Privacy Policy

The data controller is Martin Coll, a sole trader (monotributista) based in the Autonomous City of Buenos Aires, Argentina. We operate Tata, a WhatsApp-first SaaS platform for tradespeople.

For any privacy-related question, write to [email protected].

Account data. When you create an account we store your email, a hash of your password, your name and your preferred locale. If you enable 2FA, we also store the secret required to verify your codes.

Product data. Tata stores the information you load to run your business: phone numbers of your end customers, message history exchanged through the bot, quotes, calendar reminders and inventory entries.

This includes personal data about third parties (your customers). You collect that data in the course of your trade and load it into Tata as a management tool. We process it on your behalf under the instructions your use of the platform defines.

• Performance of the contract: we need to process your account and product data to deliver the service you signed up for.
• Legitimate interest: we use technical data for security, fraud prevention and incident response.
• Consent: if you opt in, we send you product news by email. You can withdraw consent at any time.

We share data only with the subprocessors required to run the service. Each one operates under contract and processes data on our behalf:

• Railway — application and database hosting.
• Meta Platforms (WhatsApp Business API) — required to send and receive messages with your customers. Meta's terms additionally apply.
• Anthropic / OpenAI— large language models that generate the bot's replies. The product cannot operate without an LLM provider.
• Mercado Pago — payment processing when you charge customers through the platform.
• Resend / SMTP provider — transactional email delivery (verification, password reset, notifications).

We do not sell your data or your customers' data.

As a data subject you have the right to access, rectify, delete and object to the processing of your personal data (Argentina's ARCO rights) as well as the right to data portability. To exercise them, write to [email protected] from the email tied to your account. We answer within the timeframe set by Law 25.326.

If you believe the processing of your data does not comply with the law, you may file a complaint with the Agencia de Acceso a la Información Pública.

We keep your account and its associated data while it is active. After cancellation we keep the data for a 30-day grace period so you can recover the account or export your information, and then we delete it.

Bot operational logs (message history) are kept for 12 months for support and audit purposes. Backups are purged within 30 days after a deletion request.

We apply reasonable technical and organizational measures: TLS in transit, encryption at rest where the provider supports it, password hashing with an adaptive algorithm (bcrypt or equivalent) and optional two-factor authentication.

No measure is absolute. If you spot suspicious activity on your account, tell us as soon as possible.

Some of our subprocessors (Railway, Anthropic, Meta) process data outside Argentina, typically in the United States or the European Union. Argentina's Law 25.326 allows these transfers to jurisdictions with an adequate level of protection or when equivalent contractual safeguards are in place. We work with providers that meet those standards.

We use only cookies that are necessary for the site to work:

• A session cookie that keeps you signed in.
• NEXT_LOCALE— remembers your preferred language so we don't ask every visit.

We do not use third-party trackers or advertising cookies.

If we update this policy we notify you by email at the address tied to your account and show a banner in the app. Changes take effect on the date stated at the top of the document.

Martin Coll — Autonomous City of Buenos Aires, Argentina.
[email protected]