Privacy Policy

1. Who we are and scope of this policy

SocialChat365 is a software-as-a-service (SaaS) platform operated by TRACKEX S.A.S. that lets businesses handle their WhatsApp Business, Facebook Messenger and Instagram Direct conversations in a shared inbox, reply to comments, publish content to their Facebook Pages and Instagram professional accounts, manage contacts, campaigns, appointments, orders and payments, and use an optional artificial intelligence assistant.

This policy explains what data we process, why, who we share it with, how long we keep it and how you can exercise your rights. It applies to the socialchat365.com website, the CRM panel (socialchat365.com/crm) and the Meta app SocialChat365.com (App ID 735385349040881).

TRACKEX S.A.S. is the entity responsible for SocialChat365 and for how data obtained from Meta is processed on the platform. Regarding the data of end customers who write to a business, each business customer is the data controller of that data and decides how it uses it in its business, and TRACKEX S.A.S. acts as the data processor: it processes the data on that business's behalf and only to provide the service.

2. Data we process

2.1 Data of our customers and their users

• At sign-up: business name, name of the person in charge, mobile number, email address and password (stored irreversibly, never in readable form).
• At payment: tax ID, legal name and billing address. Card details are received and protected directly by the payment gateway; we do not store them.
• Panel users (administrators and agents): name, email, role and the activity logs needed for account security.
• Content the customer uploads: AI assistant instructions, knowledge-base documents, product catalog, services and business hours.
• Record of acceptance of the terms (date, time, user and IP), review records for templates and campaigns, and the proof of consent the customer provides to us when we request it.

2.2 Data from the Meta accounts the customer connects

• Name and ID of the Facebook Page and of the selected business portfolio.
• Username, profile picture and ID of the linked Instagram professional account, and its posts.
• The connected WhatsApp Business number and its ID.
• The access tokens the customer authorizes and the ID of the person who made the connection, needed to handle deauthorization and data deletion requests.

We only receive data from the Pages, accounts and numbers the customer explicitly selects when connecting with Facebook.

2.3 Data of end customers who write to a business

• Name and profile picture, Facebook or Instagram ID, phone number (WhatsApp).
• The content of the messages, comments and attachments the person sends to the business, and the business's replies.
• Data the person provides in the conversation for an appointment, an order or a payment (for example, email or proof of payment).

2.4 Technical data

IP address, browser type, access dates and times, and server error logs, used for security, usage limits and troubleshooting.

3. How we use the data

• To show messages and comments in the customer's inbox and let their agents reply.
• To generate automatic AI replies when the customer enables the assistant, following the instructions the customer sets.
• To publish on Facebook and Instagram the content the customer creates and approves.
• To manage the customer's contacts, WhatsApp campaigns, appointments, orders and payments.
• To manage the account: sign-up, email verification, plans, billing, usage notices and support.
• To protect the platform: prevent fraud, abuse, spam, unauthorized access and uses prohibited by Meta, review templates and campaigns, and respond to Meta's alerts and requests.

We do not use the data for advertising, we do not sell it and we do not build profiles of end customers for our own purposes.

4. Legal basis

• Performance of the contract with our customer, to provide the contracted service.
• Instructions from the business customer, for its end customers' data, which the business processes under its own legal basis. The business customer guarantees that it has informed its contacts and that it has their consent or another valid legal basis under Ecuador's Organic Law on Personal Data Protection, in particular to send them templates and campaigns.
• Consent, when the customer accepts these terms and authorizes access to its Meta accounts; it can be withdrawn at any time by disconnecting them.
• Legal obligation, for example to keep tax records.
• Legitimate interest, for platform security and abuse prevention.

5. Use of Meta data

We only access the Facebook, Instagram and WhatsApp data needed for the CRM to work, and we use it solely to provide the service to our customer. We comply with the Meta Platform Terms. Specifically:

• We show the Pages and Instagram accounts the customer authorized, so they can choose which ones to connect.
• We subscribe the connected Pages to Meta webhooks to receive messages and comments, and unsubscribe them when the customer disconnects them.
• We receive and reply to Messenger and Instagram Direct messages within the 24-hour window allowed by Meta.
• We read the posts and comments of the connected Pages and accounts, and reply to comments.
• We publish to the customer's Page or account only the content they create and approve.

