Privacy policy

Last updated: 2026-10-15.

This Privacy Policy explains, in as much detail as possible, what personal data we collect through this platform, where we get it from, what we use it for, who we share it with, how long we keep it, and what rights you have over it. It applies to the Cloud Quoter and the Sales Agent, and to the Offline Quoter for whoever bought it before September 23, 2026, when we stopped selling it (together, the "Service"). Business Creatives LLC, a Delaware limited liability company doing business as ISMIRO at www.ismiro.com, is the data controller for the data described here. Questions about how we handle your data? Email us at soporte@ismiro.com.

1. Scope of this policy

This policy covers the personal data we collect when you visit our site, sign up, buy, or use any of the products. It does not cover processing you carry out yourself, as the owner of your own account, over your own customers' data you load into the Service as Customer Content (name, contact info, quotes): for that data, you are the data controller toward your customers, and we act as your service provider under the data processing addendum described in Section 40 of our Terms and Conditions. This policy also does not cover third-party sites we link to, each with its own policy.

2. What data we collect

Depending on how you use the Service, we collect:

• Account data: your email, password (never in plain text, see Section 10), company name, and each team member's role (owner/seller) when you invite your team.
• Billing data: cardholder name, last digits, and country, processed directly by our payment processor: we do not store your full card number. See who processes this data by name in the service providers table in Section 25.
• Offline Quoter download record (only for whoever bought it before September 23, 2026): when you download the file, we store your IP address, a browser identifier (user-agent), and the date, as evidence for a potential payment dispute over that purchase: see Section 33.
• Content you upload: your logo, brand palette, item or price catalog, quotes you generate, and your own customers' data you include in them.
• Campaign attribution data: on your first visit we store, in a cookie, which ad or link you came from (utm_source/medium/ campaign/content/term parameters), the referring page, and your approximate country (from the network you connect from), to understand which marketing campaign works. It's your first visit that's stored: later visits don't overwrite it. If the Meta pixel is turned on for the site and only if advertising is permitted for you (Section 15), that cookie also stores Meta's click identifier (fbclid) when you arrive from a Meta ad; if you accept advertising later, your next click from a Meta ad adds it to that same cookie.
• Usage and purchase-funnel data: an anonymous visitor identifier and events such as which product page you viewed, whether you started a checkout, signed up, or purchased: to measure which part of the buying process works, not to profile you individually.
• Contact messages: if you use the contact form, we store your name, email, subject, message, language, and country.
• Reviews: if you leave a product review, it's stored with your company name and published (after moderation) visibly next to the product.
• Sales Agent conversations (once the service is active for you): the messages your own customers exchange with the agent configured for your business, so we can provide the service and you can follow up on your leads.
• Technical and device data: IP address (used for approximate country-level geolocation and fraud prevention, not stored linked to your identity beyond what's necessary for that purpose), browser type, operating system, and standard server logs for security and diagnostic purposes.
• Conversations with the support assistant: what you type in the site's help chat and the answers you receive. They are stored with your account if you are logged in, or with an anonymous identifier if you are not. The providers that process them are in Sections 8 and 25.
• Your browser's local storage: your light or dark theme preference, which never reaches a server of ours, and, if you use the support chat without being logged in, a random identifier (soporte_anon) that travels to our support server to recognize your conversation.

3. Where we get this data from

Most of the data comes directly from you: what you type when you register, configure your account, load your catalog, or write to us. We receive some data from third parties acting on your behalf or ours: our payment processor confirms the outcome of a payment to us (without giving us your full card number); your browser automatically sends technical data when you visit the site; and, if you sign up for the Sales Agent, your own customers generate data by conversing with the agent through the messaging platform you use.

If you choose to sign in with your Google account, Google (United States) confirms your email, whether it is verified, your name and an identifier of your Google account that we use only to recognize you next time. We don't receive your Google password, your contacts or any other data from that account, and we don't send Google anything about what you do in the store.

