Privacy Policy

1. Data Controller

DALIA AI PARTNERS LLC (hereinafter "the Company", "we") operates the DALIA platform and its associated services, including integrations with Meta (Facebook, Instagram, WhatsApp Business API) and any other connected channel. We act as the data controller for the account data of our customers and their authorized users. For the personal data of our customers' contacts processed within their accounts (for example, conversations through connected channels), we act as a data processor on behalf of the customer, who is the data controller for that data.

2. Data We Collect

We collect the following categories of personal information, either directly from you or through integrations with third parties:

2.1 Data provided by the user

• Name, email address, phone number, and company name (when registering or submitting contact forms).
• Content of messages sent through connected channels (WhatsApp, Instagram, etc.).
• Billing and payment information, where applicable.

2.2 Data obtained automatically

• IP address, browser type, operating system, and device data.
• Platform usage data: pages visited, features used, timestamps.
• Cookies and similar tracking technologies.

2.3 Data from third-party platforms

• Public Meta profile information (name, profile picture, user identifier) when the user interacts through Facebook, Instagram, or WhatsApp.
• Data provided through Meta APIs, including WhatsApp Business API conversation data, Instagram Messaging API data, and Conversions API (CAPI) data.
• Data from e-commerce integrations (e.g., VTEX) and external CRMs (e.g., Salesforce) configured by the customer.

3. Purpose of Processing

We process personal data exclusively for the following purposes:

1. Providing the service: Operating the conversational platform, managing the multi-agent inbox, running messaging campaigns, and activating automations configured by the customer.
2. Artificial intelligence: Running AI models to provide and improve the Service, generating automated responses, qualifying leads, and optimizing conversation flows, always within the context of the customer who configures the service. We do not use customer data to train third-party AI models (e.g., OpenAI).
3. Analysis and improvement: Generating aggregated, anonymous metrics to improve the platform, the user experience, and the effectiveness of campaigns.
4. Communications: Sending transactional notifications (account status, system alerts) and, with prior consent, promotional communications.
5. Legal compliance: Meeting legal and regulatory obligations or requests from competent authorities.
6. Security: Preventing fraud, unauthorized access, and misuse of the platform.

4. Legal Basis for Processing

Data processing is based on:

• Consent: Given by accepting these terms when registering or when interacting with our channels.
• Contract performance: Necessary to provide the contracted service.
• Legitimate interest: Product improvement, fraud prevention, and platform security.
• Legal obligation: Where applicable law requires it.

5. Data Sharing

We do not sell, rent, or trade personal data. We share information only in the following cases:

• Infrastructure providers (sub-processors): Hosting and data, AI and voice processing, messaging, telephony and email, payments, and integrations connected by the customer, all subject to data processing agreements.
• Customer integrations: When the customer sets up connections with CRMs, ERPs, or other systems, data flows according to the configuration authorized by the customer.
• Legal obligations: In response to requests from judicial or administrative authorities with competent jurisdiction.
• Protection of rights: To protect the security of our services, users, and the general public.

6. Use of Data from Meta Platforms

When we access data through Meta APIs (Facebook, Instagram, WhatsApp), we commit to:

• Use that data exclusively to provide the services requested by the user or customer.
• Not use Meta data to build user profiles for our own advertising purposes, sell data to third parties, or share data with data brokers.
• Delete the data obtained from Meta when the user requests it or when the application loses access to the API.
• Comply at all times with the Meta Developer Data Use Policy.

7. Data Retention

We keep personal data for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law. In particular:

• Account data: While the customer's account remains active and up to 2 years after its closure, unless the law requires a longer period.
• Conversation history: According to the customer's retention settings, with a default maximum of 24 months; deleted within 90 days after cancellation, with backups purged within that period.
• Analytics data: Anonymized and aggregated, with no time limit.
• Billing records and legal data: Billing records are kept for a minimum of 7 years; other legal data, according to the applicable statutory limitation periods.

8. Data Subject Rights

You have the following rights under applicable law (including the GDPR, the CCPA, and Colombia's Law 1581 of 2012):

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request the deletion of your personal data.
• Restriction: Limit the processing of your data in specific circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interest.
• Withdrawal of consent: Withdraw your consent at any time, without retroactive effect.

9. Data Deletion Request

You may request the complete deletion of your personal data by any of the following means:

1. Email: Write to contacto@dal-ia.com with the subject "Delete my data".
2. From the platform: DALIA customers can delete contacts and associated data directly from the admin panel.

Data will be deleted from our active systems within a maximum of 30 calendar days, unless there is a legal obligation to retain it. Automatic backups are purged on a cycle of at most 90 days.

10. Security Measures

We implement technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) and at rest.
• Token-based authentication and role-based access control (RBAC).
• Continuous monitoring, periodic audits, and incident response.
• Row Level Security (RLS) policies in databases to isolate data between customers.

11. Cookies and Tracking Technologies

We use cookies that are necessary for the platform to work. On our website we also use cookies and measurement technologies to analyze traffic and improve content. You can manage cookies from your browser settings.

12. Minors

DALIA is not directed at people under 18. We do not knowingly collect data from minors. If you become aware that a minor has provided personal data, contact us so we can delete it immediately.

13. International Transfers

Data may be processed on servers located in the United States and the European Union through our infrastructure, AI, payment, and integration providers. These transfers are made under standard contractual clauses and/or recognized adequacy decisions, ensuring a level of protection equivalent to that required by applicable regulations.

14. Additional Rights: California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

• Right to know: What categories and specific pieces of personal information we have collected.
• Right to delete: Request the deletion of your personal information.
• Right to opt out: We do not sell or share personal information for cross-context behavioral advertising.
• Non-discrimination: We will not discriminate against you for exercising your rights.

15. Changes to This Policy

We may update this policy periodically. The current version will always be available at this URL. Material changes will be notified by email to active customers at least 14 days in advance.

16. Contact

For any question about privacy or data protection:

This privacy policy belongs to DALIA AI PARTNERS LLC and covers exclusively the services offered through the DALIA platform. It does not replace, modify, or conflict with the terms and policies of Meta Platforms, Inc.

This Privacy Policy is also provided in other languages. Translations are provided for convenience; in the event of any discrepancy, the English version shall prevail.