Privacy Notice

Identity and address of the controller

Mario Humberto Gutiérrez Morales, a natural person with business activity in Mexico, is responsible for the processing of personal data related to the own websites and services Vchat by Studio Vainilla. Vchat is the software-as-a-service (SaaS) platform developed and commercially operated by Studio Vainilla; it is not presented as an independent commercial company.

Contact business address published: Paseo Simón Bolívar nº 115, Zona Centro, C.P. 31000, Chihuahua, Chihuahua, México. For requests regarding personal data, please write to the official email of the responsible party: hola@studiovainilla.com.

The responsible party's website is www.studiovainilla.com and the platform site is vchat.com.mx. This notice covers the data that we process directly when providing Vchat, registration, billing, support and operation of the service, and separately explains the data processing that user companies incorporate into their workspaces.

Personal Information We May Process

The information processed depends on the relationship with Vchat and the functions actually activated:

• Identification and contact: name, company, position, email address, phone number, country and city.
• Accounts and service: Protected credentials, roles, department, workspace configuration, plan, subscriptions, and support requests.
• Payments and billing: tax data, payment references and subscription information; card details may be processed by payment providers and not by Vchat directly.
• Technical information: IP address, browser, device, security logs, sessions, technical errors, and preferences.
• Messaging and integrations: messages, contact and conversation identifiers, dates, source channel, name, profile photo and other data when the source platform provides them and the permission is granted; also exchanged files and audios.
• CRM and automations: Contact data, notes, tags, statuses, tasks, care history, appointment requests, and responses generated or assisted by AI when the company enables those features.

Sensitive data and third parties

Vchat does not normally require sensitive personal data to create an account. It should not be shared through the service unless there is a valid reason, appropriate measures are in place and compliance with regulations is ensured. User companies are responsible for informing their own contacts about the processing they carry out.

Responsible and in charge in the work spaces

When a company hires Vchat to serve its customers and decides what data to collect, how to use it, and for how long to keep it, that company generally acts as responsible of the processing of your contacts and conversations. Vchat can act as responsible or processing provider to the extent that it processes such data to provide the service in accordance with applicable instructions and agreements.

Requests regarding messages or data submitted by a company may require the intervention of the administrator of their workspace. If a person writes directly to Vchat, we will help identify the appropriate person and channel their request accordingly.

Primary purposes of the processing

We process the necessary information to:

• Create and manage accounts, authenticate users, enable trials, plans, and subscriptions.
• Connecting, with the customer’s permission, WhatsApp Business, Facebook Messenger, Instagram and other compatible channels.
• Receive, view, organize, and send messages; assign conversations and enable follow-up in the Inbox and CRM.
• Provide calendar, tasks, tickets, analytics, saved responses, and other contracted features.
• Process content using automation and artificial intelligence agents when those functions are enabled and subject to the customer's configuration.
• Provide technical support, resolve incidents, and communicate operational or security changes.
• Manage payments, billing, renewals, and contractual obligations.
• Detecting abuse, protecting access, maintaining operational records, and fulfilling legal obligations.

The data from Meta is used for the authorized communication and service management functionalities, subject to its applicable permissions and policies.

Secondary and negative purposes

When appropriate, we may send you news updates, invitations, satisfaction surveys or commercial information about StudioVainilla and Vchat products. These purposes are not essential for the provision of the service.

You can object to the use of your data for these purposes by sending an email to hola@studiovainilla.com with the subject Refusal of secondary purposes, or through the low-level mechanism included in the communications when present.

Connections with Meta and other platforms

A company can connect authorized accounts from Facebook Messenger, Instagram and WhatsApp Business to manage interactions from Vchat. The platform will be able to receive data enabled by official APIs, according to the permissions, configuration, and policies of each service.

This data may include account identifiers, pages and conversations, messages and files, timestamps, and basic profile information that the provider provides legally. Some data, such as a user's email or phone number on Messenger, is not available generally; Vchat does not guarantee that it will be obtained.

The company can request the channel to be disconnected from the available controls or contact support. Disconnecting an account does not necessarily immediately remove previously stored history when there is a contractual or legal reason to retain it; requests for deletion are processed in accordance with this notice and the workspace administrator.

We do not commercialize the message data or profiles obtained through Meta. Access to and use of that data must comply with platform policies and the permissions granted.

Managers, suppliers and transfers

To provide the service, we may rely on hosting, security, communications, channel integration, payment processing, analytics, support, and artificial intelligence providers, depending on the functions used. Some services may process information outside Mexico.

We distinguish between treatment by providers operating on behalf of the controller and transfers to third parties that are required under applicable law. When a transfer requires consent, this will be requested through the relevant mechanism. Providers must comply with confidentiality and information protection obligations as appropriate.

The use of an external integration may also be subject to its own notices and policies.

ARCO Rights

The persons in charge may exercise, in accordance with the applicable legislation, the rights of Access, Rectification, Cancellation, and Opposition (ARCO) about your personal data.

To submit an application, write to hola@studiovainilla.com with the subject ARCO application, and includes:

• Name of the person in charge and means of response.
• Right to exercise and description of the related data.
• Elements to identify the corresponding account or service.
• Documents required to prove identity or representation, using a secure means.
• If you request rectification, correct data and relevant substantiation.

We will respond within the applicable legal deadlines. When Vchat acts as the administrator of a client company, we may direct the request to the person responsible for that workspace.

Revocation, limitation and removal

You will be able to request the revocation of consent when appropriate, as well as the limitation of the use or disclosure of your data. The revocation will not have retroactive effects and may be subject to existing legal or contractual obligations.

Elimination of data related to Meta

To request the removal of information that may be linked to Messenger, Instagram, or WhatsApp, write to hola@studiovainilla.com Indicate the channel involved, the business or workspace, and the information to be located. Do not send passwords or tokens.

We will verify the identity or the corresponding authorization and, if the data belong to the space of a client company, we will coordinate the request with their responsible person. We will inform you of the result and any mandatory retention that prevents immediate deletion.

The informational procedure does not replace the technical removal and disconnection functions that must be configured in Meta Developers.

Cookies and similar technologies

The site and platform may use cookies, local storage, session identifiers, and similar technologies for authentication, security, preferences, functionality, and service measurement.

If non-essential cookies requiring consent are used, consent must be obtained through the appropriate controls. You can manage cookies in your browser, although disabling some may limit essential functions.

Security and conservation

We implement administrative, technical and organizational measures aimed at reducing the risks of unauthorized access, loss, alteration or disclosure of data. No system guarantees absolute security.

Retention depends on the type of data, the configuration of each workspace, the contractual relationship, security needs, and legal deadlines. Once the applicable period has ended, the data will be deleted, blocked, or anonymized as appropriate. Backups may also exist subject to retention cycles.

Minors' data

Vchat is aimed at companies and individuals with the ability to hire services. It is not designed for minors to create administrative accounts directly. If we become aware of improper treatment involving minors, we will review the request and take the appropriate actions in accordance with our role and applicable legislation.

Modifications to the notice

We may update this document to reflect changes in the service, providers, or regulations. The current version will be published on https://vchat.com.mx/aviso-de-privacidad/ with their date of update. Where appropriate, material changes will be communicated through the appropriate channels.

Contact for privacy

For privacy inquiries, personal rights, requests related to Meta, or data deletion, please use the following methods: