Privacy Policy

1. Who is responsible for your data

• •Visitors of engagebot.io and account holders: Kuery S.A.S. is the controller (responsable del tratamiento).
• •Customers of the businesses that use Engagebot (people who write to a business on WhatsApp, diners who order from a digital menu, guests who book): the business is the controller, and Engagebot processes the data on its behalf and following its instructions (encargado del tratamiento). If you are one of these customers, contact the business first; we will help it answer your request.

2. Data we collect

When you visit engagebot.io

• •Demo request form: your email and WhatsApp number, which we use to contact you about the demo.
• •Country: our hosting provider tells us your country from your IP address, only to show prices in COP or USD. We store the result (not your IP) in a cookie.
• •Usage and ad measurement: pages viewed, device and approximate location, through Google Analytics; and, to measure and improve our own ads, the Meta Pixel and the Google Ads tag on engagebot.io and on the app's sign-up and sign-in pages (visits, demo requests and completed sign-ups, never the content you enter in the app).

When you create and use an Engagebot account

• •Account: name, email and password (stored only as a bcrypt hash), or your Google name, email and profile picture if you sign in with Google.
• •Workspace: business name and settings, team members you invite, WhatsApp Business account and phone number identifiers, and the access tokens Meta issues to connect them (encrypted).
• •Billing: plan, subscription and invoice history. Card details are entered and kept by Stripe; we do not receive or store full card numbers.
• •Content you create: chatbot flows, AI agent settings, knowledge base files and text, message templates, product catalog, digital menus and photos.
• •Technical data: IP address (used in memory for security and rate limiting), browser and device, error reports with personal data removed, and usage of features and AI credits.

Data a business processes through Engagebot about its customers

• •WhatsApp contacts: phone number, WhatsApp profile name, and the name, email, address, tags, notes and communication preferences the business or its AI agent records.
• •Conversations: messages, voice notes, images, documents and location sent or received, with their timestamps and delivery status.
• •Orders: products, notes, delivery address and location, and order status.
• •Digital menu orders: the diner's name, table, phone number (required for takeaway and delivery, optional at the table), delivery address and notes. We do not store diners' IP addresses. The cart is kept in the diner's browser until the order is sent.
• •Bookings: name, phone, email, notes, and the date, text and language of the consent given on the booking page.

Google account and Calendar data

If a user chooses to connect Google, we access the following Google user data through Google's APIs:

• •Sign in with Google: name, email address and basic profile information, used to authenticate you and create your Engagebot account.
• •Google Calendar (scopes calendar.events and calendar.readonly): used only to create, update and read the appointments, bookings and reservations that customers make through the business's Engagebot WhatsApp flows, agents or booking page, and to check availability. Event details can include the customer's name, phone and booking notes.

Google API Services User Data Policy and Limited Use. Engagebot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features described in this policy. We do not sell or transfer it, do not use it for advertising, do not use it to train AI models, and do not allow humans to read it except for security purposes, to comply with the law, or with your explicit consent.

3. Why we use it

• •To provide the Service you or the business asked for: sending and receiving WhatsApp messages, running flows and AI agents, publishing menus, receiving orders and bookings, syncing calendars and catalogs (contract).
• •To manage accounts, billing and support, and to send service emails such as verification, security alerts, trial and billing notices (contract).
• •To keep the Service secure and prevent fraud, spam and abuse, and to fix errors (legitimate interest).
• •To understand and improve our website and product with aggregated analytics, and to measure our ads (legitimate interest or consent, where required).
• •To answer demo requests and, if you agree, send you product news; you can opt out at any time (consent).
• •To comply with the law, including tax and accounting duties and requests from authorities (legal obligation).

We do not sell personal data and do not use the data of businesses' customers for our own marketing.

4. Artificial intelligence

Some features send data to AI providers to generate a result:

• •AI agents: the latest customer messages (up to the last 30 in the conversation) and the contact details the agent looks up are sent to generate the reply.
• •Voice notes and images captured by AI steps in a flow are sent for transcription or extraction.
• •Menu creation with AI: the photos or PDF of the menu are sent to extract the products; uploaded PDFs are deleted from the provider after extraction.
• •Knowledge base: the text of the documents is sent to create search embeddings.

