Privacy policy
Version 1.1 · Last updated: November 2, 2026. It explains what personal data we process when operating MBA, why, who we share it with, for how long, and what you can do about it. Read it together with the Terms and conditions.
1. Who is responsible
GLOBAL COMMERCE ONLINE SRL, located at Papiros 7085, Montevideo, Uruguay (ZIP 7100), tax ID (RUT) 100795840019 (“Global Commerce”). Privacy contact: support@globalcommerce.uy.
2. Two different roles
- As controller: we process the data of panel accounts (the person who administers the business and their team), payment and billing data and technical data about the use of the service. We decide what for and how.
- As processor, on behalf of your business: we process the data of your end customers (those who message your Agent on WhatsApp) to provide the service to you. Your business is the controller: it decides what the data is used for, must inform those people and have a legal basis. We only process the data following your instructions.
3. What data we process and where it comes from
Data you or your team give us
- Account: first name, last name, email and password (we do not see the password: our access system stores it, encrypted), role and the business you belong to. If you sign in with Google, we receive your Google identity (name and email).
- Business: company name, contact phone.
- Record that you confirmed you are of legal age (who, when, minimum age).
- Agent configuration: business information, frequently asked questions, tone, rules, files, addresses of your systems and their access keys (stored encrypted and never shown again).
- People on your support team you invite to the Helpdesk: first name, last name and email.
- Messages you send us through the contact or support form.
Data we receive from Meta when you connect your WhatsApp account
- Identifiers of your WhatsApp Business account and number, and the permission (token) you give us to operate it, which we store encrypted.
- Usage and template information from your account, which we query when you open those screens, if the Agent’s payment is confirmed.
Your end customers’ data (as processor)
- Phone number and messages. By default MBA acts as a connector with Meta: we do not store the text of conversations, which live in WhatsApp. If you ask us to (for example, when using the Helpdesk or to analyze conversations), we store the data you request, for the period set out in section 7. We keep a record of each conversation’s life cycle with a fingerprint of the phone (not the number), the time of the milestones, the origin (ad, template or organic), the topics (general labels, not the message) and how many messages each party sent, without their text.
- Contacts: if you use the dashboards or the Helpdesk, for each contact we store their phone number and WhatsApp profile name (both encrypted), the phone fingerprint, when they first and last wrote, how many conversations and messages they had and how they first arrived. We use them to show you your contacts and dashboards and so you can take them to your CRM, and for nothing else. Only the Owner and Admins see them in full; the other roles see them anonymized.
- If message capture is turned on, the incoming message (phone and text) is stored encrypted for 7 days as a step before anonymizing and counting it.
- If you use the Helpdesk, the history of the conversations handed over (phone, messages and tickets) is stored in the support system so your team can answer them.
Technical data
- Service logs and error reports, without personal data, and session data. We use no third-party analytics or advertising.
Payment data
- Payment is processed by an external provider through our billing system. We do not see or store your full card number or security code. We keep which Agent was paid and when; the receipts are kept by billing.
4. What we use it for and the legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage your account, give access to the panel and your team | Account, business, roles | Performance of the contract |
| Configure, publish, test and activate your Agent | Configuration, files, keys, WhatsApp connection | Performance of the contract |
| Show usage, metrics and templates | Meta data, conversation life-cycle record | Performance of the contract |
| Handle conversations with people on your team (Helpdesk) | History and end customer data | Customer’s instruction (processor) |
| Charge for the service and meet tax obligations | Payment, billing | Contract and legal obligation |
| Security, fraud and abuse prevention, troubleshooting | Logs, technical data | Legitimate interest |
| Verify legal age | Age record | Legal obligation and legitimate interest |
| Answer inquiries and support | Contact messages | Performance of the contract and legitimate interest |
| Service notices (sign-up, account closure, changes) | Performance of the contract | |
| Show your contact list, tell new from returning contacts and let you take them to your CRM | Phone and name (encrypted), fingerprint, dates, counts and origin | Customer’s instruction (processor) |
| Show what your customers talk about (topics) | Topic label of each conversation (not the message) | Customer’s instruction (processor) |
We do not use your data or your end customers’ data for advertising, commercial profiling or to train artificial intelligence models, and we do not sell it.
5. Who we share it with
Only with those needed for the service to work:
- Meta, to run your Agent and operate your WhatsApp Business account. What you publish and the conversations are subject to Meta’s terms and privacy policy.