Meta data is not used for advertising, is not sold or transferred to data brokers, and is not used to train artificial intelligence models.

If Meta issues an alert or makes a request regarding a connected account's compliance with its policies, we may share with Meta the minimum necessary information about that account and its messages in order to respond.

6. Service providers that process data on our behalf

We do not share data with third parties for their own purposes. To provide the service we use these providers, which process data only on our behalf and under their data processing agreements:

• Google LLC (Google Cloud Platform): server hosting, databases and file storage.
• Anthropic PBC, OpenAI LLC and Google LLC (Gemini API): processing of message and comment text to generate AI replies, with the provider each customer chooses. OpenAI is also used to index the customer's documents and messages so the assistant can find relevant information. Under their API terms, these providers do not use that data to train their models.
• OpenAI, Google (Gemini), Black Forest Labs and Higgsfield: generation of images and videos for posts, based on the customer's instructions.
• Zoho Corporation: delivery of platform emails (verification, notices and summaries).
• PayPhone: card payment processing for subscriptions and for payments the customer requests from the chat.
• Google LLC (Google Calendar): only if the customer connects their calendar, to record appointments booked from the chat.

Some of these providers process data outside Ecuador, mainly in the United States. We choose providers that offer adequate contractual and technical safeguards to protect the data.

7. Artificial intelligence

The AI assistant is optional and configured by each customer. It replies based on the customer's instructions and documents, and it can make mistakes. Human agents can take over any conversation at any time; when an agent replies, the AI is paused for that conversation. We do not make automated decisions that produce legal effects on people.

8. Security

• All communication is encrypted in transit (HTTPS).
• Meta access tokens and other credentials are stored encrypted, and every call to Meta is signed with the app secret.
• Each customer's data is kept separate from other customers, and access within a customer depends on the user's role (administrator or agent).
• Server access is restricted to authorized personnel.

If a security incident affects personal data, we will notify the affected customers and the competent authority as required by law.

9. Retention and deletion

• We keep the data while the customer's account is active.
• Media files from posts are deleted automatically after 180 days.
• If a trial account ends without a paid plan, its connections are disabled and its data is deleted after 60 days.
• If the customer cancels their account or requests deletion, we delete their data within 30 days at most.
• The record of acceptance of the terms and the compliance records are kept while the account is active and for up to 3 years after it is closed, to handle claims.
• We keep only what the law requires, such as billing records, for the legal period.

If a person removes the SocialChat365.com app from their Facebook settings and requests data deletion, Meta notifies us and we process the request automatically. All options are described at https://socialchat365.com/acercade/data-deletion.html.

10. Your rights

Under Ecuador's Organic Law on Personal Data Protection and, where applicable, the European Union's General Data Protection Regulation (GDPR), you have the rights of access, rectification and updating, erasure, objection, portability, restriction of processing and not to be subject to decisions based solely on automated processing.

Write to contacto@socialchat365.com stating your request and a detail that allows us to identify you. We will reply within 15 days at most. If you are an end customer of a business that uses SocialChat365, you can also send your request to that business; we will help it respond. If you believe we did not address your request, you can file a complaint with Ecuador's Superintendency of Personal Data Protection.

11. Requests from public authorities

TRACKEX S.A.S. only discloses personal data to public authorities when there is a valid legal obligation. Every request is reviewed to verify its legality before responding; if it is considered unlawful, excessive or unfounded, it will be challenged through the available legal channels. When data is disclosed, only the minimum information necessary to comply with the request is provided. Each request is documented, including the response given, the parties involved and the legal reasoning applied.

12. Cookies and local storage

The CRM panel uses the browser's local storage only to keep you signed in and remember your preferences. We do not use third-party advertising or tracking cookies.

13. Minors

SocialChat365 is a service for businesses and is not directed at people under 18. Accounts can only be created by adults acting on behalf of a business.

14. Changes to this policy

We may update this policy when the service or the law changes. We will publish the new version on this page with its date and, if the change is significant, notify customers by email or in the panel.

15. Contact

For any privacy question, write to contacto@socialchat365.com or to TRACKEX S.A.S., Santa Rosa y Manuel Serrano, Machala, El Oro - Ecuador.

This is an English translation. In case of discrepancy, the Spanish version prevails.