Privacy Policy

1. Who we are

Vibranty SAS is a company domiciled in Medellín, Antioquia, Colombia, with registered address at Cra. 42 # 59-18. We operate the Vibranty platform, which designs, hosts, and runs conversational AI agents on WhatsApp Business for small and medium-sized businesses (SMBs) across Latin America.

Our Data Protection Officer (DPO) can be reached at hola@vibranty.co.

2. Scope of this policy

This policy applies to:

• Visitors of the vibranty.co website.
• SMB customers who contract Vibranty to operate a WhatsApp bot ("Customers").
• People who write to a WhatsApp number operated by Vibranty for a Customer ("End Users").
• People who receive bot previews shared by our operators at /preview/<token>.

3. Roles: Data Controller and Data Processor

In accordance with Colombian Statutory Law 1581 of 2012 and equivalent rules across LATAM:

SMB Customer = Data Controller

The SMB using Vibranty to talk to its own customers defines the purposes and means of processing its End Users’ data.

Vibranty = Data Processor

Vibranty processes End User data on behalf of the SMB Customer, following the documented instructions in the service contract and this policy.

Site visitors and leads = Vibranty as Controller

For data we collect directly (contact forms, signup, site browsing), Vibranty acts as the Data Controller.

4. Data we collect

4.1 SMB Customer data

• Identification data: name, email, legal name, tax ID, industry.
• Contact data: phone number, business address.
• Account data: hashed credentials, preferences, bot configuration.
• Billing data: payment method, billing address, transaction history.
• Operational data: bot configuration, uploaded knowledge base (PDFs, sheets, URLs), flow templates.

4.2 End User data (WhatsApp conversations)

• WhatsApp phone number (E.164 format).
• WhatsApp profile name (when the user exposes it).
• Content of messages exchanged with the bot and, in case of handoff, with a Vibranty human operator.
• Attachments (images, documents, audios, location) if the user sends them.
• Conversation metadata: timestamps, delivery status, classified intent, knowledge-base retrieval, tool calls (e.g. book an appointment, search the catalog).
• For the medical vertical: basic data to schedule appointments (name, reason for visit, preferred time). Vibranty does not request or store medical history.

4.3 Website browsing data

• IP address and approximate geographic location.
• Device type, operating system, and browser.
• Pages visited, session duration, referrer.
• Technical and analytics cookies (see section 12).

5. Legal basis for processing

We process personal data under the following legal bases recognized in the region:

• Performance of a contract (Law 1581/2012 CO art. 10 lit. c; LGPD BR art. 7 V; LFPDPPP MX art. 9): to deliver the contracted service to the SMB Customer.
• Prior, express, and informed consent (Law 1581/2012 CO art. 9; LGPD BR art. 7 I; Law 25.326 AR art. 5): for End Users who start a conversation with the bot, for Customer marketing, and for non-essential cookies.
• Legitimate interest (LGPD BR art. 7 IX): to improve service quality, prevent fraud, and ensure security.
• Compliance with legal obligations: tax filings, withholdings, and responding to requests from competent authorities.

6. Purposes of processing

We use data exclusively to:

• Provide, operate, and improve the Vibranty service (Bot Studio + Managed Contact Center).
• Generate bot responses using language models and retrieval-augmented generation (RAG).
• Execute agreed business actions: book appointments on Google Calendar, capture orders, search the catalog.
• Allow a Vibranty human operator to take over the conversation when the bot escalates (handoff).
• Invoice and charge the SMB Customer’s subscription.
• Detect, prevent, and respond to abuse, fraud, or security incidents.
• Meet legal obligations and respond to authority requests.
• Service communications (technical notices, contractual changes) and, with separate consent, commercial communications to the Customer.

7. Prohibited use: marketing and training

We do not use End User conversations for:

• Direct marketing to the End User by Vibranty.
• Training our own or third-party AI models with the specific content of the conversation.
• Selling, renting, or sharing personal data with third parties for commercial purposes.

Providers that process data (e.g. OpenAI) operate under contractual clauses that prohibit using inputs to train their public models.

8. Processing of minors’ data

Vibranty’s services are aimed at adults (in Colombia, 18 years and older). We do not intentionally request or collect minors’ personal data. If we detect that a minor is chatting with a bot, the SMB Customer is responsible for obtaining authorization from the legal guardian before continuing the processing, in line with Decree 1377/2013 and Colombian Law 1098/2006.

9. Who we share data with

We do not sell personal data. We share data with processors who help us deliver the service, under data-processing agreements:

Meta Platforms (WhatsApp Business Cloud API)

To send and receive WhatsApp messages. United States. Subject to Meta’s privacy policies.

OpenAI

To generate bot responses (LLM), transcribe audio (Whisper), and create vector embeddings. United States. Inputs are not used for training.