The provider is OpenAI by default. A business can also select a GLM model from Zhipu AI (servers in China) for its AI agent; in that case that agent's conversations are processed by Zhipu AI. OpenAI states that data sent through its API is not used to train its models unless the customer opts in. We do not use your data or your customers' data to train AI models.

5. Who we share data with

We share personal data only with providers that help us run the Service, under their data processing terms, and only for the purposes above:

A business can also connect its own Twilio account, webhooks or other integrations; data sent there is under the business's control. We may disclose data when the law or an authority requires it, to protect our rights and users, or to a buyer in a merger or acquisition, who will be bound by this policy.

6. International transfers

Our servers are in Germany and our backups in the European Union. Some providers above process data in the United States, China or other countries whose laws may give a different level of protection than Colombia's. We rely on the providers' contractual commitments, and by using the Service you authorize these transfers as required to provide it (article 26 of Law 1581 of 2012). Businesses are responsible for informing their customers of them.

7. How long we keep data

• •Account and workspace data, conversations, contacts, menus and orders: while the account exists. Contacts and chats that a business deletes in the app are hidden and can be restored; they are permanently erased when the account is deleted.
• •Account deletion: when you ask us to close your account, we delete its data within 90 days, except what the law requires us to keep (for example invoices). Encrypted backups expire automatically within a further 90 days.
• •AI capture media: images and audio captured by AI steps are deleted 30 days after the conversation is archived.
• •Exports: CSV exports are deleted after 30 days.
• •Demo requests: kept while we follow up the request and for up to 24 months after, unless you ask us to delete them sooner.
• •Billing records: as long as tax law requires.

8. Security

• •All traffic uses HTTPS. Passwords are stored as bcrypt hashes.
• •WhatsApp access tokens, Google Calendar tokens, Twilio credentials and integration secrets are encrypted at rest with AES-256-GCM.
• •Sessions use a secure, httpOnly cookie that expires after 7 days.
• •Messages from Meta, Stripe, Twilio and Google are verified before they are processed.
• •Every database query is limited to the workspace it belongs to; only the workspace owner manages billing and the team.
• •Nightly database backups are encrypted and stored with a different provider from our servers.

No system is completely secure. If a security incident affects your personal data, we will notify you and the authorities as the law requires.

9. Cookies and local storage

The app also stores interface preferences (active workspace, list views, sound and printing settings) in your browser. You can block or delete cookies in your browser settings, and opt out of Google Analytics with Google's opt-out add-on; blocking auth_token stops you from signing in.

10. Your rights

In Colombia (Law 1581 of 2012) you have the right to know, update and correct your personal data; ask for proof of the authorization you gave; be told how your data is used; revoke the authorization or ask for deletion when there is no legal or contractual duty to keep it; access your data free of charge; and file complaints with the Superintendencia de Industria y Comercio (SIC) after contacting us.

In the European Union, the United Kingdom and similar jurisdictions you can also ask for restriction and portability of your data and object to its processing, and complain to your data protection authority. California residents have the right to know, delete and correct their data and not to be discriminated against for exercising these rights; we do not sell or share personal data for cross-context behavioral advertising, except the Meta Pixel and Google Ads tag described above, which measure our own ads.

How to exercise them

Write to privacy@engagebot.io with your name, the email or phone number your request is about, and what you are asking for. We answer questions within 10 business days (extendable by 5) and claims, such as corrections or deletion, within 15 business days (extendable by 8), as Colombian law provides. If your data was collected by a business that uses Engagebot, we will pass your request to that business and help it respond.

11. Children

The Service is for businesses and is not directed to children. Engagebot accounts are for people aged 18 or over. Businesses that serve minors must obtain the consent the law requires from their parents or guardians.

12. Changes to this policy

We will publish any change on this page with a new date and tell account holders about material changes by email or in the app before they take effect.

13. Contact

Kuery S.A.S., NIT 901228403-3 (Engagebot). Address: Calle 140 # 9 - 42, Bogotá, Colombia. Privacy and data requests: privacy@engagebot.io. Support: support@engagebot.io.