Privacy Policy

1. Who is responsible

The data controller for the data described in this policy is Sufam SpA (trade name: Sumetis), Chilean tax ID (RUT) 78.102.344-2, with its address at Serrano #125, Limache, Valparaíso 2240120, Chile. It operates the SuChatBot service.

You can contact us at contacto@suchatbot.com.

2. Our roles: controller and processor

We handle data in two different roles:

• Data of the business customer's account (who signs up for SuChatBot, their team and the connection to Meta): Sufam SpA is the controller.
• Data of the business's end customers (the people who message the business's WhatsApp number): Sufam SpA acts as a processor on behalf of the business, which decides how that data is used. We process that data only on the business's instructions and to provide it with the service.

3. What data we process

Data we receive from Meta through the WhatsApp API

• Phone numbers of the people who message the business.
• WhatsApp profile names.
• Message content and attachments (for example, images, audio, documents).
• Message delivery statuses (sent, delivered, read, failed).
• Identifiers of the WhatsApp Business Account (WABA) and of the business's phone number.
• The business's message templates and their approval status.
• The Meta user identifier of the person who authorizes the connection.

Business account data

• Business name, contact email and details of the team members who access the inbox.
• Technical credentials for the connection with Meta (access tokens), which we store encrypted.

Technical data

Technical operation and security logs from our servers (for example, IP addresses and access times).

4. Why we use the data

We use the data only to provide the service: receive, display and send the business's messages, manage its contacts and message templates, maintain the connection with Meta, provide support and protect the security of the service.

AI assistant. If the business turns on the assistant, conversation content and the information the business provides about itself are sent to an artificial intelligence model provider solely to generate replies to its customers. The business can turn it off or hand a conversation to a person at any time.

5. Who we share data with (providers)

Only the following providers have access to data, for the function indicated:

• Meta Platforms, Inc. / Meta Platforms Ireland Ltd.WhatsApp Cloud API: message transport and template management. Country: United States / Ireland.
• Hostinger International Ltd.Server where the gateway and each business's inbox run. Server located in the United States.
• Vercel Inc.Hosting of this public website, which contains no WhatsApp data. Country: United States.
• Cloudflare, Inc.Domain DNS and email forwarding. Country: United States.
• Google LLCReceipt of the contact email. Country: United States.

If we add a new provider (for example, an artificial intelligence provider), we will update this policy before using it.

Apart from these providers, we will only disclose data if a competent authority requires it under the law.

6. International data transfers

Data is processed on servers located outside Chile, mainly in the United States, and on Meta's infrastructure in the United States and Ireland. By using the service, the business and its users accept this transfer, which is necessary for the service to work.

7. Security

• All traffic is encrypted with TLS.
• Access tokens are stored encrypted at rest with AES-256-GCM.
• Each business has its own instance, separate from the others.
• Access to systems is restricted to the people who need it.
• Administrative accounts use two-factor authentication.

No system is infallible; if we detect an incident affecting your data, we will notify you as required by law.

8. How long we keep data

• Messages and contacts: kept while the business has the service active. After the service ends, they are deleted within 30 days, unless a legal obligation requires keeping them.
• Access tokens: deleted when the business disconnects its account.

9. Your rights

Under Chilean Law No. 19.628 on the protection of private life and its amendments, you may exercise the rights of access, rectification, cancellation (erasure), objection and portability over your personal data.

To exercise them, write to contacto@suchatbot.com stating which right you wish to exercise and how to identify you (for example, the phone number or account concerned). We will reply within 15 business days.

If you are an end customer of a business that uses SuChatBot (that is, you messaged it on WhatsApp), you can make the request directly to the business or to SuChatBot; if you write to us, we will handle it together with the responsible business where appropriate.

10. Data deletion

You can ask us to delete your data at any time. Instructions are on the data deletion page.

11. Cookies and this website

This public website does not use tracking or analytics cookies, includes no tracking pixels and loads no third-party fonts or scripts.

Like any web hosting service, the site's provider (Vercel) may log technical data about visits, such as the IP address, for operation and security purposes. If you email us, your message reaches our mailbox through Cloudflare and Google, and we use it only to reply to you.

Each business's inbox is a separate service from this public website; it may use strictly necessary technical cookies to keep you signed in.

12. How to report a vulnerability

If you found a security issue in SuChatBot, write to contacto@suchatbot.com with the subject "Seguridad" (Security). Describe what you found and how to reproduce it. Please do not access third-party data or disclose the issue before we have had a chance to fix it.

13. Changes to this policy

If we change this policy in a material way (for example, by adding a new provider), we will publish the updated version on this page with its new effective date before the change applies.

14. Contact

Sufam SpA · Tax ID (RUT) 78.102.344-2 · Serrano #125, Limache, Valparaíso 2240120, Chile · contacto@suchatbot.com