4. What we use it for, and our legal basis

We use this data to: provide the Service (create your account, process your purchase, generate your quotes, operate the Sales Agent), as necessary to perform our contract with you; communicate with you (confirmations, support, important notices about your account or price changes), also to perform the contract or meet a legal obligation; measure and improve the purchase funnel and the product, and prevent fraud and abuse, based on our legitimate interest in running and protecting a sound business, balanced against your privacy; meet legal and accounting obligations (for example, tax records of a sale); and, if the Meta pixel is active on the site, measure our ads and show you relevant advertising on other platforms, based on your consent (the site's notice or the privacy choices page; in the United States, as long as you haven't opted out; see Section 15). We do not use your data to make automated decisions producing legal or similarly significant effects on you without human review available; see Section 12 regarding the Sales Agent.

5. Cookies and local storage

We use a small number of cookies: session, attribution, visitor, consent, the email you type when logging in (lg_email, 10 minutes) and, only if you choose to sign in with Google, the two steps of that sign-in (g_oidc, 10 minutes, and g_alta, 15 minutes). If the Meta pixel is turned on, the pixel adds its own cookies (_fbp and _fbc). We also use two browser local-storage entries: your light/dark theme preference and the support chat identifier. The full detail (name, purpose, and duration of each) is in our cookie policy, which is part of this privacy policy.

6. Who we share your data with

We do not sell your data for money. We share it only with the providers we need to operate the Service, each under its own terms of service, and only so they can deliver the service we've contracted them for:

• Our payment processor: payment processing and billing data. Acts as an independent processor subject to its own privacy policy for data it processes directly (for example, your full card number, which never reaches us).
• Our transactional email delivery provider: account verification, password resets, notifications.
• Our cloud infrastructure provider: compute, database, and backups: the infrastructure the platform runs on and where your data is stored.
• Meta's messaging platforms: if you sign up for the Sales Agent, messages travel through Messenger or Instagram (and WhatsApp Business Platform once available), depending on the channel, under Meta's terms; we don't control them.
• AI model providers: the Sales Agent sends the text of each conversation, and any photos or audio the customer sends, to the providers in Section 25 to generate the reply, describe the image or transcribe the audio. The same happens with your business details when you build the agent's configuration, with its demo chat, and with what you type in the site's support assistant.

Each of these providers' real name, exact role, and the data category it handles lives in the service providers table in Section 25, so this section stays accurate even if we switch providers under Section 47.

We may also disclose data if required by law (for example, a valid court order), to protect our legal rights or the safety of our users, to investigate fraud, or in a merger, acquisition, or asset sale (notifying you as required by law and per Section 48 of our Terms and Conditions).

7. Categories of recipients under U.S. privacy laws

For purposes of laws like California's CCPA/CPRA, the categories of third parties we share personal information with are: payment processing providers, cloud infrastructure providers, transactional email providers, and, only if you sign up for the Sales Agent, the messaging platforms and AI model providers. We do not share data with data brokers or advertising networks for "sale" purposes under those laws; see Section 15 for the Meta pixel and targeted advertising while the pixel is active.

8. International transfers

Our providers process data in several countries, and the table in Section 25 lists each one's. Our infrastructure runs on Cloudflare's global network, which may mean your data is processed in data centers outside your country, including the United States. Stripe, OpenAI, Anthropic and Resend process in the United States, and Meta in the United States and other countries where it operates. The Sales Agent that answers your business's customers generates its replies with the DeepSeek API, which processes in the People's Republic of China, and, as a fallback, with OpenAI (United States). That is why your customers' conversations with your live agent are sent to China to generate each reply. The site's public demo chat and the interview you use to build your agent's configuration also use DeepSeek: what you type in that demo and the business details you load in the interview are sent to China. The site's support assistant (the help robot that appears on the site's pages and in your dashboard, and that loads from soporte.ismiro.com) also generates its replies with DeepSeek as the primary model, with OpenAI (United States) as a fallback and with Anthropic (United States) as a specialist for the more complex cases: what you type in that chat is sent to those providers, China included. If you prefer that a message not go to China, email us instead of using the chat. These transfers happen within the service contracted with each provider and under its own terms. If you access the Service from outside the United States, or your customers write to your agent from another country, you understand and agree that the data may be processed in the countries listed in Section 25.

