Privacy Policy

At LEAD MEDIA SPA (Tax ID 77.218.325-9), a Chilean Sociedad por Acciones operating under the commercial brand Citaredy ("we", "us"), we are the developers and operators of the Citaredy platform. We are committed to protecting the privacy of our users and their clients' data. This policy describes how we collect, use, store and protect personal information.

This policy is framed by Chile's Law No. 19.628 on the Protection of Private Life and, from its entry into force on December 1, 2026, by Law No. 21.719 governing the protection and processing of personal data, as well as by Meta Platforms' data-use policies.

2.1 User data (business owner)

• Account name and email address
• Business information (name, address, phone, hours)
• Service and pricing configuration
• Messaging-platform integration credentials (access tokens)

2.2 End-customer data (business contacts)

• Name, phone and email address (when provided)
• Platform identifiers (Instagram ID, Messenger PSID, WhatsApp phone)
• Conversation and message history
• Appointment and booking history
• Notes and tags assigned by the business owner

2.3 Usage data

• Platform usage metrics (anonymized analytics)
• Artificial-intelligence usage records (tokens consumed, costs)

Data processing relies on a lawful basis according to the purpose: performance of the contract with the business owner, the data subject's consent, the legitimate interest in operating and securing the Service, and compliance with legal obligations. Where the basis is consent, it is freely given, informed, specific, unambiguous and revocable; we do not rely on tacit consent.

3.1 Business owners (Citaredy users)

By creating a Citaredy account and connecting their Meta accounts, the business owner grants freely given, informed and specific consent for Citaredy to access and process data from their messaging platforms in order to provide the Service. This consent can be revoked at any time by disconnecting the Meta accounts from the dashboard.

3.2 End customers (business contacts)

End customers contact the business of their own initiative through Meta platforms; that voluntary contact allows their request to be handled. For sending proactive messages (for example, reminders or promotions), the business owner is responsible for obtaining valid opt-in consent —freely given, informed, specific, unambiguous and revocable— from each end customer, in accordance with Meta's policies and Chilean law.

3.3 Revoking access

The business owner can revoke Citaredy's access to their Meta data at any time by disconnecting their accounts from the dashboard. Disconnection immediately revokes Citaredy's access to that data; deletion of data already received is carried out within 30 days of your request, as described in section 11 (Retention and Deletion) and on the Delete Account and Data page.

It is important that you understand how your data flows through our system:

• Reception: end-customer messages reach Citaredy from Meta platforms (currently WhatsApp and Instagram; Messenger coming soon) through secure webhooks.
• AI processing: the message content is sent to our artificial-intelligence provider, OpenAI (gpt-4o-mini), to generate automated replies. The provider processes the data and returns the responses, but does not store your customers' data to train its models.
• Storage: processed messages, along with contact data and conversation history, are stored permanently in the Citaredy database (hosted on Supabase).
• Response: AI-generated replies are sent back to the end customer through Meta platforms.

We use the information we collect to:

• Operate and maintain the virtual assistant Service
• Process and reply to customer messages using artificial intelligence
• Manage appointments and bookings
• Send appointment reminders to end customers
• Generate analytics and reports for the business owner
• Improve the quality of the AI assistant's responses
• Communicate with you about your account and the Service

End-customer messages are processed by third-party artificial-intelligence models (OpenAI) to generate automated responses. The Citaredy assistant is a task-specific automation tool, not a general-purpose AI assistant. It is important that you know:

• Messages are sent to OpenAI (gpt-4o-mini) for processing and response generation
• Neither Citaredy nor its AI provider (OpenAI) use Meta Platform Data or message content to train or improve artificial-intelligence models. For more information, see OpenAI's privacy policy: OpenAI's Privacy Policy.
• Chat sessions (temporary buffer): the AI conversation context is held in memory for up to 12 hours of inactivity to preserve conversation continuity. This is a temporary buffer, not permanent storage. Once the session expires, the context is reset.
• Message history (permanent storage): message content is stored permanently in our database as conversation history, accessible from the business dashboard.
• Audio transcriptions are processed and stored as text
• Automated assistant: the assistant discloses that it is an automated (AI) assistant when the customer asks, never claims to be a human being, and does not make decisions with legal or similarly significant effects on them without the business's human supervision.

