Privacy Policy

Important notice: this document is a baseline draft meant as a starting point. Before publishing it, a lawyer must review and adapt it to the actual operation, the providers under contract, and the regulations in force in each country where the service is offered.

IgnacIA is a platform of conversational AI agents. Client companies use it to serve, sell, and resolve over WhatsApp, web chat, and voice calls. This policy applies to the ignacia.ai website, the platform dashboard, and the services where this document is displayed.

By using IgnacIA, you accept this policy and our Terms and Conditions.

Two situations need to be told apart, because the obligations differ in each one:

• When we process data about our own visitors, prospects, and dashboard users, we act as the data controller.
• When an agent talks with the end customers of a company that hired us, we act as a data processor on that company's behalf. It defines what the data is used for, and we process it following its instructions and the service agreement.

If you talked with an agent and want to exercise your rights over that data, you can write to us and we will route you to the responsible company, or you can contact that company directly.

We collect different types of data, always limited to what is necessary to provide the service.

Account data

• Name, email, and phone number of the people who use the IgnacIA dashboard
• Company, position, and role assigned within the platform
• Access credentials (stored encrypted)

Conversation data

• The content of the messages exchanged between the end user and the agent, over WhatsApp, web chat, or voice
• Channel identifiers: phone number, widget session ID, or call ID
• On voice channels, the audio recording and its transcript, when the client enables that feature
• The data a person provides during the conversation: name, email, address, order number, or anything else the flow requires
• Logs of the actions the agent performs in the client's systems (tickets created, appointments booked, status lookups)

Technical data

• Platform access and usage logs
• Device and browser information for security and support
• Aggregate metrics on volume, response times, and handoffs to a human

Ask agents only for the data the flow actually needs. If a conversation may touch sensitive data (health, financial situation, or others), the client company must configure it with additional safeguards and the corresponding legal basis.

We use data to provide and improve the contracted service:

• Running the agents: understanding the message, holding the conversation's context, and replying
• Executing the integrated actions the client configured in their CRM, ERP, or scheduling system
• Showing conversation history in the dashboard so the human team can supervise and take over when needed
• Providing technical support and implementation guidance
• Improving the service's security, availability, and quality
• Sending operational communications and, with your consent, commercial information

We do not sell conversation data and we do not use it for third-party advertising.

The agents run on language models. Some of those models are operated by external providers, so the content of the conversation is transmitted to them in order to generate the reply.

• We contract those providers under terms that prohibit using conversation content to train their models
• The providers act as sub-processors and are bound by confidentiality and security obligations
• An up-to-date list of sub-processors is available on request by writing to contacto@ignacia.ai

Keep in mind that a reply generated by a language model can contain errors. Agents support the operation and do not replace human review when the decision warrants it.

We do not sell your data. We only share it in these cases:

• Language model providers and speech transcription or synthesis providers, to the extent needed to generate the reply
• The messaging and telephony providers through which the conversation travels
• Cloud infrastructure, storage, and monitoring providers, under confidentiality agreements
• Integrations the client company expressly activates (CRM, ERP, scheduling, invoicing)
• Competent authorities when required by law

With every sub-processor we keep a written agreement requiring security measures equivalent to our own and prohibiting the use of the data for their own purposes.

We keep conversations and their associated data while the client's account is active and for the period needed to meet legal, accounting, and tax obligations.

• Clients can set shorter retention periods for conversation history and for voice recordings
• Audio recordings can be deleted while keeping only the transcript, if the client configures it that way
• At the end of the contract, the client may request the export of their conversations and their subsequent deletion
• Backups are deleted according to our infrastructure's rotation cycles

In Chile, Law 19.628 on the protection of private life grants you rights of access, rectification, cancellation, and objection over your personal data. You may:

• Access the personal data we process about you, including the conversations you had with an agent
• Request the rectification of inaccurate or outdated data
• Request the deletion of your data where applicable
• Object to the processing or withdraw any consent you gave
• Request a copy of your data in a readable format

If you live in the European Economic Area or the United Kingdom and the General Data Protection Regulation applies, you also have the rights to restriction of processing, data portability, and not to be subject to automated decisions with significant effects, as well as the right to lodge a complaint with your supervisory authority.

To exercise these rights, write to contacto@ignacia.ai stating your request and the channel you used. If the data belongs to a client company acting as controller, we will forward your request to them.

Conversations are stored on cloud infrastructure with encryption in transit and at rest, automatic backups, and role-based access controls. Access by the IgnacIA team to conversation content is restricted to what support and operations require, and it is logged.

Part of the processing happens on servers located outside Chile, including those of our language model providers. In those cases we require equivalent contractual protection guarantees, including standard contractual clauses where the transfer falls under the GDPR.

The entity responsible for this platform is [LEGAL ENTITY NAME], tax ID [TAX ID], with registered address at [BUSINESS ADDRESS], Chile.

If you have questions about this policy or how your data is processed, write to us at contacto@ignacia.ai or visit our contact page.