9. How long we keep it, and backups

We keep your account data while your account is active. When you close your account, we keep it for 30 days in case you change your mind; after that we delete your data and your customers' data from our systems. We keep only what the law requires (for example, billing records). If you ask for immediate deletion, we do it within 15 days. Payment records are kept for as long as applicable tax law requires. Campaign attribution and purchase-funnel data are kept for the period stated in our cookie policy (30 and 180 days respectively) and then deleted or anonymized. If you buy, that visit's attribution (the source, medium and campaign you came from) is copied to your order and to the payment data at our payment processor, and is kept with the billing records. Each Offline Quoter download is logged with the date, IP address and browser, and each acceptance of these documents with the date, IP, browser, language and accepted text: those records are not deleted automatically because they are the evidence of delivery and acceptance in a payment dispute. Sales Agent conversations are kept while your subscription to that product is active, so you can follow up on your leads; upon cancellation, they're retained per the same criteria as the rest of your Customer Content. In addition to the live database, we run a weekly full backup, encrypted in transit, to private storage that is not publicly exposed. Those backups overwrite themselves within 35 days; until then they aren't used for anything, and if we ever restore one, we delete again what you had already removed.

10. Security

Your password is stored using a key-derivation function (PBKDF2, never in plain text). Your logged-in session is identified by a random, opaque token stored in a cookie the page's JavaScript cannot read, with a hard ceiling on how long it can stay valid even while active; you can revoke all your sessions and change your password at any time from your security panel. Our team's internal admin access is logged in an audit trail, and used only to provide support, investigate abuse, or meet legal obligations. Each company's data is isolated from every other company's at the access level: one company can never read another's data through the Service. Even so, no system is 100% foolproof; if we detect a breach affecting your data, we will notify you as required by applicable law, with the information available at that time about which data was affected and what measures we took.

11. Children's data

The Service is aimed at businesses, not underage consumers. We do not knowingly collect data from anyone under 18 through signup or purchase. If you sign up for the Sales Agent and your own end customers include minors, you (as the data controller for that data under Section 1) are responsible for ensuring the appropriate legal basis; we process that data on your instructions. If you believe a minor gave us personal data directly (for example, through the contact form), email us at soporte@ismiro.com and we will delete it.

12. Artificial intelligence and automated decisions

The Sales Agent uses third-party artificial intelligence models to generate automated responses to your customers' messages. That processing generates text content in response to a conversation; we do not use it to make automated decisions with a legal or similarly significant effect on a person (for example, it does not decide whether someone is approved or denied a service automatically and without the possibility of human review). You, as the owner of the commercial relationship with your customers, retain human control over the final business decisions you make based on those conversations. We do not use Sales Agent conversation content to train third-party models without explicit consent, beyond the processing necessary to generate each individual response in real time.

13. Aggregated and anonymous data

Beyond the personal data described above, we generate and use aggregated or anonymized data about usage of the Platform as a whole (for example, how many quotes are generated on average, or which brand palettes are chosen most often). This data does not identify a specific person or company and is not subject to the rights described in Section 16, because it is no longer personal information.

14. Marketing and your communication preferences

We may send you marketing communications about new features or products, in addition to essential transactional communications about your account. You can unsubscribe from marketing at any time using the link in each email, without it affecting your access to the Service or your receipt of transactional communications, which you cannot turn off while you have an active account.

15. Targeted advertising

No advertising pixel is active on this site today. When it's active, we use the Meta pixel to measure our ads and show you relevant advertising. Outside the United States we only load it if you accept it in the site notice or on our privacy choices page. In the United States we load it unless you opt out on that page ("Do not sell or share my data"), and never if your browser sends the Global Privacy Control signal. If you make a purchase with the pixel active and it loaded for you (because you accepted it outside the United States, or because you didn't opt out in the United States), our server also sends Meta, through its Conversions API, a notice of the purchase with your hashed email (SHA-256), IP address, browser, the _fbp and _fbc cookies, the ad click identifier and the amount, so Meta can attribute it to the right ad. Under laws like the CCPA/CPRA this may count as "sharing" data for targeted advertising; you can withdraw consent or opt out at any time from the privacy choices page.

