Privacy policy

1. Who we are

Cercanto is a product operated from Colombia. For any question about this policy or your data, write to us at privacidad@cercanto.com.

2. What data we collect

If you manage a Cercanto account (tenant):

• Your account and team data: name, email address, authentication (through our identity provider).
• Your business data: name, industry, timezone, bot configuration (tone, business hours), enabled modules.
• Content you upload for the bot to use as reference: documents, FAQs, product or service catalog.
• Connection credentials for your own channels (e.g., your WhatsApp Business number) — stored encrypted, never in plain text.
• If you activate the paid subscription: billing data is processed directly by our payment provider (Stripe) — Cercanto never receives or stores your card number.

If you message a business that uses Cercanto (end user):

• The content of your messages and the conversation history with the bot or the business's human team.
• Your contact identifier per channel: WhatsApp number, Messenger/Instagram ID, or the data you leave in the web widget.
• If the business uses our booking or CRM module, additional data you yourself provide in the conversation (name, date of interest, etc.).

Cercanto never receives or stores your card number: subscription payment processing is handled directly by Stripe, under its own security guarantees (see section 4).

3. What we use this data for

• Operating the product: generating bot replies with real business information, keeping the conversation history, showing the admin panel to the tenant.
• Security: isolating each business's data from the rest (each tenant can only see its own data), detecting and preventing abuse.
• Support: answering questions tenants have about their account.
• We never sell personal data to third parties, or use it for advertising.

4. Who we share data with

We use external providers to operate the platform, who process data on our behalf under their own security guarantees:

• Meta / WhatsApp Business Platform — to send and receive WhatsApp messages, when a tenant connects that channel.
• OpenAI (via Vercel AI Gateway) — to generate the bot's replies from the conversation and the business's reference content.
• Stripe — to process the subscription payment, when a tenant activates it. Stripe receives and processes card data directly; Cercanto never sees or stores it.
• Neon — database hosting.
• Vercel — application hosting.
• Our authentication provider — for signing in to the admin panel.

We don't share personal data with third parties for purposes other than operating Cercanto, unless required by law.

5. How long we keep the data

We keep data for as long as the tenant's account is active. If a tenant closes their account or requests deletion of their data, we delete it within a reasonable timeframe, unless we must retain certain information due to legal obligation.

6. Security

Each business's data is isolated at the database level (each tenant can only access its own information). Connection credentials for external channels (like WhatsApp tokens) are stored encrypted. All traffic between your browser and Cercanto is encrypted (HTTPS).

7. Your rights

If you're an end user who messaged a business that uses Cercanto, or if you manage a Cercanto account, you have the right to know, update, correct, and request deletion of your personal data, in accordance with Law 1581 of 2012 (Colombia) and its implementing regulations. To exercise these rights, write to us at privacidad@cercanto.com. If your request is about a conversation with a specific business, you can also contact that business directly.

8. Cookies

The admin panel uses strictly necessary cookies to keep you signed in. We don't use advertising tracking cookies.

9. Changes to this policy

We may update this policy as the product evolves. We'll keep the "last updated" date on this same page current.