Privacy Policy

Nirko is an AI-powered sales operations platform for vehicle dealerships. This Policy explains how we process personal data under Brazil's General Data Protection Law (Law No. 13,709/2018 — LGPD) and, when another mandatory data-protection rule applies to a specific processing activity, the rights and safeguards required by that law.

For website visitors, sales contacts, platform users, security, and service administration, Nirko acts as controller when it determines the essential purposes and means of processing. For lead and customer data uploaded or integrated by a dealership customer, the dealership is generally the controller and Nirko acts as processor/operator under the customer's contract and instructions.

• Platform account data, such as name, email, company, store, and role.
• Dealership lead and customer data, such as name, phone, email, vehicle interest, conversation history, and information needed for the sales journey.
• Messages and interactions processed through the platform, including AI-assisted interactions.
• Data submitted through website forms, including demo, sales-contact, and privacy-rights requests.
• Technical and security data, such as access logs, IP address, browser identifiers, audit events, and information needed to prevent abuse or fraud.
• When authorized, optional analytics and campaign data from measurement and marketing tools.

The applicable legal basis depends on context. Processing may rely on consent, performance of a contract or pre-contractual procedures, compliance with legal or regulatory obligations, exercise of legal rights, and legitimate interests, as permitted by the LGPD and any other law that applies to the specific activity.

• Operate accounts, authentication, permissions, integrations, and contracted features.
• Qualify and organize leads, support customer engagement, and record the sales funnel.
• Prevent abuse, fraud, unauthorized access, and security incidents.
• Respond to sales, support, and data-subject requests.
• Comply with legal, regulatory, contractual, and rights-protection obligations.
• Measure audience and campaigns only after the visitor authorizes the relevant optional category.

On the public website, optional analytics and marketing technologies are disabled by default. On a first visit, you can accept all, reject optional technologies, or choose categories separately. Rejecting optional technologies does not block access to essential public website content.

• Necessary: technical resources required for core functionality, security, and storage of privacy preferences.
• Analytics: Google Analytics 4, loaded only after Analytics consent.
• Marketing: Google Tag Manager and Meta Pixel for campaign measurement and marketing events, loaded only after Marketing consent.

Your choice is stored in your browser with its date, authorized categories and policy version for up to 180 days. After that period, or after a material policy change, the website asks again. You can withdraw or change your choice free of charge at any time through the control below or the “Cookie preferences” link in the footer.

Data may be processed by providers required to operate Nirko, including hosting, database, authentication, artificial intelligence, messaging, customer engagement, analytics, and marketing services. Current providers may include Vercel, Supabase, Anthropic, Meta, and Google, depending on the feature used and applicable consent.

Some providers may process data outside Brazil. Where an international transfer occurs, Nirko applies the contractual, technical, and organizational safeguards required by the law applicable to that processing. Where the GDPR applies, this includes using the legally required transfer mechanism for the relevant operation. We do not sell personal data to third parties.

We keep personal data only for as long as necessary for the purposes described, performance of the contract, dealership-controller instructions, exercise of rights, and legal or regulatory duties. After that, data is deleted, anonymized, or retained only where a legal basis permits continued storage. Website cookie preferences are renewed no later than every 180 days.

Under the LGPD, you may request, as applicable:

• Confirmation of processing and access to your data.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliantly processed data.
• Portability where applicable and subject to applicable regulation.
• Information about data sharing and about the possibility of refusing consent.
• Deletion of consent-based data, subject to lawful retention exceptions.
• Withdrawal of consent through a free and easy procedure.
• Objection to processing in the circumstances provided by law.

Where the GDPR applies, you may also have rights including restriction of processing, data portability, objection, withdrawal of consent, and the right to lodge a complaint with the competent data-protection authority, subject to the applicable legal requirements.

To exercise your rights, use the form below or email info@nirko.com.br. We may request information strictly necessary to verify identity and protect the data subject's information.

Nirko uses artificial intelligence to support customer engagement, classification, qualification, and opportunity management. Where processing is based solely on automated decisions that materially affect a data subject's interests, the information and review rights required by applicable law are observed. The dealership remains responsible for final commercial decisions in its operation.

We use technical and organizational measures designed to reduce the risk of unauthorized access, loss, alteration, disclosure, or improper processing, including access controls, tenant isolation, audit logging, secret protection, and abuse-prevention mechanisms. No digital environment is entirely risk-free; relevant incidents are handled in accordance with applicable legal obligations.

Nirko's privacy contact is info@nirko.com.br. Requests concerning a dealership's lead data may require participation by that dealership because it is generally the controller of those data.

We may update this Policy to reflect changes in the product, providers, processing practices, or legal requirements. Material changes will be highlighted and, where a new authorization is required, consent will be requested again.