employee or other individual authorized by a Business Customer to access the Business Customer's workspace on the Platform.

(c) "End Customer" means an individual who interacts with a Business Customer through the Platform, including a client, prospective client, purchaser or other contact of a Business Customer, a holder of an account in a Business Customer's client portal, and a visitor to a Business Customer's website or online storefront hosted on the Platform.

(d) "Customer Data" means all Personal Information and other data that a Business Customer, its Authorized Users or its End Customers submit to, store on, or generate through the Platform in connection with the Business Customer's use of the Services.

(e) "Personal Information" means information that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable individual.

(f) "Process" and "Processing" mean any operation or set of operations performed on Personal Information, whether or not by automated means, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, restriction, erasure or destruction.

(g) "Service Provider" means a person that Processes Personal Information on behalf of, and pursuant to the written instructions of, another person.

3. OUR ROLES

3.1 Naydiris as Controller. Naydiris determines the purposes and means of Processing, and is therefore responsible for, the Personal Information described in Section 4 (information concerning visitors to agglo.cloud, prospective customers, Business Customers and Authorized Users in their capacity as account holders).

3.2 Naydiris as Service Provider. With respect to Customer Data, Naydiris acts solely as a Service Provider to the relevant Business Customer. Each Business Customer determines the purposes and means of Processing its Customer Data, is responsible for its own compliance with applicable law, and is responsible for providing any notice and obtaining any consent required in respect of its End Customers. Naydiris Processes Customer Data only on the documented instructions of the Business Customer, as set forth in our Terms of Service and the Data Processing Agreement entered into with each Business Customer, and does not Process Customer Data for its own purposes.

3.3 Notice to End Customers. If you are an End Customer, Naydiris has no direct relationship with you. The Business Customer with which you interact is responsible for the handling of your Personal Information, and its privacy notice governs that handling. Each website hosted on the Platform displays a link to the privacy notice of the relevant Business Customer. Requests concerning your Personal Information should be addressed to that Business Customer. If you submit such a request to Naydiris, we will forward it to the relevant Business Customer and will assist the Business Customer in responding to it as described in Section 15.4.

4. PERSONAL INFORMATION WE COLLECT AS CONTROLLER

4.1 Enquiries and Prospective Customers. When you submit an enquiry through agglo.cloud, we collect your name, email address, telephone number, company name, the content of your message, and the date and time at which you accepted this Privacy Policy.

4.2 Business Customer Account Information. When a Business Customer is onboarded, we collect the business's name, address, telephone number, email address, preferred language, logo, brand colors and notification email address, and the name and contact details of its representatives.

4.3 Authorized User Account Information. For each Authorized User, we collect the individual's name, work email address, role, login identifier, authentication credentials (in hashed or otherwise protected form, managed by our authentication Service Provider), multi-factor authentication settings where enabled, language preference and notification preferences.

4.4 Commercial Information. We collect information relating to the commercial relationship between Naydiris and each Business Customer, including the written quotation and order documentation, the modules contracted, and records of payments made to Naydiris. Business Customers pay Naydiris by the method stated in their quotation. Where payment is made by card, the card details are entered directly into the payment form of the payment processor named in the quotation (such as Stripe, Inc. or PayPal, Inc.), which processes them under its own privacy policy; Naydiris does not receive or store card numbers.

4.5 Activity and Audit Information. We record an activity log of events within the Platform (for example, the sending of a quotation or the recording of a payment), together with the Authorized User who performed the action.

4.6 Technical Information. When you access the Services, our systems automatically record technical information, including Internet Protocol (IP) address, request paths (with long identifiers masked), error messages and timestamps. Email addresses are masked in our server logs. Except as described in Section 4.9, IP addresses are used transiently for rate limiting and security purposes. When you first visit agglo.cloud without a saved region preference, the approximate country associated with your IP address, as reported by our content-delivery network, is used to select the regional pages to display; it is not stored.

4.7 Region Preference. We record your selection of region (United States or Mexico) as described in Section 10.

4.8 Support Communications. When you communicate with us by email or telephone, we collect the content of the communication and your contact details.

4.9 Records of Acceptance of the Terms. When an administrator of a Business Customer accepts our Terms of Service on its behalf, we record, as evidence of the agreement, the version of the Terms accepted, the date and time, the administrator's account identifier and email address, the IP address from which the acceptance was made and the browser identification string. This is the one case in which we retain an IP address beyond transient use. These records are used only to establish and defend the existence and terms of the agreement, and are retained for the term of the agreement and thereafter as described in Sections 12.2(e) and 12.3.

