Privacy Policy

1. Information We Collect

We may collect the following categories of information:

• Account & Identity Data: Name, email address, company name, and role when you register or contact us.
• Usage & Interaction Data: Prompts, queries, agent actions, session logs, and outputs generated through the platform.
• Technical Data: IP address, browser type, device identifiers, operating system, referral URLs, and access timestamps collected automatically via logs and cookies.
• Integration Credentials: OAuth tokens or API keys you provide to connect third-party services (stored encrypted; never read in plaintext by our staff).
• Communications: Emails, support tickets, and feedback you send to us.

2. How We Use Your Information

We use collected information to:

• Provide, operate, and improve the Service and its agentic capabilities.
• Authenticate users and secure access to accounts.
• Process and execute agent workflows on your behalf.
• Monitor platform performance, detect abuse, and ensure security.
• Communicate with you about updates, incidents, or support requests.
• Comply with applicable legal obligations.

We do not sell your personal data to third parties, and we do not use your data to train AI models without your explicit written consent.

3. Legal Bases for Processing (GDPR / Colombian Law 1581)

Where applicable, we process your personal data under the following legal bases:

• Performance of a contract: Processing necessary to deliver the Service you have requested.
• Legitimate interests: Security monitoring, fraud prevention, and service improvement.
• Consent: For optional features such as analytics or marketing communications, where we request your explicit consent.
• Legal obligation: Where we are required to process data by law.

4. Sharing of Information

We may share your information with:

• Service providers: Cloud hosting, database, and infrastructure vendors operating under strict data processing agreements (e.g., AWS, Google Cloud).
• AI model providers: Third-party AI APIs (such as Anthropic) that process inputs on behalf of the Service. These providers operate under their own privacy policies and do not retain your data for model training without consent.
• Legal authorities: When required by valid legal process, court order, or to protect the rights and safety of users or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction with appropriate notice.

We do not share personal data with advertisers or data brokers.

5. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. Interaction logs and agent session data are retained for a maximum of 12 months unless a shorter period is requested by you or required by law. After account deletion or a verified data deletion request, your personal data is permanently removed within 30 days, except where retention is required by applicable law.

6. Cookies & Tracking Technologies

We use essential cookies required for authentication and session management. We may use analytics cookies (with your consent) to understand how users interact with the Service. You can manage cookie preferences through your browser settings or our in-platform consent banner.

7. Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, access controls, and regular security reviews. No system is completely secure; we encourage you to use strong, unique passwords and to report any suspected security issues to [email protected].

8. International Data Transfers

Asisteme AI operates across Colombia and the United States. Your data may be transferred to and processed in servers located in either jurisdiction. For users in the European Economic Area, such transfers are subject to appropriate safeguards (Standard Contractual Clauses or equivalent mechanisms).

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data (see our Data Deletion page).
• Restrict or object to certain processing activities.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

10. Children's Privacy

The Service is intended for business users and is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or an in-platform notice at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.