Amazon Web Services (AWS)

For infrastructure hosting, file storage (S3), and compute. Regions us-east-1, us-east-2, and eu-west-1. ISO 27001 and SOC 2 compliant.

Google (Google Calendar API)

Only for Customers who enable the calendar integration. To create and manage calendar events.

Payment providers

Approved payment processors to charge the SMB Customer’s subscription.

Vibranty (human operators)

Internal Vibranty staff access conversations to take handoffs, monitor quality, and provide support. Subject to confidentiality obligations.

Competent authorities

When a valid legal request is issued by a competent authority (judicial, tax, data-protection).

10. International data transfers

Some processors are located outside Colombia and LATAM, primarily in the United States (OpenAI, Meta) and Ireland (AWS eu-west-1). We rely on the following mechanisms:

• Contractual clauses ensuring protection levels equivalent to Colombian regulation (Law 1581/2012) and applicable LATAM rules.
• For Brazil: compliance with LGPD art. 33 (international transfers with safeguards).
• For Argentina: compliance with Law 25.326 art. 12 and DNPDP rulings.
• For Mexico: contracts with standard clauses under LFPDPPP and its Regulations.

By using the service or chatting with a bot, you authorize these transfers under the terms described.

11. Data retention

We retain data only for as long as needed to meet the purposes described, with the following maximum periods:

Active WhatsApp conversations

90 days in operational storage (MySQL) for support, quality, and handoff.

Archived conversations

Up to 24 months in cold storage (S3 Glacier) for audit, legal defense, and service improvement. Encrypted at rest.

SMB Customer data

While the subscription is active and for the periods required by Colombian tax law (10 years for accounting and electronic invoicing supporting documents).

Technical and security logs

Up to 12 months.

Data deleted on request

Immediate logical deletion + hard deletion (including backups) within 90 days, except for mandatory legal retention (e.g. tax documents).

12. Cookies and similar technologies

On vibranty.co we use cookies and similar technologies for the following purposes:

• Strictly necessary cookies: session, security, language preferences. No consent required.
• Analytics cookies: measuring aggregate traffic and behavior. Consent required.
• Marketing cookies: measuring campaign effectiveness. Explicit consent required.

You can manage your preferences from the cookie banner and from your browser settings.

13. Security measures

We apply reasonable technical, administrative, and organizational measures to protect data against unauthorized access, loss, alteration, or disclosure. These include:

• Encryption in transit (TLS 1.2+) on all communications.
• Encryption at rest for databases and file storage.
• Tenant isolation (multi-tenant with logical workspace segregation).
• Role-based access control for internal operators.
• Access auditing and security-event logging.
• Hosting on AWS, ISO 27001 and SOC 2 Type II compliant.
• Internal incident-response policy and continuity plan.

In the event of an incident affecting personal data, we will notify the Colombian Superintendencia de Industria y Comercio (SIC) and the affected data subjects within the applicable legal deadlines.

14. Your rights (Habeas Data, ARCO, LGPD)

As a data subject, you have the following rights:

Access

Know what data we process about you, for what purposes, and with whom we have shared it.

Rectification

Request correction of inaccurate, incomplete, or outdated data.

Cancellation / Deletion / Erasure

Request deletion of your data when it is no longer necessary, when you withdraw consent, or when it has been processed unlawfully.

Objection

Object to processing when no consent applies, when not necessary for a contract, and when no legal obligation exists.

Portability

Request delivery of your data in a structured, commonly used format (especially under LGPD Brazil).

Withdrawal of consent

Withdraw authorization at any time, without retroactive effect.

Information

Receive information about how your data is used and the consequences of not providing the requested information.

15. How to exercise your rights

To exercise any of the rights above, send your request to hola@vibranty.co indicating:

• Your full name and contact details.
• A valid ID (to verify your identity).
• The specific right you wish to exercise.
• The information or data your request refers to.

We will respond within a maximum of 15 business days from receipt of the request, in line with art. 14 of Law 1581/2012 and Decree 1377/2013. If your request concerns a bot operating for an SMB Customer, we may coordinate the response with that Customer as the Data Controller.

If you do not receive a satisfactory response, you can file a complaint with the SIC in Colombia, the ANPD in Brazil, the AAIP in Argentina, or the INAI in Mexico, as applicable.

16. Data deletion

For detailed data-deletion processes (including the URL for Meta users), see our dedicated Data Deletion page at /data-deletion.

17. Changes to this policy

We may update this policy to reflect legal, technical, or operational changes. When changes are material, we will notify you by email (for Customers) and publish the updated version on vibranty.co with the "Last updated" date at the top of the document. Continued use of the service after the changes take effect implies acceptance of the updated version.

18. Contact

For any inquiry about this policy or about the processing of your personal data, contact us: