Privacy Policy

1. Information We Collect

We may collect the following categories of information:

• Account & Identity Data: Name, email address, company name, and role when you register or contact us.
• Usage & Interaction Data: Prompts, queries, agent actions, session logs, and outputs generated through the platform.
• Technical Data: IP address, browser type, device identifiers, operating system, referral URLs, and access timestamps collected automatically via logs and cookies.
• Integration Credentials: OAuth tokens or API keys you provide to connect third-party services (stored encrypted; never read in plaintext by our staff).
• Communications: Emails, support tickets, and feedback you send to us.

2. How We Use Your Information

We use collected information to:

• Provide, operate, and improve the Service and its agentic capabilities.
• Authenticate users and secure access to accounts.
• Process and execute agent workflows on your behalf.
• Monitor platform performance, detect abuse, and ensure security.
• Communicate with you about updates, incidents, or support requests.
• Comply with applicable legal obligations.

We do not sell your personal data to third parties, and we do not use your data to train AI models without your explicit written consent.

3. Google User Data

If you choose to connect your Google account, Agentic requests only the permissions needed to run the tasks you configure. You grant each permission explicitly during the Google consent screen, and you can revoke them at any time from your Google Account permissions page.

• Gmail: to read and classify incoming email, apply labels, and draft replies for your review. Agentic never sends email without your explicit approval.
• Google Calendar: to read availability and create, update or cancel events when you ask an agent to schedule a meeting.
• Google Drive: to read the documents you point an agent to, and to write back the summaries and extracted data it produces.
• Google Sheets: to list the spreadsheets in your Drive so you can choose which ones an agent uses, and to read and update the ones you connect as a data source. To build that list Agentic reads file names and metadata only — never the contents of files you have not connected.

Agentic's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: we use Google user data only to provide and improve the features you have explicitly requested; we do not transfer it to third parties except as needed to provide those features, for security purposes, or to comply with applicable law; we do not use it for advertising; we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or when the data is aggregated and anonymized; and we do not use it to train generalized AI models. Google user data is deleted when you disconnect the integration or delete your account, following the retention terms in the section below.

4. Legal Bases for Processing (GDPR / Colombian Law 1581)

Where applicable, we process your personal data under the following legal bases:

• Performance of a contract: Processing necessary to deliver the Service you have requested.
• Legitimate interests: Security monitoring, fraud prevention, and service improvement.
• Consent: For optional features such as analytics or marketing communications, where we request your explicit consent.
• Legal obligation: Where we are required to process data by law.

5. Sharing of Information

We may share your information with:

• Service providers: Cloud hosting, database, and infrastructure vendors operating under strict data processing agreements (e.g., AWS, Google Cloud).
• AI model providers: Third-party AI APIs (such as Anthropic) that process inputs on behalf of the Service. These providers operate under their own privacy policies and do not retain your data for model training without consent.
• Legal authorities: When required by valid legal process, court order, or to protect the rights and safety of users or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction with appropriate notice.

We do not share personal data with advertisers or data brokers.

6. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. Interaction logs and agent session data are retained for a maximum of 12 months unless a shorter period is requested by you or required by law. After account deletion or a verified data deletion request, your personal data is permanently removed within 30 days, except where retention is required by applicable law.

7. Cookies & Tracking Technologies

We use essential cookies required for authentication and session management. We may use analytics cookies (with your consent) to understand how users interact with the Service. You can manage cookie preferences through your browser settings or our in-platform consent banner.

8. Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, access controls, and regular security reviews. No system is completely secure; we encourage you to use strong, unique passwords and to report any suspected security issues to [email protected].

9. International Data Transfers

Asisteme AI operates across Colombia and the United States. Your data may be transferred to and processed in servers located in either jurisdiction. For users in the European Economic Area, such transfers are subject to appropriate safeguards (Standard Contractual Clauses or equivalent mechanisms).

10. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal data (see our Data Deletion page).
• Restrict or object to certain processing activities.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

11. Children's Privacy

The Service is intended for business users and is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or an in-platform notice at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.