4.10 Information We Do Not Collect. Naydiris does not collect payment card numbers. Payments made through the Platform are entered directly into the payment form of the Business Customer's own payment processor and are not received or stored by Naydiris.

5. CUSTOMER DATA WE PROCESS AS SERVICE PROVIDER

5.1 Categories. Depending on the modules a Business Customer uses and the information it elects to enter, Customer Data may include the following categories of Personal Information concerning End Customers and Authorized Users:

(a) identifiers and contact information (name, email address, telephone number, company and address);
(b) messages submitted through contact forms and quotation-request forms;
(c) client records maintained by the Business Customer, including notes, tags, custom fields and pipeline stage;
(d) commercial information, including quotations, invoices, orders, payment records (amount, date, method, reference and payment-processor identifiers, but not payment card numbers), refunds and receivables;
(e) project, milestone and task records concerning the End Customer;
(f) files uploaded by Authorized Users or by End Customers through a client portal;
(g) feedback responses, ratings, and the End Customer's election as to publication of a review;
(h) client-portal account information, including email address and login identifier;
(i) online-store order information, including the buyer's name, email address, telephone number, items purchased and totals;
(j) records of the date and time at which an individual accepted a privacy notice on a public form;
(k) appointment records maintained by a Business Customer in the Bookings module, including the End Customer's name, email address and telephone number, the service, date, time and provider booked, answers to intake questions the Business Customer chooses to ask, the End Customer's acknowledgement of the Business Customer's privacy notice, a deposit amount and its payment and refund status, internal staff notes, and a private link by which the End Customer may view, move or cancel the appointment; and
(l) staff records maintained by a Business Customer in the People module, including hourly cost and billable rates and time entries.

5.2 Use Limitation. Naydiris Processes Customer Data solely to provide, maintain, secure and support the Services for the relevant Business Customer, to comply with law, and as otherwise instructed by the Business Customer. Naydiris does not use Customer Data for advertising, does not sell or share Customer Data, and does not combine Customer Data of one Business Customer with that of another.

5.3 Access by Naydiris Personnel. Naydiris personnel access a Business Customer's workspace only when strictly necessary to provide support, troubleshoot, or correct a malfunction, in each case only with the prior permission of the Business Customer, and each such access is recorded. The only exceptions are access required by law and emergency access needed to prevent imminent harm to the Services, such as repairing an outage or a fault that is damaging data; in that case the access is limited to what is needed, is recorded, and the affected Business Customer is notified no later than seventy-two (72) hours afterwards.

6. SOURCES OF PERSONAL INFORMATION

We obtain Personal Information (a) directly from you; (b) from the Business Customer that employs or engages you or with which you interact; (c) automatically, from your device and browser, when you use the Services; and (d) from Service Providers acting on our behalf, such as our authentication and email-delivery providers.

7. PURPOSES OF PROCESSING

We Process the Personal Information described in Section 4 for the following purposes:

(a) to respond to enquiries and to prepare and deliver quotations;
(b) to establish, administer and support Business Customer accounts and Authorized User accounts, including authentication and account security;
(c) to provide, operate, maintain and improve the reliability of the Services;
(d) to send transactional and service communications, as described in Section 11;
(e) to administer our commercial relationship with Business Customers, including invoicing and collection of amounts owed to Naydiris;
(f) to detect, prevent and respond to security incidents, fraud, abuse and violations of our Terms of Service;
(g) to comply with applicable law, legal process and requests of governmental authorities, and to establish, exercise or defend legal claims; and
(h) to effect a merger, acquisition, financing, reorganization or sale of all or part of our business, subject to Section 8.4.

We do not use Personal Information for targeted advertising, do not engage in profiling that produces legal or similarly significant effects, and do not make decisions about individuals based solely on automated Processing.

8. DISCLOSURE OF PERSONAL INFORMATION

8.1 No Sale or Sharing. Naydiris does not sell Personal Information, does not share Personal Information for cross-context behavioral advertising, and does not disclose Personal Information to third parties for their own direct marketing purposes.

