Privacy Policy

1Website vs. platform

This website (beppoai.com) is informational: it requires no account and shows no advertising. It uses two kinds of visit analytics. Vercel Web Analytics counts page views in aggregate and without cookies. Google Analytics does use cookies (_ga) to measure which pages and campaigns bring people who write to us and go on to become BeppoAI customers; we do not use it to show you advertising. If you open WhatsApp from the site to write to us, the message carries a short code (for example [#inicio-…]) that links that visit to the conversation, so we know which page or campaign you came from. We tell Google that the contact or result happened (for example, that you wrote to us or booked a meeting), along with its cookie identifier and the time; never your name, your phone number or the content of your messages. If you write to us on WhatsApp or by email, we handle only the data you share with us in order to reply. The platform (app.beppoai.com), on the other hand, operates the businesses’ WhatsApp agents and handles their end customers’ data, as detailed below.

2The three roles — who is accountable for what

BeppoAI does not play a single role regarding your data. It plays three, and the obligations change depending on which one applies:

When you write on WhatsApp to a business served by a BeppoAI agent, the controller of your data is that business, not BeppoAI. We process on its instructions. This policy is not that business’s privacy notice — the business issues its own, and must give it to you in the conversation. Some businesses publish their own notice on our domain, for example beppoai.com/aviso/pediatria-con-lu (in Spanish), the notice of Dr. Luisa Muskus, pediatrician.

Identification details of BeppoAI as processor: Sergio Leonardo Cortés Perdomo, natural person and merchant, NIT 1075246021-5, business establishment "BEPPOAI", Calle 105B #109-70, Apartadó, Antioquia · contacto@beppoai.com

3When BeppoAI contacts you as its own prospect (sales channel)

Besides operating as processor for the businesses that use the platform, BeppoAI also acts as controller of its own sales data: when you leave your details in a BeppoAI advertising form (for example, a Google Ads form) and tick the authorization box, you authorize BeppoAI (Sergio Leonardo Cortés Perdomo, natural person and merchant, Apartadó) to write to you on WhatsApp through an automated assistant (an AI).

For what purpose. To understand your business, assess whether BeppoAI’s service is useful to you and, if it fits, get in touch to talk about it. For that, the assistant will ask you in which country your business operates, how much a customer brings you on average and what message volume you handle. The conversation may be read or continued by a person on the team.

Which data and where it is processed. Your WhatsApp number, your name and the content of the conversation, with the same sub-processors outside Colombia detailed below (United States and Singapore).

How long it is kept. The content of the conversation is deleted 90 days after the last interaction. The record of your authorization is kept and, if you ask not to be written to again, your number goes on an exclusion list solely so that we never contact you again.

How to opt out or exercise your rights. You can ask not to be written to again by replying NO in the same chat (or writing STOP), or at contacto@beppoai.com; and you can access, update, rectify or delete your data, or revoke your authorization, as described in the Habeas Data rights section.

4Data we handle

• Of end customers (on WhatsApp): WhatsApp number, contact name, message content, conversation metadata (status, tags) and, when the feature is on, AI-generated summaries of each customer’s history (“customer memory”).
• Of the business’s users (who operate the platform): name, email and role.
• Of whoever contacts us through the site: the contact detail you write to us from (WhatsApp or email) and the message.

5Purposes

To provide the WhatsApp service with AI and with human intervention: answering conversations, giving continuity to returning customers, qualifying prospects, measuring service quality and meeting the platform’s operational and security obligations. We do not use the businesses’ conversations to train general-purpose AI models.

6Legal basis / authorization

The basis for processing is the data subject’s authorization. For the contact details of the Client (the contracting business), authorization is understood as granted through unequivocal conduct by providing those details for the performance of the service (Decree 1377 of 2013, art. 7), and it is documented in the contract. For the data of end customers, the authorization is collected by the business as controller. The medical or health emergency exception applies (art. 10 lit. c) of Law 1581 of 2012).

