Privacy policy

1. Who is responsible and how to reach us

Servicios Informáticos E-brain SpA, tax ID (RUT) 76.834.222-3, with its registered address at Av. Bosques de Montemar #30, Viña del Mar, Valparaíso, Chile (“Trato” or “we”), is the controller of the data this policy describes as Trato's own.

• Privacy contact: contacto@grupodtg.com.
• Brazil (LGPD): Eduardo Grandón Hernandez (contacto@grupodtg.com).

Write to that contact with any question about your data or to exercise your rights.

2. Trato's role for each type of data

Trato plays two different roles, depending on the data:

• Controller: Trato decides why and how it processes the data of company accounts and their teams, billing, sales inquiries, visits to this site, security logs, company verification documents and each end customer's Trato account (name, @nickname, verified email, the Google, Facebook or TikTok account you sign in with, the record of your promotion preferences, your acceptance of the Terms of use for customers and this policy, push notifications, blocks and reports).
• Processor: we process the content of each conversation between an end customer and a company on that company's behalf (messages, files, voice messages, consents, campaign context, internal notes and AI suggestions). The company is the controller and decides how it's used.

If you talk with a company through Trato, that company is accountable for how it uses the conversation. Please also read its privacy policy.

3. Data about companies, teams and visitors

As a controller, we process:

• Team accounts: name, email, language, role and status of each person; their password, if they have one (stored in protected form, never as readable text), and the Google, Facebook or TikTok account they sign in with, if they choose to (see “Sign in with Google, Facebook or TikTok”).
• Company: name, chat address (trato.chat/yourcompany), billing country, profile details and settings.
• Billing: plan, payments, receipts and the payment method on file. You enter your card or bank account details on the payment gateway's page: Trato never receives them and only keeps a token or reference, the brand and the last digits.
• Sales inquiries: name, email, company, phone, team size and the message you send us from this site.
• Company verification: the documents the company uploads and its messages with the review team (see “Company verification”).
• Acceptance of the Terms by the company: who accepted (name and email), the date and time, the IP address, the browser, the version and a fingerprint of the accepted text.
• Usage and security: technical logs (IP address, browser, dates), the console's audit log and support access records.
• Visits to this site: the language you choose (see “Cookies and local storage”).

4. Your Trato account as an end customer

You don't need to give us any details to talk with a company. If you want, you can add details to your Trato account so companies recognize you and so you can get your history back on another device. The first detail is always your email: once it's verified, you can add a @nickname. Trato is the controller of this data:

• Verified email, confirmed with a code we send you by email.
• Name and @nickname, if you choose to give them. You pick your @nickname after verifying your email. You can change or remove them in Settings.
• The Google, Facebook or TikTok account you sign in with in the web chat or the Android app, if you choose to (see “Sign in with Google, Facebook or TikTok”).
• Your acceptance of the Terms of use for customers and this policy (see below).
• Your language, the push notifications you turn on, and the companies you block or report, with the reason for the report.
• A session identifier stored in your browser or in the app.

To get your history back on another device, verify your email, sign in with the same Google, Facebook or TikTok account, or enter your @nickname. With your @nickname, we send a code to your account's email and only show you part of that email, so you know where it went. When you sign in, we merge your conversations.

When you write to a company, we show it your name, @nickname and email, if you added them. Each company only sees its own conversation with you: it can't see which other companies you talk with.

You decide on each company's promotions:

• They start on when you start a conversation with a company. In that conversation, we let you know they're on, with a button to turn them off.
• You can turn them off or back on anytime, company by company, with the “Get promotions” switch in the company's info (web chat, widget or app), or by replying STOP in the conversation.
• The company can turn them off if you ask, but can never turn them on. Its promotions only reach you if you have them turned on, and they always include how to opt out.
• Notices about your services are separate: turning off promotions doesn't change them.
• We keep a record of each change, with the date, the source (the start of the conversation, the switch, your STOP reply or the company) and the version of this policy. We keep it while your account exists, delete it when you delete your account or it's anonymized, and include it in the copy you get with “Download my data.”

In the chat and the app, we ask you to accept the Terms of use for customers and this policy, the same ones we publish on this site:

• We keep the version you accepted (its “Last updated” date), the date and time, and where you accepted it (web chat, widget or app).
• If the version changes, we ask you to accept it again.
• We keep it while your account exists, delete it when you delete your account or it's anonymized, and include it in the copy you get with “Download my data.”