8.2 Service Providers. We disclose Personal Information to Service Providers that Process it on our behalf and under written obligations of confidentiality and use limitation, solely to enable them to perform services for us. As of the Effective Date, our Service Providers are:

8.3 Business Customers' Chosen Services. At a Business Customer's direction, Customer Data is transmitted to services that the Business Customer has elected to connect, including the Business Customer's own account with Stripe, Inc. or its affiliates for payment processing. Such services act under their own agreements with the Business Customer, and Naydiris is not responsible for their practices.

8.4 Corporate Transactions. We may disclose Personal Information to a prospective or actual acquirer, successor or assignee in connection with a merger, acquisition, financing, reorganization, bankruptcy, receivership or sale of all or part of our business, provided that the recipient is bound to Process such Personal Information consistently with this Privacy Policy.

8.5 Legal Requirements. We may disclose Personal Information where we determine in good faith that disclosure is required by law, subpoena, court order or other legal process, or is necessary to protect the rights, property or safety of Naydiris, our Business Customers or others. Where permitted by law, we will notify the affected Business Customer of any request for its Customer Data.

9. MESSAGING INTEGRATIONS (WHATSAPP BUSINESS PLATFORM)

9.1 Applicability. This Section 9 applies only if and when Naydiris makes available, and a Business Customer elects to connect, the Business Customer's WhatsApp Business account to the Platform. As of the Effective Date, this integration is not yet available. Until a Business Customer connects its WhatsApp Business account, no information is received from Meta Platforms, Inc. or its affiliates ("Meta") under this Section.

9.2 Information Received. Where a Business Customer connects its WhatsApp Business account, the Platform receives from Meta, directly or through our messaging Service Provider: (a) identifiers of the Business Customer's WhatsApp Business account, business portfolio and business phone number; (b) the display name and profile information associated with that account; (c) access credentials issued for the purpose of operating the connection; (d) the names, approval status and content of message templates; (e) the telephone numbers and WhatsApp profile names of individuals who exchange messages with the Business Customer; (f) the content of messages exchanged, including text and media; and (g) message metadata, including timestamps and delivery and read status.

9.3 Use. Naydiris Processes information received from Meta solely as a Service Provider to the relevant Business Customer and on its instructions, for the purpose of enabling the Business Customer to send and receive WhatsApp messages and to manage its WhatsApp message templates within the Platform. Naydiris does not use such information for any other purpose, does not sell, license or purchase it, does not use it to build or augment profiles of individuals, and does not use it for advertising.

9.4 Disclosure. Information received from Meta is disclosed only to the relevant Business Customer, to Meta, and to the following Service Providers acting on behalf of the Business Customer: Amazon Web Services, Inc. (hosting and storage) and the messaging Service Provider that transmits the messages, expected to be Twilio Inc., which Naydiris will confirm in this Section before the integration is made available. Meta and the messaging Service Provider Process such information in accordance with their own terms and privacy policies.

9.5 Retention and Deletion. Information received from Meta is retained for as long as the Business Customer maintains the WhatsApp connection or as otherwise instructed by the Business Customer, and is deleted (a) upon the Business Customer's disconnection of its WhatsApp Business account or termination of its agreement with Naydiris, in accordance with Section 12.3; (b) upon a verified request of the individual concerned, in coordination with the Business Customer; or (c) upon the request of Meta. The period for which the messaging Service Provider retains message records will be stated in this Section before the integration is made available. Instructions for requesting deletion are published at agglo.cloud/us/data-deletion.

10. COOKIES, LOCAL STORAGE AND EMBEDDED CONTENT

10.1 Cookies. Naydiris sets a single cookie, named eco_region, on the agglo.cloud domain. It records the visitor's choice of region (United States or Mexico) for the sole purpose of displaying the applicable regional pages, and it expires one (1) year after it is set. Naydiris does not use analytics, advertising or tracking cookies or similar technologies. Payment pages are an exception described in Section 10.3(c).

10.2 Browser Local Storage. The Services store the following information in the local storage of your browser, which remains on your device: sign-in session tokens; the contents of a shopping cart in a Business Customer's online store; display preferences; and, for Authorized Users of the website builder, a personal task checklist.