16. Your rights

If you are a resident of a U.S. state with an applicable privacy law (such as California's CCPA/CPRA, or equivalent laws in other states), you have the right to:

• Know: what personal data we hold about you, where we got it, what we use it for, and who we share it with.
• Access / port: request a copy of your data in a portable format. Your account already includes an export button in your dashboard, with no need to wait on a manual request.
• Correct: ask us to fix inaccurate personal data we hold about you.
• Delete: ask us to delete your personal data, subject to exceptions the law allows (for example, records we must keep for tax purposes).
• Opt out of the sale or sharing of your personal data for targeted advertising. We do not sell personal data for money. No advertising pixel is active on this site today. When the Meta pixel is active, you can opt out of our sharing your data from our privacy choices page or with the Global Privacy Control signal, without it affecting your access to the Service.
• Limit use of sensitive information: we do not collect sensitive personal information categories beyond what our payment processor processes directly for payment, so in practice there is no additional use to limit.
• Non-discrimination: exercising any of these rights never gets you worse service, a different price, or lower quality.

If you live outside the U.S. and your local law grants you equivalent rights (for example, access, correction, deletion, objection, or portability under a GDPR-style regime), we honor them the same way, although we do not formally operate in the European Union today nor designate a local representative there.

17. How to exercise your rights

Email us at soporte@ismiro.com stating which right you want to exercise and the email on your account, so we can verify it's really you requesting the data. The verification process is proportional to the type of request: to export your own data from your already-authenticated account, we need no additional verification (use your dashboard); for a deletion request by email, we may ask you to confirm from the email registered on your account before processing it. You may also authorize a third party (an authorized agent) to make the request on your behalf, by telling us in writing and letting us verify that authorization. We will respond within the timeframe applicable law requires; if we decline a request, we'll explain why and how to appeal.

18. Browser "Do Not Sell" signals (Global Privacy Control)

If your browser or an extension sends a Global Privacy Control (GPC) signal or another equivalent signal recognized by applicable law, we treat it as a valid request to opt out of the sale or sharing of your personal data, with the same effect as using the corresponding button on our privacy choices page. We read it on every visit (the Sec-GPC header your browser sends) and, while it arrives, no targeted advertising loads even if you accepted it on that page before.

19. California "Shine the Light" right

If you are a California resident, California law also gives you the right to ask us, once a year and free of charge, whether we share your personal data with third parties for those third parties' own direct marketing purposes, and if so, with whom. Since we do not sell or share personal data with third parties for their own direct marketing, this request would today result in a negative answer; you can still send it to soporte@ismiro.com and we will respond all the same.

20. Links to third-party sites

The Service may include links to third-party sites (for example, informational links on the site, or the link to the messaging platform used by the Sales Agent). We are not responsible for those sites' privacy practices; we recommend reading their policy before sharing data with them.

21. State-specific U.S. notices

Besides California, other U.S. states (for example Virginia, Colorado, Connecticut, or Utah, among those that have passed comprehensive privacy laws) may grant you rights similar to those described in Section 16, with nuances specific to each law (for example, a different appeal process if we decline your request). We apply the same process described in Section 17 to any of those laws that apply to you; if you're unsure which law covers you, write to us and we'll guide you.

22. Principles guiding this processing

Beyond the section-by-section detail, we handle your personal data following these principles: (a) minimization: we collect only what we need for the purposes described in Section 4, not data "just in case"; (b) purpose limitation: we use each piece of data for the purpose we collected it for, and if we want to use it for something substantially different, we tell you first; (c) accuracy: we give you tools (your account dashboard, this contact) to correct inaccurate data; (d) storage limitation: we keep each data category only for the time described in Section 9 and the table in Section 24; (e) integrity and confidentiality: the technical measures in Section 10; and (f) transparency: this policy tries to describe the reality of the code and infrastructure as they actually work today, not a generic version of what a SaaS platform "usually" does.

