Privacy Policy
Version 2026-11 · November 1, 2026
1. Who is responsible
The controller of your data is Nexu HR Inc., a corporation incorporated in the State of Delaware, United States (3 Germay Dr, Unit 4 #3278, Wilmington, DE 19804, USA). Privacy contact: privacy@nexuhr.com.
We comply with Colombia’s Law 1581 of 2012, the European Union’s General Data Protection Regulation (GDPR) where it applies, and U.S. state privacy laws (section 11).
2. What data we process
Account data: name, email and language. Trip data: itinerary, bookings, documents you upload, expenses and lists. Technical data: phone model, app version and errors.
We don’t store passports or ID document numbers. Medical info is optional (section 6). We don’t store your location on our servers.
3. What we use it for
To organize your trip and share it with the people in your group, send you alerts, provide support, charge for paid plans and keep the service secure.
We don’t sell your data or share it for targeted advertising.
4. Legal basis
In Colombia, we process your data with your prior, express and informed authorization (Law 1581 of 2012 and Decree 1377 of 2013). Under the GDPR, the bases are the contract to provide the service, your consent for AI, medical info and analytics, and legitimate interest for security and abuse prevention.
You can withdraw a consent at any time in Settings › Privacy and consent.
5. Artificial intelligence (Google Gemini)
If you agree, the documents you choose to read with AI are sent to Google (Gemini API, paid tier) to extract the booking details. Google does not use them to train its models. Files and drafts are deleted after 30 days or once you confirm them.
We never send your medical info to AI. Without your permission, everything can be done manually.
6. Health data (medical info)
Medical info is optional and is only stored with your explicit consent. It is encrypted on your phone before it leaves (end-to-end encryption): not even we can read it. Only the members of your trip see it, for example in SOS.
Leaving it empty doesn’t limit the service. It is deleted when you leave the trip or delete your account.
7. Analytics, errors and other providers
In the app, we use PostHog for usage analytics, without your name or email, and you can turn it off in Settings. We use Sentry to detect errors, without personal data or content.
Other processors that help us provide the service include Supabase and PowerSync (servers in the EU), Expo (notifications), Resend (email), Vercel (website), Apple and Google. Each has a data processing agreement. The full list is at https://tedolo.com/legal/subprocessors.
8. International transfers
Nexu HR Inc. is based in the United States, and some providers process data outside your country. The app’s main servers are in the European Union (Frankfurt).
When data leaves Colombia or the EU, we use recognized safeguards: countries with an adequate level of protection according to the Superintendence of Industry and Commerce, the EU-U.S. Data Privacy Framework or standard contractual clauses.
9. How long we keep it
We keep your data while your account is active. If you delete it, the data is erased or anonymized within 30 days at most; backups are replaced every 7 days.
Your expenses in other people’s trips stay under “Former member,” without your name, so the group’s balances still add up.
10. Minors
Accounts are for people 18 and older. The app is not directed at children under 13, and we do not knowingly collect their data.
An adult can add a minor to a trip as a member without an account, with the authorization of the minor’s legal guardian. If you believe we hold a minor’s data without that authorization, write to us and we will delete it.
11. If you live in the United States
Under California privacy laws (CCPA/CPRA) and those of other states, you can ask to know what data we hold, get a copy, correct it or delete it, and not be discriminated against for exercising those rights.
We don’t sell your personal data or share it for cross-context behavioral advertising, and we don’t use sensitive data to infer characteristics about you. An authorized agent can make the request on your behalf; we will verify your identity through your account.
12. Your rights and how to contact us
You can access, update, correct and delete your data, revoke your authorization, object to processing and take a copy (Habeas Data and GDPR: access, portability and erasure). In the app: Settings › Export my data and Delete my account; without the app, at https://tedolo.com/delete-account.
Write to us at privacy@nexuhr.com. We answer queries within 10 business days at most and complaints within 15 (one month under the GDPR; 45 days under California law). You can also go to Colombia’s Superintendence of Industry and Commerce (SIC) or your data protection authority in the EU.
13. Website, cookies and changes
Our website only stores one cookie with your language. We measure visits without cookies or personal identifiers, which is why we don’t show you a cookie banner.
If we change this policy, we will publish the new version here with its date and, if the change is significant, we will let you know in the app before it takes effect.