10.3 Embedded Third-Party Content. Websites, online stores and payment pages of Business Customers hosted on the Platform may include (a) maps provided by Google LLC, which load, and cause your browser to connect to Google, only after you click to display the map; (b) videos hosted by YouTube (through its privacy-enhanced youtube-nocookie.com domain) or Vimeo, Inc., which cause your browser to connect to the video host when the video loads or is played; (c) on checkout and invoice-payment pages, the payment form of Stripe, Inc., loaded from Stripe's servers, which may set its own cookies and collect device and browsing information for fraud prevention, in accordance with Stripe's privacy policy; and (d) photographs selected by the Business Customer from the Pexels image library, which are displayed from Pexels' own image servers and cause your browser to connect to Pexels when the page loads. Upon such connection, the relevant provider may receive your IP address and may set its own cookies, in accordance with its own privacy policy. All typefaces used by the Services are hosted by Naydiris, and no font service is contacted.

10.4 Do Not Track. Because Naydiris does not track visitors over time or across third-party websites, the Services do not respond differently to "Do Not Track" browser signals or similar mechanisms.

10.5 Third-Party Tracking. Other than as described in Section 10.3, Naydiris does not permit third parties to collect Personal Information about your online activities over time and across different websites when you use the Services.

11. ELECTRONIC COMMUNICATIONS

11.1 Transactional Communications Only. Naydiris sends only transactional and relationship communications. Naydiris does not send marketing or promotional email or newsletters, does not use purchased mailing lists, and does not permit Business Customers to send marketing email through the Platform.

11.2 Communications Sent on Behalf of Business Customers. The Platform sends, on behalf of and under the name of Business Customers, transactional emails such as quotations, invoices, payment receipts, order confirmations and shipping notices, overdue-payment reminders (no more than three (3) per invoice, sent at least seven (7) days apart), client-portal invitations and registration confirmations, password-reset messages and follow-up reminders. Certain of these messages are sent automatically, according to rules configured by the Business Customer, without individual review by an Authorized User.

11.3 Opting Out. Optional notifications include a one-click unsubscribe link and a link to a preferences page that does not require sign-in. Security-related messages, including password-reset and registration-confirmation messages, are necessary for the operation of an account and cannot be disabled.

12. DATA RETENTION

12.1 General Principle. We retain Personal Information only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, to comply with our legal obligations, to resolve disputes and to enforce our agreements.

12.2 Specific Periods.

(a) Enquiries. Enquiries submitted through agglo.cloud that do not result in a customer relationship or a quotation are deleted automatically twenty-four (24) months after submission.

(b) Business Customer and Authorized User Account Information. Retained for the duration of the Business Customer's agreement with Naydiris and thereafter for the period described in Section 12.3, except records that Naydiris is required by law to retain, which are retained for the period required by law.

(c) Server Logs. Retained for ninety (90) days, after which they are deleted automatically.

(d) Backups. Automated database backups are retained for seven (7) days, after which they expire.

(e) Records of Acceptance of the Terms. Retained for the term of the Business Customer's agreement and thereafter for the period described in Section 12.3, except that Naydiris may retain them for as long as needed to establish or defend a legal claim relating to the agreement.

12.3 Termination of a Business Customer's Agreement. Upon termination or expiration of a Business Customer's agreement, the Business Customer may export its Customer Data for thirty (30) days. Naydiris thereafter permanently deletes the Business Customer's Customer Data within ninety (90) days, except data that Naydiris is required by law to retain. Residual copies in backups expire within seven (7) days thereafter.

12.4 Deletion within the Platform. When a Business Customer deletes a record within the Platform, the record is permanently removed from the production database, and the only remaining copy expires with the backup cycle described in Section 12.2(d). Two exceptions apply: a note deleted on its own is hidden from view but retained, attached to its record, until that record is deleted; and invoices are voided rather than deleted, so that the Business Customer keeps a complete commercial record.

13. DATA SECURITY

13.1 Measures. Naydiris maintains administrative, technical and physical safeguards designed to protect Personal Information against unauthorized access, use, alteration, disclosure and destruction, appropriate to the nature of the information and the risks presented by its Processing. These safeguards include encryption of data in transit by means of Transport Layer Security; encryption at rest of the Platform's database and file storage; logical separation of each Business Customer's data enforced at the database level by row-level security; restriction of access to production systems to authorized personnel; encrypted storage of Business Customers' payment-processor credentials; optional multi-factor authentication for user accounts; and review of each release prior to deployment.

13.2 No Absolute Security. No method of transmission over the Internet or of electronic storage is completely secure. Naydiris therefore cannot guarantee the absolute security of Personal Information.