In Settings, you can also download your data or delete your account (see “Your rights and how to exercise them”).

5. Sign in with Google, Facebook or TikTok

You can sign in to Trato with your Google, Facebook or TikTok account:

• If you're on a company's team: to sign in to the console or to create your company's account, without a password.
• If you're an end customer: in the web chat or the Android app, to identify yourself and get your history back on any device. It isn't available inside the widget on a company's website or in the iPhone app: there, you sign in with your email and a code.

Using a provider is optional and your choice: in the console you can use your email and a password, and in the chat you don't need to give us any details.

From that provider we only receive:

• your account identifier with that provider;
• your name;
• your email, when the provider shares it.

Depending on the provider:

• Google shares your verified email.
• Facebook shares your confirmed email, but sometimes shares none. If it doesn't, we ask for it and confirm it with a code.
• TikTok never shares your email: we always ask for it and confirm it with a code.

We don't receive your posts, contacts, friends or any other data from that account, and we never post on your behalf.

We use this data only to identify you, to sign you in or create your account and, if you're an end customer, to merge your conversations. We keep the linked account while your console account or your Trato account exists, and delete it when you delete your account or it's anonymized. Unfinished sign-ins and the one-time codes used to return from the provider are deleted after 1 day.

The provider you choose confirms your identity and knows you used your account to sign in to Trato. It processes that data under its own terms and privacy policy.

6. Your conversations with each company

When an end customer talks with a company, Trato processes the following on that company's behalf, as a processor:

• the conversation's messages, photos, documents and voice messages, and its history;
• whether you agreed to receive notices and whether you have that company's promotions turned on, and opt-outs;
• context from campaign links: the topic of the inquiry and, if the company includes them, a recipient reference and a suggested name, which we don't verify;
• internal notes, tags and details added by the company's team, and satisfaction surveys;
• reply suggestions and summaries created with AI.

The company decides how it uses this data and must inform its customers and have a legal basis. Trato uses it only to provide the service to the company and according to its instructions, as set out in the Terms of service and the Data processing agreement. The company can also move this data into its own systems using the API and webhooks, or into artificial intelligence tools it chooses using the MCP server; in that case, the company decides on that transfer and is responsible for it.

Trato doesn't ask for sensitive data. If a company asks you for it (for example, health data at a clinic), that company is responsible for processing it: check its terms and privacy notice.

If you want to exercise your rights over a conversation, contact the company. If you write to us, we'll forward your request to them.

7. Why we use data and on what legal basis

Each use has a legal basis: the contract (providing the service that was requested), your consent, our legitimate interest (as long as your rights don't override it) or a legal obligation.

We don't sell personal data. Trato doesn't use conversations for advertising or to train AI models.

8. Photos, documents and voice messages

End customers with a verified email can send photos, documents and voice messages from the chat, the widget and the app.

• The company receives them in its console, and can also receive them through the API and webhooks.
• We check each file's actual type (not just its extension) and accept files up to 10 MB.
• We store them in private storage, never at a public address.
• They open through signed links that expire after 24 hours.
• We don't use voice messages to recognize your voice or identify you.

Only send what's needed. Avoid sharing sensitive information, such as health information, ID documents or bank details, unless the company needs it to help you. For example, if a clinic asks you for a photo or a test result, the clinic decides how that data is used and is responsible for protecting it; Trato protects it with the measures described in this policy.

9. Links with context

Companies whose plan includes links with context can create them for their emails, campaigns, text messages or social media. If you open one:

• we count the click for the company's statistics;
• you see what your inquiry is about, and the company's team sees an internal note with a summary of the campaign;
• if the company added a recipient reference and a name to the link, we store them with the conversation marked “unverified,” because a forwarded email may reach someone else.

We recommend that companies use references that don't directly identify the person, such as a subscriber number instead of an email address. If the company asks, AI summarizes the campaign email for its team (see “Artificial intelligence”).

10. Company verification

Companies whose plan includes verification can request the verified business badge. To do so, they upload documents that prove who they are: in Chile, the company's tax ID (RUT), its deed of incorporation, bylaws or certificate of good standing, and its legal representative's national ID card; in other countries, the company registration and its legal representative's ID. They can also add proof of address or other documents.

