Privacy Policy

At LEAD MEDIA SPA (Tax ID 77.218.325-9), a Chilean Sociedad por Acciones operating under the commercial brand Marketing Con Yas ("we", "us"), we are the developers and operators of the Citaredy platform. We are committed to protecting the privacy of our users and their clients' data. This policy describes how we collect, use, store and protect personal information.

This policy complies with Law No. 19.628 on the Protection of Private Life of Chile and Meta Platforms' data protection regulations.

2.1 User data (business owner)

• Account name and email address
• Business information (name, address, phone, hours)
• Service and pricing configuration
• Messaging-platform integration credentials (access tokens)

2.2 End-customer data (business contacts)

• Name, phone and email address (when provided)
• Platform identifiers (Instagram ID, Messenger PSID, WhatsApp phone)
• Conversation and message history
• Appointment and booking history
• Notes and tags assigned by the business owner

2.3 Usage data

• Platform usage metrics (anonymized analytics)
• Artificial-intelligence usage records (tokens consumed, costs)

Data processing is based on the informed consent of the parties involved:

3.1 Business owners (Citaredy users)

By creating a Citaredy account and connecting their Meta accounts (Instagram, Messenger, WhatsApp), the user grants explicit consent for Citaredy to access and process data from their messaging platforms. This consent can be revoked at any time by disconnecting the Meta accounts from the Citaredy dashboard.

3.2 End customers (business contacts)

End customers grant implicit consent when starting a conversation with the business through Meta platforms (Instagram, Messenger or WhatsApp). By sending a message, the customer accepts that their information will be processed by the business and its authorized tools, including Citaredy.

3.3 Revoking access

Business owners can revoke Citaredy's access to their Meta data at any time by disconnecting their accounts from the dashboard settings. Once disconnected, data originating from Meta is deleted within the following 30 days (see section 9).

It is important that you understand how your data flows through our system:

• Reception: end-customer messages reach Citaredy from Meta platforms (Instagram, Messenger, WhatsApp) through secure webhooks.
• AI processing: the message content is sent to our artificial-intelligence provider, OpenAI (gpt-4o-mini), to generate automated replies. The provider processes the data and returns the responses, but does not store your customers' data to train its models.
• Storage: processed messages, along with contact data and conversation history, are stored permanently in the Citaredy database (hosted on Supabase).
• Response: AI-generated replies are sent back to the end customer through Meta platforms.

We use the information we collect to:

• Operate and maintain the virtual assistant Service
• Process and reply to customer messages using artificial intelligence
• Manage appointments and bookings
• Send appointment reminders to end customers
• Generate analytics and reports for the business owner
• Improve the quality of the AI assistant's responses
• Communicate with you about your account and the Service

Customer messages are processed by third-party artificial-intelligence models to generate automated responses. It is important that you know:

• Messages are sent to OpenAI (gpt-4o-mini) for processing and response generation
• Our AI provider has committed not to use customer data to train its general-purpose models. For more information, see their privacy policy: OpenAI's Privacy Policy.
• Chat sessions (temporary buffer): the AI conversation context is held in memory for up to 12 hours of inactivity to preserve conversation continuity. This is a temporary buffer, not permanent storage. Once the session expires, the context is reset.
• Message history (permanent storage): message content is stored permanently in our database as conversation history, accessible from the business dashboard.
• Audio transcriptions are processed and stored as text

Data is stored on secure servers provided by Supabase (cloud infrastructure) and Vercel. We implement the following security measures:

• Data isolation per business (multi-tenancy with Row Level Security)
• Encryption in transit (HTTPS/TLS)
• Webhook signature verification (HMAC-SHA256)
• Securely stored access tokens
• Rate limits to prevent abuse

We do not sell personal data. We share data only with:

• AI provider (OpenAI): for message processing
• Meta Platforms (Instagram, WhatsApp, Messenger): to send and receive messages through their platforms
• Infrastructure providers (Supabase, Vercel, Upstash): for storage and operation of the Service
• Legal authorities: when required by Chilean law

• Account data: for as long as the account is active. Upon account termination, the user has 30 days to export their data; once that period expires, all data is permanently deleted.
• Messages and conversations: for as long as the account is active
• Chat sessions (AI): the AI conversation context is held in memory as a temporary buffer for up to 12 hours of inactivity, then resets automatically. This does not affect the message history stored in the database.
• Meta Platform data: when the Meta integration (Instagram, Messenger, WhatsApp) is disconnected, data originating from Meta is deleted within the following 30 days.
• Deduplication records: 24 hours

Under Chilean Law No. 19.628 you have the right to:

• Access: request a copy of your personal data
• Rectification: correct inaccurate or incomplete data
• Deletion: request the deletion of your data (includes a prior export window of up to 30 days)
• Export: download your contact data in CSV format from the dashboard

To exercise these rights, contact us at contacto@citaredy.com. We will reply within a maximum of 15 business days.

For detailed instructions on how to delete your account and data, see Delete Account and Data.

The Service is not directed to anyone under 18. We do not knowingly collect data from minors. If we detect that we have collected data from a minor, we will delete it immediately.

We use essential cookies for the Service to function (authentication and session). We do not use advertising tracking cookies or third-party cookies for marketing purposes.

As a Meta tech provider, we comply with the data-use policies of Meta Platforms, including:

• Using user data exclusively to provide the Service
• Not sharing Meta user data with unauthorized third parties
• Deleting Meta-originated data within 30 days after the integration is disconnected (consistent with section 9)
• Complying with the 24-hour messaging window
• Never selling, licensing, or transferring Meta Platform Data to third parties

We may update this policy from time to time. We will notify significant changes by email at least 15 days in advance. The last update date is shown at the top of this document.

For questions about privacy and data protection, contact us at contacto@citaredy.com.

This privacy policy is provided in Spanish as required by Chilean law. Below is a brief summary in English for reference purposes. In case of any discrepancy, the Spanish version prevails.

Citaredy is a SaaS platform developed and operated by LEAD MEDIA SPA (Tax ID 77.218.325-9, doing business as Marketing Con Yas), based at Fresia 7500, BL 1, Dep. 103, Condominio St. Gallen, La Florida, Región Metropolitana de Santiago, Chile. Citaredy is a Meta Tech Provider to offer AI-powered virtual assistants for businesses in the beauty and wellness industry. We process messages from Instagram, WhatsApp, and Messenger on behalf of our users (business owners) using OpenAI (gpt-4o-mini) as our AI provider. We do not sell personal data, and we never sell, license, or transfer Meta Platform Data to third parties. Users can revoke Meta access at any time, and all Meta-originated data is deleted within 30 days of disconnection; deletion can also be requested via our Delete Account page. For inquiries: contacto@citaredy.com.