13.3 Account Credentials. Each Authorized User is responsible for safeguarding his or her credentials and for promptly notifying Naydiris at admin@agglo.cloud of any suspected unauthorized use of an account.

14. SECURITY INCIDENTS

14.1 Notification to Business Customers. If Naydiris becomes aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data, Naydiris shall notify the affected Business Customer without undue delay, and in any event within seventy-two (72) hours after becoming aware of the breach.

14.2 Notification Required by Law. Where Naydiris is itself required by law to notify individuals, governmental authorities or other persons of a security breach affecting Personal Information for which it acts as controller, Naydiris shall provide such notice in the manner and within the time required by applicable law, including, with respect to residents of Puerto Rico, the Citizen Information on Data Banks Security Act, Act No. 111 of September 7, 2005, as amended.

15. YOUR RIGHTS AND CHOICES

15.1 Requests Concerning Information We Control. If you are a prospective customer, a visitor to agglo.cloud, or an Authorized User, you may request access to, correction of, or deletion of the Personal Information that Naydiris holds about you as controller, and you may object to its Processing. Requests may be submitted by email to admin@agglo.cloud or by telephone at +1-787-431-3687. We will verify your identity by reasonable means before acting on a request, and will respond within forty-five (45) days of receipt, or within such shorter period as applicable law may require. We will not discriminate against you for exercising any of these rights.

15.2 Limits. We may decline or limit a request where the information is required to be retained by law, is necessary to establish, exercise or defend legal claims, or where fulfilling the request would adversely affect the rights of others, and we will inform you of the reason.

15.3 State-Specific Rights. Residents of certain states have statutory rights with respect to their Personal Information, which may include rights of access, correction, deletion and portability, and the right to opt out of the sale of Personal Information, targeted advertising and certain profiling. Naydiris does not engage in sales of Personal Information, targeted advertising or such profiling. To the extent any such statute applies to Naydiris, you may exercise the rights it confers by the means described in Section 15.1, and, where the statute provides for an appeal of a denied request, by replying to our decision with the word "Appeal."

15.4 End Customers. If you are an End Customer, please submit requests concerning your Personal Information to the Business Customer with which you interact. If Naydiris receives such a request, it will forward the request to the relevant Business Customer and will provide the Business Customer with the assistance and tools reasonably necessary to respond.

15.5 Nevada Residents. Naydiris does not sell covered information, as defined in Chapter 603A of the Nevada Revised Statutes. Nevada residents may nonetheless submit a request directing us not to sell covered information to our designated request address, admin@agglo.cloud.

15.6 Review and Correction. Authorized Users may review and update much of their account information directly within the Platform.

16. DELETION OF DATA RECEIVED THROUGH META PLATFORMS

Instructions for requesting the deletion of Personal Information received through Meta's platforms, including the status of a request and the grounds on which a request may be refused, are published at agglo.cloud/us/data-deletion.

17. CHILDREN

The Services are intended for use by businesses and are not directed to children under thirteen (13) years of age. Naydiris does not knowingly collect Personal Information from children under thirteen (13) years of age as controller. A Business Customer whose End Customers include minors is solely responsible for obtaining any parental or guardian consent required by applicable law. If you believe that we have collected Personal Information from a child under thirteen (13) years of age in our capacity as controller, please contact us at admin@agglo.cloud and we will delete it.

18. LOCATION OF PROCESSING

Personal Information processed in connection with the Services is stored in the United States, in the US East (Northern Virginia) region of Amazon Web Services. If you access the Services from outside the United States, your Personal Information will be transferred to, stored in and Processed in the United States, whose data-protection laws may differ from those of your jurisdiction.

19. CHANGES TO THIS PRIVACY POLICY

Naydiris may amend this Privacy Policy from time to time. The amended Privacy Policy shall bear a revised Effective Date and version number and shall be published at agglo.cloud/us/privacy. Where an amendment is material, Naydiris shall notify Business Customers by email to their designated notification address no less than thirty (30) days before the amendment takes effect, except where an earlier effective date is required by law. Prior versions are available upon request.

20. CONTACT

Questions, requests and complaints concerning this Privacy Policy or our Processing of Personal Information may be directed to:

Naydiris LLC
Attention: Rudy Alberto Rivera Soto, Privacy
1654 Calle Tulipán, Ste 100
San Juan, PR 00927-6242, USA
Email: admin@agglo.cloud
Telephone: +1-787-431-3687