Data is stored on secure servers provided by Supabase (cloud infrastructure) and Vercel. We implement the following security measures:

• Data isolation per business (multi-tenancy with Row Level Security)
• Encryption in transit (HTTPS/TLS)
• Webhook signature verification (HMAC-SHA256)
• Securely stored access tokens
• Rate limits to prevent abuse

We do not sell personal data. We share data only with:

• AI provider (OpenAI): for message processing and audio transcription
• Meta Platforms (WhatsApp and Instagram; Messenger coming soon): to send and receive messages through their platforms
• Infrastructure providers (Supabase, Vercel): for storage —including images and profile pictures— and operation of the Service
• Upstash: for request rate limiting and the temporary handling of conversation context, which may transiently include message content and images while they are processed
• MercadoPago: for payment and subscription processing
• Sentry: for error monitoring and technical diagnostics, which may log technical identifiers associated with a request. When an error occurs, Sentry may record a reconstruction of the on-screen session (the pages visited and the interactions) so it can be diagnosed. On-screen text and images are masked, and sessions without errors are not recorded
• Resend: for sending transactional emails
• Google LLC (Google Analytics and Google Tag Manager): for usage analytics on our public marketing pages
• Competent authorities: when required by Chilean law

Some of our sub-processors (for example, OpenAI, Vercel, Supabase, Sentry and MercadoPago) process or store data on servers located outside Chile, including the United States. When this happens, we apply appropriate safeguards —each provider's contractual commitments and security measures— to protect your data in accordance with Chilean law. By using the Service, you acknowledge that your data may be processed in those jurisdictions.

We maintain measures to prevent and detect security incidents. In the event of a breach affecting personal data and posing a risk to the data subjects, we will notify the competent supervisory authority (the Personal Data Protection Agency, once operational) and, where applicable, the affected users, without undue delay and within the timeframes established by applicable law.

• Account data: retained for as long as the account is active. Upon account termination, the user has 30 days to export their data; once that period expires, it is permanently deleted.
• Messages and conversations: for as long as the account is active
• Chat sessions (AI): the AI conversation context is held in memory as a temporary buffer for up to 12 hours of inactivity, then resets automatically. This does not affect the message history stored in the database.
• Data originating from Meta: disconnecting the integration immediately revokes Citaredy's access to that data. Deletion of data already received is carried out within 30 days of your request, via the Delete Account and Data page.
• Deduplication records: 24 hours
• Financial and billing records: retained for the period required by Chilean tax law
• Security audit logs: up to 12 months

Under Law No. 19.628 and, from its entry into force, Law No. 21.719, data subjects have the right to:

• Access: request a copy of your personal data and information about its processing
• Rectification: correct inaccurate, outdated or incomplete data
• Erasure (deletion): request the deletion of your data where applicable
• Objection: object to certain processing, including marketing communications
• Portability: receive and transfer your data in a structured, commonly used format
• Blocking: request the temporary suspension of processing in the cases permitted by law
• Export: download your contact data in CSV format from the dashboard

To exercise these rights, contact us at contacto@citaredy.com. We will reply within a maximum of 15 business days, or within the timeframe established by applicable law.

For detailed instructions on how to delete your account and data, see Delete Account and Data.

The Service is not directed to anyone under 18. We do not knowingly collect data from minors. If we detect that we have collected data from a minor, we will delete it immediately.

As a Meta tech provider, we comply with the data-use policies of Meta Platforms, including:

• Using user data exclusively to provide the Service
• Not sharing Meta user data with unauthorized third parties
• Deleting Meta-originated data within 30 days of your deletion request; disconnecting the integration immediately revokes our access to that data
• Complying with the 24-hour messaging window
• Never selling, licensing, or transferring Meta Platform Data to third parties
• Not using Meta Platform Data to make eligibility decisions, including those relating to credit, employment, insurance or housing
• Not using Meta Platform Data for surveillance purposes
• Not using Meta Platform Data to build profiles or for targeted advertising

We may update this policy from time to time. We will notify significant changes by email at least 15 days in advance. The last update date is shown at the top of this document.

For questions about privacy and data protection, contact us at contacto@citaredy.com.

This privacy policy is provided in Spanish as required by Chilean law. Below is a brief summary in English for reference purposes. In case of any discrepancy, the Spanish version prevails.

Citaredy is a SaaS platform developed and operated by LEAD MEDIA SPA (Tax ID 77.218.325-9, doing business as Citaredy), based at Fresia 7500, BL 1, Dep. 103, Condominio St. Gallen, La Florida, Región Metropolitana de Santiago, Chile. Citaredy is a Meta Tech Provider offering AI-powered virtual assistants for businesses in the beauty and wellness industry. We process messages from WhatsApp and Instagram (Messenger coming soon) on behalf of our users (business owners) using OpenAI (gpt-4o-mini and Whisper); neither we nor OpenAI use Meta Platform Data or message content to train AI models. Our subprocessors include OpenAI, Supabase, Vercel, Upstash, MercadoPago, Sentry, and Resend; some process data in the United States under appropriate safeguards. We do not sell personal data, and we never sell, license, or transfer Meta Platform Data to third parties, nor use it for eligibility decisions, surveillance, profiling, or advertising. Users can revoke Meta access at any time (which immediately cuts off our access); associated data is deleted within 30 days of a request via our Delete Account page. This policy follows Chile's Law No. 19.628 and, from December 1, 2026, Law No. 21.719. For inquiries: contacto@citaredy.com.