23. Information we do not collect

So you know exactly where this policy's scope ends: we do not collect, and do not ask you for, sensitive personal information categories such as health data, genetic or biometric information, sexual orientation, union membership, religious or philosophical beliefs, racial or ethnic origin, criminal history, precise real-time geolocation (beyond the approximate country we infer from your IP address), or identity document numbers beyond what our payment processor may ask you directly for payment anti-fraud verification purposes, without that reaching our systems. If a future product needed any of these categories, we would update this policy before starting to collect it and, if applicable, ask for your explicit consent.

24. Data retention schedule by category

25. Subprocessor table

26. Security of billing data

When you pay at our checkout, card fields are processed directly by our payment processor: your full card number never passes through our servers or lands in our database. We only receive from it a confirmation of the payment outcome and limited billing data (cardholder name, last digits, country). This means most of the compliance scope for payment card industry standards (PCI DSS) falls on our payment processor (identified by name in Section 25), a provider certified for that purpose; we do not claim our own PCI DSS certification because, given this design, we don't handle card data in the first place.

27. Notice of new subprocessors

If we add a new subprocessor in the future that processes Customer Content substantially differently from those already listed in Section 25 (for example, a new AI infrastructure provider for the Sales Agent), we'll update that table and, if the change is significant, notify you under Section 56 before it takes effect, so you can assess its impact on your own regulatory compliance if applicable.

28. Government authority requests

If a government or judicial authority asks us for data about you, we evaluate whether the request has valid legal process before responding (for example, a court order or subpoena under applicable law). When the law allows it and there is no express legal prohibition on notifying you (such as a non-disclosure order), we notify you before handing over the data. We may push back on requests we consider overbroad, poorly founded, or contrary to law.

29. Browser "Do Not Track" signal

Some browsers offer a "Do Not Track" (DNT) signal distinct from Global Privacy Control. We don't automatically respond to the DNT signal today because there is no uniform industry standard for exactly what it means; we do, however, honor the Global Privacy Control signal under Section 18, which has a clearer legal meaning under several U.S. privacy laws.

30. Export format and technical portability

The export available in your dashboard gives you your Customer Content (catalog, quotes, team data) in a commonly used, machine-readable file format (for example, CSV or JSON depending on the data type), meant so you can import it into another tool or simply keep your own backup. If you need a different format to meet your own regulatory obligation, email us at soporte@ismiro.com to discuss it.

31. Withdrawing consent

Where processing is based on your consent (for example, the Meta pixel's targeted advertising, while the pixel is active), you can withdraw it at any time from the privacy choices page, without it affecting the lawfulness of processing carried out before you withdrew it. Withdrawing marketing consent does not cancel your account or your access to the Service.

32. Data visibility within your own team

If you invite Sellers to your Cloud Quoter account, certain information becomes visible among your team members depending on their role: an account owner sees everything a seller sees plus team administration and billing; a seller sees the catalog, quotes assigned to them, and, depending on how you configure it, other sellers' quotes. We do not decide that internal visibility beyond the two fixed roles (owner/seller) the Service offers: it's your responsibility, as the account owner, to decide who you invite and with what role, knowing what each person you add will be able to see.

33. The Offline Quoter does not send us data

Applies only to whoever bought the Offline Quoter before September 23, 2026: it is no longer sold as of that date.

It's worth stating plainly because it's the biggest difference between our products: once you download the Offline Quoter file, the quotes you generate with it (including your own customers' data you load there) are processed entirely in your browser and never travel to our servers. We have no access, no copy, and no way to see those quotes.

Two things do reach us, and neither includes the content of what you quote. First, at the moment you download the file (not every time you open it): your IP address, a browser identifier (user-agent), and the date, together with the file version delivered, per Section 73 of our Terms and Conditions. We keep that download record as evidence for a potential payment dispute over that purchase, for no other purpose. Second, every time you open the file with an internet connection within 180 days of your purchase: your license key travels to our server so the file can confirm whether your access is still active or has been revoked, per Section 5.1 of those same Terms. After those 180 days, the file stops making that check. In no case do we receive the quotes you generate or your own customers' data you load into them.

