1. Identification of the Data Controller and Data Processor
This document governs the Privacy and Personal Data Processing Policy of MERITY SpA (hereinafter, "Partsflow"), a joint-stock company (sociedad por acciones) incorporated under the laws of the Republic of Chile, Chilean Tax ID (Rol Único Tributario) No. 77.587.368-K, legally represented by Mr. Felipe Antonio De la Fuente Villablanca, both domiciled at Ramón Carnicer No. 65, commune of Providencia, Santiago, Metropolitan Region, Chile.
For any questions regarding the processing of personal data or to exercise your rights, you may contact us by email at: privacy@partsflow.ai or felipe@partsflow.ai.
2. Roles and Scope of Processing (B2B SaaS and Customers)
Partsflow is a Software as a Service (SaaS) platform focused on automating conversational flows, quoting and inventory management for the automotive industry through Artificial Intelligence and the WhatsApp Business API.
- Partsflow as Data Processor (Encargado del Tratamiento): In providing our SaaS services to dealerships, retailers and automotive companies (hereinafter, the "Business Customers"), Partsflow acts as Data Processor. The Business Customers are the Data Controllers of their end users' data. Partsflow processes such data solely and exclusively to execute the agreed conversational flows.
- Partsflow as Data Controller (Responsable del Tratamiento): With respect to browsing data collected on our corporate website (partsflow.ai) and the corporate contact data of our Business Customers, Partsflow acts as Data Controller.
3. Personal Data We Collect
Partsflow collects and processes only the data strictly necessary to provide its services:
- Data provided in WhatsApp interactions (SaaS Service): Mobile phone number, WhatsApp user ID (WUID), content of text messages, technical parts inquiries, quote history and preferences expressed by the end user during the interaction.
- Business Customer Data (B2B): Name of the legal representative or technical contact, corporate email, contact phone number, company legal name, RUT (Chilean Tax ID) and billing data.
- Web Browsing Data: IP address, browser type, operating system and technical cookies for optimizing the partsflow.ai website.
4. Purpose of Data Processing
The personal data collected is processed exclusively for the following purposes:
- Operating the conversational AI platform (Agents Julia, David and Víctor) to answer inquiries about the availability, prices and compatibility of automotive parts in real time.
- Generating and displaying informational quotes and external purchase/payment links (e.g., Shopify) at the user's request within the chat.
- Managing the connection and authentication with the WhatsApp Business API of Meta Platforms, Inc. and with the ERP/inventory systems of the Business Customers.
- Providing technical support, service availability monitoring and IT security.
- Complying with the legal, tax and contractual obligations applicable to Merity SpA.
Explicit non-monetization statement: Partsflow does not sell, rent or transfer personal data to third parties. The data processed is not used to create third-party advertising profiles or to send unsolicited spam.
5. Subprocessors and International Data Transfers
To ensure the continuous, high-availability operation of the SaaS platform, Partsflow uses cloud infrastructure from leading international providers, which act as subprocessors under strict confidentiality and data processing agreements:
- Amazon Web Services, Inc. (AWS): Cloud infrastructure hosting, servers and main databases (United States).
- Google LLC (Google Cloud / Gemini): Cloud infrastructure and natural language processing models (United States).
- OpenAI OpCo, LLC: API services for natural language processing and Artificial Intelligence (United States).
- Anthropic PBC: API services for language models and Artificial Intelligence (United States).
- Meta Platforms, Inc.: Provision of the WhatsApp Business API infrastructure.
Guarantee regarding Artificial Intelligence Models: Partsflow exclusively uses the corporate enterprise APIs of the Artificial Intelligence providers listed above. These integrations contractually guarantee that end users' data and interactions are NOT used to train public Artificial Intelligence models and are not retained for those providers' own purposes.
6. Security and Custody of Information
Partsflow applies technical, physical and administrative security measures in line with industry standards to safeguard the confidentiality, integrity and availability of data:
- Data Encryption: All data in transit is encrypted using TLS 1.3 / HTTPS cryptographic protocols. Data stored in databases is encrypted at rest (AES-256).
- Access Control: Role-based access control (RBAC) and multi-factor authentication (MFA), only for authorized technical staff.
- Monitoring: Intrusion detection systems and ongoing security audits.
7. Data Retention and Deletion
Personal data processed in connection with the SaaS services will be retained exclusively for the term of the contractual relationship with the corresponding Business Customer. Once the SaaS contract ends, or at the express request of the Data Controller or the data subject, Partsflow will securely delete, destroy or irreversibly anonymize the records from its active infrastructure within a maximum period of thirty (30) days, unless there is a legal or judicial obligation to retain them.
8. Rights of Data Subjects (ARCO Rights)
In accordance with Law No. 19,628 of the Republic of Chile and the applicable data protection standards, data subjects (or their representatives) may at any time exercise their rights of:
- Access: Request information about the personal data being processed by Partsflow.
- Rectification: Request the correction of inaccurate, outdated or incomplete data.
- Cancellation / Deletion: Request the erasure of their personal data when there is no legal basis justifying its retention.
- Objection: Object to the processing of their data for specific purposes.
To exercise any of these rights, the data subject may send a detailed written request to the email address: privacy@partsflow.ai.
9. Links to Third-Party Websites
During the conversational interaction, Partsflow may display links to third-party websites or e-commerce stores (for example, payment gateways or Shopify stores of our Business Customers). Partsflow assumes no responsibility for the privacy practices or the content of such external sites, and recommends that users review the privacy policies of each destination platform.
10. Governing Law and Jurisdiction
This Privacy Policy is governed in all respects by the laws of the Republic of Chile, in particular by Law No. 19,628 on the Protection of Private Life (and its amendments). Any controversy or dispute arising from the interpretation or application of this document shall be submitted to the jurisdiction of the Ordinary Courts of Justice of the city of Santiago, Chile.