Assistant AI Privacy Policy
This is the English version of the Assistant AI Privacy Policy. If there is any discrepancy, the Spanish version prevails.
This policy explains how Cumbre Dev handles personal information in Assistant AI, an AI-powered WhatsApp bot system for businesses. Questions: cumbredev@gmail.com.
1. Who we are and how to contact us
Assistant AI is developed and operated by Cumbre Dev (cumbredev.com.ar), a software development studio based in Mendoza, Argentina. Owner: Ramiro Hugas, tax ID (CUIT) 20-44537970-1, address Mendoza, Argentina.
Cumbre Dev is a Meta Tech Provider. It offers Assistant AI to businesses ("business customers"), which connect their WhatsApp Business number to our system. Our role depends on the data:
- Data of people who message a business customer on WhatsApp ("end users"): we process it on behalf of and under the instructions of that business, which is the controller of that data. If you are an end user, the business you messaged is your first point of contact; you can also write to us and we will forward your request.
- Business customers' account data (for example name, email, WhatsApp identifiers and settings): Cumbre Dev is the controller.
Privacy contact: cumbredev@gmail.com.
2. What information we collect
| Category | Data | Source |
|---|---|---|
| Business customer | Business name, email address, WhatsApp Business Account ID (WABA), phone number ID, access tokens (stored encrypted) and bot settings. | The business, when signing up and configuring the service, and Meta, during Embedded Signup. |
| End users who message via WhatsApp | Phone number, WhatsApp profile name, message content (text and files), date and time, message identifiers and delivery status. | Meta (WhatsApp Business Platform), when the end user messages the business customer's number or receives a message from it. |
| Coexistence with the WhatsApp Business app | App contacts and, only if the business customer authorizes it, the app's message history for up to the last 180 days. | Meta, when the business connects a number it already uses in the WhatsApp Business app. |
| Meta data received through Embedded Signup | Identifiers of the assets the business authorizes (business portfolio, WhatsApp Business Account, phone number) and the related access token. We never receive passwords for Facebook, Meta or WhatsApp. | Meta, when the business completes signup and grants permissions. |
| Technical data | Server logs, IP address, browser type, access date and time. | Automatically, when using the dashboard or visiting this website. |
We do not ask for or seek sensitive data. If an end user includes it in a message on their own, it is handled like any other message content, only to provide the service.
3. How and why we use it
| Category | Purpose |
|---|---|
| Business customer | Create and manage the account, connect the WhatsApp number, provide the service, manage templates, provide support and communicate about the service. |
| End users | Receive and route messages to the right business, generate automated AI replies, show the conversation to the business in the dashboard and hand it over to a person when needed. |
| Coexistence | Show contacts and prior history in the dashboard so the business has continuity in its conversations. |
| Embedded Signup data | Identify the authorized assets and operate the WhatsApp Business API on the business's behalf (send and receive messages, manage templates). |
| Technical data | Keep the system running, detect failures, protect security and prevent abuse. |
We do not use end users' messages for advertising, we do not build commercial profiles from them and we do not use them for our own purposes other than providing the service to the business customer.
4. Who we share it with
To provide the service we work with these providers, which process data under their own terms and only as needed:
- Meta Platforms (WhatsApp Business Platform): message transport between end users and the business customer.
- Hostinger: servers hosting the system, including the PostgreSQL database and the n8n automation tool that runs the bot workflows.
- OpenAI: processing of message content to generate automated replies. Under OpenAI's API Data Retention Policy, content is not used to train their models and is retained for up to 30 days for abuse-monitoring purposes.
- Netlify: hosting of this website (assistantai.com.ar).
The business customer also accesses its own end users' conversations through the dashboard. We may disclose information if required by law or by a competent authority.
We do not sell personal data and we do not share it with third parties for advertising.
5. How long we keep it
| Data | Period |
|---|---|
| Conversation messages and files | 12 months from the last message in the conversation |
| Access tokens | While the account is active (deleted when the business disconnects its account) |
| History synced through coexistence | 12 months |
| Server logs | 90 days |
| n8n execution logs | 30 days |
| Business customer account data | 90 days after the service ends |
After these periods, or earlier if deletion is requested, we delete or anonymize the data, unless the law requires us to keep part of it.
6. Security
- Access tokens stored encrypted.
- Encrypted HTTPS/TLS connections on the website, dashboard and webhook.
- Dashboard access only with username and password; each business sees only its own conversations.
- Database and n8n not directly exposed to the public internet; restricted administrative access.
- Signature validation of the notifications Meta sends to the webhook.
- Regular backups.
No system is invulnerable. If we detect an incident affecting personal data, we will notify the affected business customers and, where applicable, the supervisory authority.
7. Your rights
Under Argentina's Personal Data Protection Law No. 25,326, you have the right to access, rectify, update and delete your data. Access is free of charge at intervals of no less than six months, unless a legitimate interest is shown.
To exercise these rights, email cumbredev@gmail.com stating your request and a detail that lets us find you (for example, your phone number). End users can also contact the business they messaged; if the request reaches us, we coordinate with that business.
The Agency for Access to Public Information (Agencia de Acceso a la Información Pública, AAIP), as the supervisory authority under Law 25,326, handles complaints from anyone whose rights are affected by non-compliance with personal data protection rules.
Data subjects have the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown, under Article 14, paragraph 3 of Law No. 25,326. The Agencia de Acceso a la Información Pública, as the supervisory authority under Law No. 25,326, has the power to address complaints and claims filed by anyone whose rights have been affected by non-compliance with the personal data protection rules in force.
8. How to request data deletion
You can ask us to delete your data at any time by emailing cumbredev@gmail.com with the subject "Eliminación de datos" (Data deletion). Full steps, timelines and what is deleted: Data deletion instructions (in Spanish).
9. International transfers
Meta, OpenAI and Netlify process data outside Argentina, mainly in the United States and other countries where they operate. The Hostinger servers hosting the system are located in Brazil (São Paulo). Your data may therefore be stored or processed in those countries, whose laws may offer a different level of protection than Argentina's. We choose providers that state security and confidentiality measures in their terms.
10. Children
Assistant AI is a service for businesses and is not directed at people under 18. We do not knowingly collect children's data for our own purposes. If a minor messages a business customer, their messages are processed on behalf of that business. If you believe we process a minor's data improperly, contact us and we will delete it.
11. Changes to this policy
We may update this policy. We will post the new version on this page with its update date and, for significant changes, notify business customers by email.