34. We do not use device fingerprinting

To prevent fraud and measure the purchase funnel we use the mechanisms described in Section 2 (cookies, visitor identifier, approximate IP address) and not "device fingerprinting" techniques that combine multiple device characteristics to persistently identify you even if you clear cookies. There is one caveat: on the signup, contact and password-recovery forms, and on login after several failed attempts, we use Cloudflare's Turnstile to tell a person from a robot. Turnstile reads signals from your browser for that check; we use it only for that, not to persistently identify you or for advertising.

35. Initial Sales Agent configuration

When you sign up for the Sales Agent, part of our team (or contractors subject to the confidentiality obligations described in Section 78 of our Terms and Conditions) accesses the information you load in your dashboard and give us to configure the agent: your catalog, brand tone, response scripts, and, once active, a reasonable sample of conversations to tune its performance. That access is limited to what's necessary to provide the service and is logged like the rest of the internal administrative access described in Section 10.

36. What we tell you if there's a security incident

If we detect a security incident we reasonably believe affected your personal data, we'll notify you by email to your account address with the information we have available at that time: the nature of the incident, what data categories may have been affected, what measures we took to contain it, and what you can do (for example, changing your password from your security panel). The timeframe for that notice is whatever applicable law requires; we do not promise a specific number of hours beyond that.

37. How we contact you

Our main contact channel is email to the address registered on your account. We do not call or text you for marketing purposes unless you've given us that contact for a specific, different purpose (for example, support you initiated yourself through another channel).

38. Retention of published reviews

A review you left and that we published after moderation may remain visible next to the product even after you close your account, because it's public content you chose to publish, unless you expressly ask us to remove it by emailing soporte@ismiro.com.

39. Effect of closing your account on your team's data

If you close your company's account, the data of the Sellers you invited (their email, role, activity within your account) is retained along with the rest of the account's data per the same retention cycle described in Section 9, because it's part of your company's operation, not independent personal accounts for each seller.

40. Language of this policy

This policy is offered in Spanish and English. If there's a conflict in interpretation between the two versions, the version in the language in which you first accepted our Terms and Conditions prevails, unless applicable law requires otherwise.

41. Pseudonymization and anonymization

We use two different techniques depending on the case. Pseudonymization: your visitor identifier ("vid" cookie) is an opaque value that, on its own, doesn't directly identify you, but that we could link to your account if you register and log in from the same browser: it's still personal information under most privacy laws, because a reasonable path to re-identification exists. Anonymization: the aggregated data described in Section 13 (for example, usage averages across all accounts) is processed so there is no reasonable path back to a specific person or company; once anonymized, we no longer treat it as personal information.

42. Data of individuals within a business account

Although the Service is designed for businesses, "personal information" under this policy refers to the data of the individuals involved: you as the account owner, each Seller you invite, and your business's end customers whose data you upload or who converse with the Sales Agent. Your company's name and general contact details as an entity (for example, the legal business name shown on a quote) are not, by themselves, personal information about an individual, unless they happen to match an individual's name (for example, if you're a sole proprietor and your business name is your own name).

43. Our own analytics, not third-party

The purchase-funnel measurement described in Section 2 (which page you viewed, whether you started checkout, whether you purchased) is built and stored by us, on our own infrastructure. We do not currently use third-party analytics tools like Google Analytics for that internal measurement; if we add a third-party analytics tool in the future, we'll update this policy and the cookie policy before turning it on.

44. Periodic review of this policy

Besides updating this policy when something concrete changes about how we handle your data, we review it periodically to verify it still accurately describes what the production code does. If you find a description that seems inaccurate about how the Service actually works, we'd appreciate you flagging it to soporte@ismiro.com.

45. Your IP address, in detail

We use your IP address for two limited purposes: (a) inferring your approximate country, both to show the reference price in your local currency and for campaign attribution and funnel measurement; and (b) as one signal among others to prevent fraud (for example, mass-signup patterns from the same address range). We also log it specifically when you download the Offline Quoter, per Section 33. We do not keep a geolocated history of your visits beyond what's necessary for those purposes, nor do we use it to track your precise physical location.

