Privacy Policy

This policy explains how Vortex303 handles personal data, in particular when businesses use our WhatsApp customer-service agents and CRM (PeopleSpot), which run on the official WhatsApp Business Platform (Cloud API) provided by Meta.

1. Who we are

Vortex303 is a software studio based in Buenos Aires, Argentina. Contact: hello@vortex303.com.

2. Our role

When a business (our client) connects its WhatsApp Business account to our service, the client decides why and how its customers' data is used. The client is the data controller; Vortex303 acts as a data processor (in Argentine law, a provider of data-processing services) and processes that data only on the client's instructions and to provide the service.

For data about our clients themselves (account holders, billing contacts), Vortex303 is the controller.

3. Data we process

• Client account data: name, email, business name, phone number, WhatsApp Business account and phone-number identifiers, access tokens issued by Meta.
• End-customer data, on behalf of clients: WhatsApp phone number, profile name, message content (text, media and metadata), conversation history, and CRM records the client creates (e.g. notes, appointments, tags).
• Technical data: logs needed to operate, secure and debug the service (timestamps, IP addresses, error reports).

We do not use cookies for advertising or tracking.

4. How we use it

• To receive and send WhatsApp messages for the client through Meta's WhatsApp Business Platform.
• To generate replies with an AI agent configured by the client. The agent is limited to answering questions about that client's business (products, services, bookings, support) and hands conversations to a human when needed.
• To show conversations and contacts in the client's CRM inbox.
• To secure, maintain and improve the reliability of the service.

We do not sell personal data, do not use it for advertising, and do not use client or end-customer data to train AI models.

5. Service providers (sub-processors)

• Meta Platforms — WhatsApp Business Platform (Cloud API), message delivery.
• Anthropic — Claude AI models used to generate agent replies. Data sent through the API is not used to train their models.
• Hosting and database providers (e.g. Fly.io, Neon, Vercel, Cloudflare) — infrastructure that stores and runs the service.

These providers may process data outside Argentina. We use providers that offer appropriate safeguards for international transfers.

6. Retention

We keep client and end-customer data for as long as the client's account is active, or until the client deletes it. After a client disconnects or closes their account, we delete their data within 30 days, except where the law requires us to keep it longer (e.g. billing records). Technical logs are kept for up to 90 days.

7. Security

Data is encrypted in transit (TLS) and at rest. Access tokens are stored encrypted, each client's data is isolated from other clients, and staff access is limited to what is needed to operate the service.

8. Your rights

Under Argentina's Personal Data Protection Law No. 25,326 (and, where applicable, the EU GDPR), you can request access to, correction of, or deletion of your personal data, and object to its processing. If you are a customer of a business that uses our service, please contact that business first; we will assist them. You can also write to us directly at hello@vortex303.com, and we will reply within 10 business days for access requests and 5 business days for corrections or deletions, as required by Law 25,326.

The Agencia de Acceso a la Información Pública, as the enforcement authority of Law 25,326, handles complaints regarding breaches of personal data protection rules.

See also: how to request data deletion.

9. Children

The service is for businesses and is not directed to children under 13.

10. Changes

We will post any changes on this page and update the date above. Material changes will be notified to clients by email.