Privacy policy

1. Who is the controller

Guillermo Rogel Mora, RUC tax ID 0106693088001, who operates AndesIA, with offices at IMPAQTO, Edificio IQON, 1st floor, Av. de los Shyris y Suecia, Quito 170506, Ecuador. Contact for anything related to your data: [email protected].

2. Data we handle

Depending on how you interact with AndesIA, we may handle:

• Website forms: name, email, company, WhatsApp number, business type and the message you send us.
• Platform customers: account data, data about the customer's team users, and billing data.
• Conversations processed on behalf of a customer: the sender's phone number and profile name, message content (text, voice notes and images), payment receipts the person sends, and appointment or reservation data.
• Minimal technical data needed to run and protect the service, such as access logs.

3. Data processed on behalf of our customers

When someone writes to a business that uses AndesIA, the data belongs to that business: the business is the controller and AndesIA acts as processor, only to provide the service and following its instructions. We don't use those conversations for anything else and we don't sell them.

If the business handles sensitive data, for example health data in a clinic, we sign a data processing agreement with it before activating the assistant.

If you wrote to a business that uses AndesIA and want to exercise your rights, please contact that business first. We will help if you write to us.

Each business's data is isolated from every other customer on the platform.

4. What we use data for

• Responding to access requests and contact messages. Legal basis: your consent and pre-contractual steps you request.
• Providing the service: receiving and replying to messages, booking appointments, managing reservations and showing conversations to the customer's team. Legal basis: performance of the contract.
• Generating automatic replies with artificial intelligence models, based on the information each business sets up.
• Billing, support and keeping the service secure. Legal basis: the contract, our tax obligations and our legitimate interest in protecting the service.

5. Artificial intelligence

Conversation content is sent to OpenAI, our AI model provider, to generate the assistant's replies. We don't use identifiable conversations to train third-party models.

AI-generated replies may contain errors. Each business can take over any conversation and pause the assistant in it.

6. Who we share data with

We don't sell or rent data. We only share it with providers needed to operate, who process it on our behalf under equivalent data protection obligations:

• Meta Platforms, through the WhatsApp Business Platform, to send and receive messages.
• OpenAI, as our artificial intelligence model provider, to generate the assistant's replies.
• Supabase, as the database for conversations and appointments.
• Google (Calendar and Sheets), for the calendar and the prices and inventory panel, if the business uses them.
• Cloudflare and our web server provider, to serve this website and the platform.
• PagoPlux, to process card payments.

7. Data location and international transfers

Several of these providers have servers outside Ecuador, mainly in the United States. We choose providers that offer adequate safeguards, such as data protection contractual clauses.

8. How long we keep data

• Requests and messages that don't lead to a contract: up to 12 months.
• Customer data: for as long as the service lasts and then for as long as Ecuadorian tax rules require for sales receipts.
• Platform conversations: as agreed with each business, and never after the service ends unless the business asks. If a service is not renewed, data is kept for 30 days before it is permanently deleted.
• When the service ends, the business can ask for its data back in a standard format (CSV or JSON) or for its deletion, within 30 days.

9. Security

We apply technical and organizational measures: data isolation per customer, encryption in transit (HTTPS/TLS), individual accounts with access control, access logging and backups. Only the people who work on each business's account have access, under a confidentiality obligation. If a breach affected data, we would notify the affected business without delay and within 48 hours at the latest, and the authority as the law requires.

10. Your rights

You can request access, rectification and update, erasure, objection, portability, restriction of processing, and not to be subject to decisions based solely on automated processing, and you can withdraw your consent. Email [email protected] with the subject "Personal data": we reply within 15 days at most. If you are not satisfied, you can file a complaint with Ecuador's Superintendency of Personal Data Protection.

11. How to delete your data

If you connected your business's WhatsApp Business or your Facebook account to AndesIA with Meta login, or gave us your data any other way, you can ask us to delete it:

• To delete everything: email [email protected] with the subject "Delete my data", from the email you signed up with, and include the business name or WhatsApp number.
• To remove access only: in Facebook, go to Settings > Business integrations and remove the integration you used for AndesIA; in Meta's WhatsApp Manager, remove its access to your account.
• Within 15 days at most we delete access permissions to your WhatsApp account, your assistant's configuration and stored conversations, and confirm by email. We only keep the sales receipts required by tax law.

12. Cookies and analytics

This website does not use tracking or advertising cookies. We measure visits with Cloudflare Web Analytics, which sets no cookies and only provides aggregate figures.

13. Minors

AndesIA is a service for businesses and is not directed at minors.

14. Changes

We may update this policy. We will publish the current version on this page with its update date and notify customers of relevant changes.