• Purpose: confirm that the company is who it says it is, show the badge and prevent fraud and impersonation.
• Review: done by hand by Trato's review team. There are no automated decisions.
• Access: only the company's admins and the review team. Support access can't see these documents, and every action is recorded in the audit log.
• Storage: outside the public site. We accept PDF, JPG and PNG files and check each file's actual content.
• Retention: we keep the documents for up to 90 days after the request is approved or rejected, or for up to 12 months without activity if the request is never completed. We keep a record of the decision.

If you're the legal representative, we use your data only for this verification.

11. Verification codes, emails and push notifications

• Codes by email: to verify your email or to sign in with your @nickname, we send you a 6-digit code that expires after 15 minutes.
• Codes for a company's team: the email code to sign up a company expires after 30 minutes. The console's email codes, used to confirm your email when you sign in with Google, Facebook or TikTok and the provider doesn't share it, or to close the account without a password, expire after 15 minutes.
• Emails: we send codes, reply notifications, receipts and account notices through Oracle Cloud Infrastructure.
• Push notifications: if you turn them on, we store an identifier for your browser or phone, along with the browser type, to let you know when a company replies. The notification includes the company's name and the beginning of its reply, and it's delivered through Apple, Google or your browser's notification service. You can turn notifications off in your browser or phone.

12. Support access with permission

The Trato team isn't part of any company and can't see its conversations or contacts. It only enters a company's account if an admin of that company authorizes it in Settings → Security:

• for a limited time (from 1 hour to 7 days) and at a set level: read only, or read and change;
• it can never touch billing, API keys, the team, support permissions or verification documents;
• every access and change is recorded in the company's audit log, and the first time we enter, we notify its admins by email;
• the company can revoke the permission at any time.

13. Artificial intelligence

Trato uses AI from Anthropic (US) for two features that the company chooses to use:

• AI Agent reply suggestions and automatic answers: we send Anthropic the latest messages in the conversation and the company's knowledge base. For files and voice messages, we only send their type and name, not their content. Internal notes aren't sent.
• Email summaries for links with context: we send the text of the email the company pastes in.

A member of the company's team reviews each suggestion before sending it. If the company turns on automatic answers, the AI Agent may answer you without that review, only with information from the company's knowledge base; those messages appear as coming from the “AI assistant” and you can always ask to talk to a person. The AI doesn't make automated decisions that have legal effects on you or that significantly affect you. Anthropic processes this data as our provider, only to generate the response, and under its commercial terms doesn't use it to train its models.

14. Who we share data with

We only share data with:

• the company you're talking with, which sees the conversation and the Trato account details described above;
• providers that help us deliver the service (listed below), which may only use the data for that purpose;
• authorities, when required by law.

Providers by category and country:

• Hosting, database and files: Oracle Cloud Infrastructure (Chile).
• Email delivery: Oracle Cloud Infrastructure.
• Artificial intelligence: Anthropic (US).
• Payments in Chile: Transbank, Flow and Mercado Pago (Chile).
• Payments in other countries: PayPal (US).
• Push notifications: Apple and Google (US), and your browser's notification service.
• Fonts on this site: Google Fonts (US).

Payment gateways receive your card or bank account details directly; Trato only keeps a token or reference and the last digits. Some gateways also process that data under their own policies.

If you choose to sign in with Google, Facebook or TikTok, using that provider is your choice: it confirms your identity, sends us only the data described in “Sign in with Google, Facebook or TikTok” and processes the sign-in under its own policies.

If Trato changes ownership or merges with another organization, data may be transferred with the same protections.

15. International transfers

Some providers process data outside your country, mainly in the US (see the list above). When data goes to a country that may not offer an equivalent level of protection, we use safeguards such as data protection contract clauses with each provider, which require it to protect the data as the law demands. For data subjects in Brazil, we adopt the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024). For data we process on behalf of companies, the safeguards are set out in the Data processing agreement. You can ask for more information about these safeguards at contacto@grupodtg.com.

16. How long we keep data

We keep data only as long as we need it for the purpose we received it for. These are the retention periods:

When a company closes its account:

• An admin requests it in Settings → Security and confirms with their password or, if they sign in with Google, Facebook or TikTok, with a code we email them. From that moment, its customers can no longer message it.
• For 30 days, the company can download a copy of its data or cancel the closure. We send a reminder by email 7 days before the deletion.
• On day 30, we delete everything: conversations, contacts, files and the accounts of team members who don't belong to another company. We only keep payment receipts for the tax retention period and the records of acceptance of the Terms.