- Amazon Web Services, which hosts our database, the service and the panel.
- Our payment provider, through Global Commerce’s billing system.
- Sentry, to detect errors, without personal data.
- Google, if you choose to sign in with Google, and for the fonts loaded by the sign-in screen.
- Email providers for service notices.
- The people on your team you give access to, according to their role.
- Authorities, when a law or court order requires it.
We work with providers that offer data protection terms. If Global Commerce merges or transfers the business, the data will pass to the new owner with the same protections.
6. International transfers
Our database and service are on AWS, US East region (us-east-1), and Meta operates from the United States. By using the service your data is transferred to that country, and we adopt reasonable technical and contractual measures to protect it.
7. How long we keep it
| What | Period |
|---|---|
| Account and business configuration | While the account is active |
| Conversation life-cycle record (fingerprint, milestones, counts) | 90 days |
| Contacts (phone and name encrypted, dates and counts) | While you use the service with that Agent; deleted when the Agent is deleted or the account is closed (after their periods), or sooner if you ask us |
| Messages captured from the webhook, encrypted | 7 days |
| Failed pending forwards | 7 days |
| Helpdesk history and tickets | Until the Agent is deleted or the account is closed |
| Deleted Agent | 30 days to restore it; then it is deleted |
| Closed account | 30 days to reopen it; then the business’s and its end customers’ data are deleted; deletion is completed after 90 days |
| Minimum record after deletion (sign-up, payment, usage in counts, users with their role, deletion) | 90 days |
| Payment and billing receipts | The period required by law |
| Backups and technical logs | A limited period, renewed with normal use of the service |
Closing the account with us does not delete what you already published in your Meta account or disconnect your number: that remains under your control in Meta.
8. Security
Encryption of credentials, Meta tokens and the keys of your systems; encrypted traffic; end customers’ phones are stored as a fingerprint or encrypted; each account is separate and each request is validated against the account making it; access restricted to the team that operates the service; roles within your business. No system is infallible. If there is a breach affecting your data, we will notify you without undue delay and, where applicable, within 72 hours, and we will inform the supervisory authority.
9. Your rights
You can ask us to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format and withdraw your consent when it is the basis for processing. To exercise them, write to support@globalcommerce.uy. If you ask for a copy of your data, the request reaches us by email and we deliver it within one week at most. We answer other requests within a reasonable time and within the periods set by applicable law. If you are not satisfied, you can complain to the data protection authority of your country (in Uruguay, the Personal Data Regulatory and Control Unit).
If you are an end customer of a business that uses MBA, your rights over your data are handled by that business, which is the controller; we can help it do so. If you write to us, we will tell you how to contact it.
10. Artificial intelligence
The Agent is an artificial intelligence assistant operated by Meta. Some data (for example, conversations or the Agent’s metrics) may be analyzed with artificial intelligence tools only if the customer asks for it, for the purpose it requests and on the data it indicates; without that request we do not analyze them with AI. We do not make decisions with legal effects on people based solely on automated processing. When a person asks to talk to someone, or the Agent cannot resolve the matter, the conversation may be handed to a person on the business’s team if you turned on the Helpdesk. Businesses must inform their customers that they are talking to an AI assistant when the law requires it.
11. Cookies and browser storage
We use what the panel needs to work: session and sign-in security cookies, your language, your theme (light or dark) and, in your browser, the draft of what you configure, without API keys. We do not use analytics or advertising cookies. The Meta and payment windows, when they open, may use their own.
12. Minors
The service is for people aged 18 or over only. If we learn that an account belongs to a minor, we close it.
13. Changes
If we change this policy in a way that affects you, we will notify you before it takes effect. The date above shows the last modification.
14. Contact
GLOBAL COMMERCE ONLINE SRL · Papiros 7085, Montevideo, Uruguay (ZIP 7100) · RUT 100795840019 · support@globalcommerce.uy
Appendix: suggested text to inform end customers
Each business must inform the people who message its Agent. Starting text, which the business adapts:
You are talking to an artificial intelligence assistant of [business name]. Your messages are processed to answer you and, if you ask or it is needed, a person on our team may assist you. [Business name] may store your number and WhatsApp profile name to keep a record of its contacts. [Business name] is responsible for your data; you can exercise your rights at [business contact]. WhatsApp and Meta process your messages according to their own policies.