46. Encryption in transit and at rest

Connections to our site, your dashboard, and our API use encryption in transit (HTTPS/TLS): your credentials and data never travel in plain text across the internet between your browser and our servers. At rest (that is, while data is stored) we rely on the storage encryption measures of our cloud infrastructure provider (identified by name in Section 25), whose platform the Service runs on. In addition, your password specifically is never stored in plain text under any circumstance: it is always processed with the key-derivation function described in Section 10.

47. Changes in infrastructure provider

Today we build the Service on a cloud infrastructure provider (compute, database, and backups), a payment processor, and a transactional email delivery provider: all three identified by their real name in the Section 25 table. If we change any of these core providers in the future, we will require data protection guarantees at least equivalent to those described in this policy, and we'll update Sections 6 and 25 before the change takes effect, notifying you if the change is significant under Section 56 of this policy.

48. Inquiries from minors through the Sales Agent

If you operate the Sales Agent in a sector where it's foreseeable that a minor might message it (for example, inquiring on behalf of an adult family member, or by mistake), the agent responds the same as to any other message per its configuration: it has no special logic to detect the age of who's writing. As the owner of the relationship with your customers under Section 62 of our Terms and Conditions, you are responsible for any additional handling your jurisdiction requires when you reasonably know you're interacting with a minor.

49. Our own professional advisors

We may share limited personal data with our own legal, accounting, or financial advisors, when necessary for them to advise us (for example, an accountant who needs to see billing records for a tax filing, or a lawyer reviewing a claim). Those advisors are bound by their own professional confidentiality obligations and only access what's necessary for the specific task we've asked of them.

50. Due diligence in a potential merger or sale

If we evaluate a merger, acquisition, or asset sale, we may share a limited set of data (prioritizing aggregated or anonymized data where possible) with the other party's advisors, under confidentiality agreements, so they can assess the transaction. If the transaction closes, your data transfers to the new owner under Section 48 of our Terms and Conditions and remains protected by this policy (or its update, if we notify you of a change) unless shown otherwise.

51. Primary territorial scope of this policy

This policy is written primarily with the U.S. legal framework in mind, particularly CCPA/CPRA-style state privacy laws, because that's where we first operate commercially. If your jurisdiction has a different regime (for example, a GDPR-style regime) and it applies to you, we honor equivalent rights under Section 16, even though this policy's language isn't formally organized as a complete GDPR notice (for example, we do not currently designate a data protection officer or an EU representative). The rights, deadlines and authorities for each Latin American country where we sell are in the annex in Section 58.

52. Data we receive about payment disputes

If you open a payment dispute (chargeback) with your bank or card issuer, our payment processor notifies us that a dispute exists and its status (open, won, lost), but does not give us access to your bank's internal investigation. We use that data solely to apply what's described in the dispute policy of our Refund Policy (suspension while it's resolved, reactivation if resolved in your favor) and for our own fraud-prevention records under Section 4.

53. How we record your consent when required

When processing requires your consent, we record what you chose and when, so we can demonstrate it was properly obtained if needed. The acceptance checkbox for the Terms and this policy, at signup and at checkout, is stored on our servers with the date, IP address, browser, language, document version and the exact text you checked. Your targeted advertising choice on the privacy choices page is stored in a cookie in your browser (consent), not on our servers. We do not infer consent from your silence or from continuing to use the Service without having checked the relevant box when that box is mandatory to proceed.

54. Relationship between this policy and our Terms

This policy is incorporated into our Terms and Conditions by reference, as stated in Section 36 on order of precedence: in case of a direct conflict between a privacy clause in the Terms and this policy, this policy controls on the specific subject it governs. Outside of such conflicts, both documents are read together.

55. Basis for these descriptions

Every statement in this policy about what we collect, how we protect it, and how long we keep it describes the actual behavior of our code and infrastructure as of the update date shown above, not a generic template of what a similar platform "usually" does. If the Service changes in a way that makes this description inaccurate, we commit to updating this policy under Section 56, not to leaving an outdated description in place.