7Who the data is processed with, and where

None of them uses the data to train artificial intelligence models.

International data transmission

All of the providers above are outside Colombia and process the data as processors: on behalf of the controller, following its instructions and under a processing contract. That is an international transmission (Decree 1377 of 2013, arts. 24 and 25, now compiled in Decree 1074 of 2015), not a transfer to another controller (Law 1581 of 2012, art. 26). Under that contract, the transmission requires no additional authorization from the data subject, whichever country the provider operates in.

This does not replace the authorization each business asks its customers for to process their data, in particular sensitive data and data of children and adolescents (Law 1581 of 2012, arts. 6 and 7).

For transparency, we state the countries where they operate: the United States and Singapore (YCloud). Singapore is not on the Superintendencia de Industria y Comercio’s list of countries with an adequate level of protection, which is why we name it expressly.

8How long we keep the data

• WhatsApp conversations: at most 90 days (about 3 months) from the last interaction. Each business can set a shorter period; businesses that handle health data set it at 30 days.
• Data handled before an authorization exists: it is quarantined and deleted after 30 days if the authorization does not arrive.
• Records of the agent’s internal tests: 90 days, and anonymized (no phone numbers, names or emails).
• Data processed by Anthropic in an assistant task: we delete it when the task ends. If Anthropic flags a task for safety reasons, it may keep it for up to 2 years; that period is set by the provider and does not depend on BeppoAI.
• Proof of authorization: kept while the relationship is in force, because the law requires being able to prove it. A revocation does not erase the proof that the authorization existed: it records that it ended.

9Security

We apply technical and organizational measures to protect the data: encryption in transit (TLS), separation per business (multi-tenant), sensitive credentials in a secrets manager and role-based access controls. No system is infallible; we work to keep these measures up to date.

Security incidents. If a breach affecting personal data occurs, we notify the controlling business within 24 hours of becoming aware of it, and we report to the Superintendencia de Industria y Comercio within the 15 business days required by Circular 003 of 2018 — an obligation that also applies to processors.

10Habeas Data rights

Every data subject may request to access, update, rectify and delete their personal data, as well as revoke the authorization granted, under Law 1581 of 2012 and its regulatory decrees. They may also file complaints with the Superintendencia de Industria y Comercio (SIC). Requests are received at contacto@beppoai.com. Queries (access) are answered within at most ten (10) business days, extendable by five (5) more; claims (rectify, update, delete or revoke) within at most fifteen (15) business days, extendable by eight (8) more. When the request concerns data whose controller is a client business, BeppoAI, as processor, forwards it to that controller within the following two (2) business days and informs the requester (Law 1581 of 2012, arts. 14 and 15).

11Informing the end customer and opting out

The business is responsible for informing its end customers that they are interacting with an AI agent. An end customer can stop receiving automated messages by writing STOP (opt-out already in place).

12Cookies

This site uses no tracking cookies. The platform uses strictly functional cookies (session and active workspace). The details are in the Cookie Policy.

13Data of children and adolescents

They have reinforced protection (Law 1581, art. 7; Decree 1377, art. 12). When a BeppoAI agent serves a business that handles minors’ data —for example, a pediatric practice—:

• Authorization is granted by the father, mother or legal representative, in a prior, express and informed way
• The processing must serve the minor’s best interest and respect their fundamental rights
• If the minor is old and mature enough to have an opinion, that opinion must be taken into account
• Only the minimum necessary for the purpose is handled

14Changes to this policy

This document may be updated as the product evolves. Relevant changes will be communicated through the service’s usual channels.

15Contact

To exercise your rights or resolve questions, write to contacto@beppoai.com.

National Database Registry (RNBD). BeppoAI operates as a natural person and merchant, and Decree 090 of 2018 expressly excludes natural persons from the obligation to register databases with the RNBD. That exclusion does not exempt it from the rest of Law 1581, including the duty to report security incidents.