An automated process applies these periods every day: when a period ends, it deletes or anonymizes the data. We only keep data longer if the law requires it or if we must preserve it because of a claim, an investigation or a court order (a legal hold); in that case, until the matter is resolved.

Backups are overwritten within 90 days, so deleted data also disappears from backups within that period.

17. Your rights and how to exercise them

You can exercise these rights over your data:

• Access: know what data we process about you and get a copy.
• Correction: fix inaccurate or incomplete data.
• Deletion: ask us to delete your data.
• Objection: object to processing, for example processing based on our legitimate interest. You can also object to receiving a company's promotions: turn them off anytime with the “Get promotions” switch in that company's info, or by replying STOP.
• Portability: get your data in a structured, commonly used format.
• Restriction (blocking): ask us to pause processing while we handle another request from you.
• Withdraw your consent, when processing is based on it.

If you're in Brazil, you also have the rights under Article 18 of the LGPD, such as confirming whether we process your data and knowing who we share it with.

How to exercise them:

• Your Trato account data (name, @nickname and email): directly with us. In Settings in the chat or the app, you can change or remove your name and @nickname, download a copy of your account, your conversations, your promotion records and your acceptance of the Terms of use and this policy as a JSON file with “Download my data,” and delete your account with “Delete my account.” For anything else, write to contacto@grupodtg.com.
• Data in a conversation with a company: contact that company, which is the controller. If you write to us, we'll forward your request to them.
• Data about companies, their teams and sales inquiries: write to contacto@grupodtg.com.

When you delete your account, we anonymize it right away: we erase your name, @nickname, email, linked Google, Facebook or TikTok accounts, the record of your promotion changes and the record of your acceptance of the Terms of use and this policy, and sign you out on all your devices. If you had a verified email, we send you a confirmation. Your conversations stay with each company, because they're that company's data: if you want them deleted too, ask the company.

If you're a company, you can handle your customers' requests from the console: an admin can download a full copy of the company's data (a ZIP file with contacts, conversations, messages and files) and delete a contact along with its entire history. We email you when the copy is ready; the link expires after 7 days.

We may ask you to confirm your identity, for example with a code sent to your verified email. We respond within the legal deadlines: in Chile, 30 calendar days, extendable once for the same period.

If you're not satisfied, you can file a complaint with the Personal Data Protection Agency (Agencia de Protección de Datos Personales, Chile), the National Data Protection Authority (ANPD, Brazil) or the data protection authority in your country.

18. Minors

Trato accounts for end customers are for people aged 18 or older. Company accounts are for adults acting on behalf of an organization.

If a company serves children or teenagers, such as a clinic or a school, it is responsible for following the rules that apply to their data, including obtaining parental or guardian authorization when the law requires it. If you believe someone under the minimum age has given us their data, write to contacto@grupodtg.com and we'll delete it.

19. Security and incident notification

We use technical and organizational measures to protect data:

• encrypted connections and passwords stored in protected form;
• role-based access control and an audit log;
• files and documents in private storage, with their type checked and signed links that expire;
• integration keys stored encrypted and never shown in full;
• limits on attempts for verification codes and on sending;
• signed webhooks and API keys with permissions and usage limits, which the company can revoke;
• automatic deletion of data when its retention period ends;
• support access only with the company's permission, time-limited and audited.

No system is completely secure. If an incident occurs that may affect your data, we'll notify the competent authority and the people affected within the deadlines required by law. If it affects data we process on behalf of a company, we'll notify that company without delay so it can meet its own obligations.

20. Cookies and local storage

This site doesn't use advertising cookies. It stores in your browser the language you choose and whether you closed the language notice. Fonts are loaded from Google Fonts, which receives your IP address when downloading them. The console and the chat use browser storage to keep you signed in.

21. Changes to this policy

We may update this policy. We'll publish the new version on this page with its date and, if the change is significant, notify companies by email or in the console. Each time the version changes, the chat and the app ask end customers to accept it again.

22. Contact

For any questions about privacy or this policy, write to us at contacto@grupodtg.com. From Brazil, you can also use Eduardo Grandón Hernandez (contacto@grupodtg.com).