56. Changes to this policy

We may update this policy to reflect legal or Service changes. If the change is material (for example, if we start sharing data with a new category of third party, or turn on the Meta pixel or add another advertising platform) we'll notify you by email or a visible notice on the site before it takes effect.

57. Contact

Questions about this policy or your data? Email us at soporte@ismiro.com.

Business Creatives LLC (Delaware, USA) · ISMIRO

58. Country annex (Latin America)

This annex completes section 16 for people who live in the countries where we sell. In all of them, the controller of your account data is Business Creatives LLC, domiciled in the State of Delaware, United States, and the channel to exercise any right is soporte@ismiro.com. We answer within the deadline your country's law sets or, if shorter, the one stated below. The data of end customers who chat with a business's Sales Agent is handled by that business as controller and by us as processor (see the Data Processing Agreement at /en/legal/dpa): those people can write to the business or to us, and we pass the request on to the business.

Mexico

The 2025 Federal Law on the Protection of Personal Data Held by Private Parties applies. You have the rights of access, rectification, cancellation and opposition (ARCO rights), and may revoke your consent. We communicate our decision within 20 business days of receiving your request and, if it applies, carry it out within the following 15 business days. The competent authority is the Secretaría Anticorrupción y Buen Gobierno, which took over INAI's functions.

Colombia

Law 1581 of 2012 (habeas data) and Decree 1377 of 2013 apply. You may know, update and correct your data, request proof of your authorization, be informed of how we use it, revoke the authorization or request its deletion. We answer inquiries within 10 business days and claims within 15 business days. After claiming with us you may go to the Superintendencia de Industria y Comercio (SIC).

Peru

Law 29733 and its Regulation, Supreme Decree 016-2024-JUS, apply. You have the rights of access, rectification, cancellation, opposition and portability. We resolve opposition requests within 10 business days and the rest within the Regulation's deadlines. The authority is the National Authority for Personal Data Protection of the Ministry of Justice and Human Rights.

Argentina

Law 25,326 applies. We answer access requests within 10 calendar days and rectification, update or deletion within 5 business days. The authority is the Agencia de Acceso a la Información Pública (AAIP), which handles complaints.

Chile

Until November 30, 2026, Law 19,628 applies. From December 1, 2026, Law 21,719 is in force: it adds the rights of opposition, portability and not to be subject to decisions based solely on automated processing, and creates the Agencia de Protección de Datos Personales, where you may file complaints. We honor those rights starting now.

Guatemala and the rest of Central America and the Caribbean

Guatemala has no general private-sector data protection law today: we give you the same rights as everyone else. In Costa Rica, Law 8968 applies (authority: PRODHAB); in Panama, Law 81 of 2019 (authority: ANTAI); and in the Dominican Republic, Law 172-13.

Brazil and the European Union

We do not currently direct the Service to Brazil or the European Union. If we ever do, we will publish the corresponding annex (LGPD and GDPR) before starting.

59. Data we receive from Meta's platforms

When you connect a Facebook Page, an Instagram professional account or a WhatsApp Business account to the Sales Agent using Meta's login, we receive only what you authorize on that screen:

• Your name and your Meta user identifier.
• The names and identifiers of the Pages, Instagram accounts and WhatsApp Business accounts you choose to connect.
• The access tokens that let us receive and answer messages on those accounts on your behalf.
• Once connected, the messages your customers send to those accounts and the agent's replies, with the name, identifier, profile picture and, on WhatsApp, the phone number that the platform shares about the person writing.

We use this data only to provide the service you signed up for: receiving and answering messages, showing you the conversations and leads in your dashboard, and notifying you about them. We don't sell it, we don't use it for advertising or to build profiles of people, we don't use it to train our own artificial intelligence models, and we don't share it with anyone beyond the subprocessors in section 25 that are needed to answer. We handle it in accordance with Meta's Platform Terms and Developer Policies. Access tokens are stored with the measures in section 46 and are never shown in the dashboard.

We keep conversations as described in section 24, and tokens for as long as the account stays connected. You can remove our access at any time from Facebook, Instagram or your Meta business portfolio, and ask us to delete what we already received, as explained in Data deletion. This section does not change anything about the Meta pixel, which is governed by section 15.