Privacy and Personal Data Processing Policy — LogisTalk
Last updated: October 15, 2026
1. Who we are
LEADING SOLUTIONS SAS ("Leading Solutions", "we"), a Colombian company with tax ID (NIT) 902.037.122-2, domiciled at Calle 11 # 55-209, Neiva, Huila, Colombia, operates LogisTalk (the "platform"), a cloud service that lets businesses ("customers" or "businesses") serve their own customers ("end customers") on WhatsApp with an automated assistant and their human team.
Privacy and data protection contact: privacidad@logistalk.com · +57 316 373 8937 · Calle 11 # 55-209, Neiva, Huila, Colombia.
This policy complies with Colombian Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and other Colombian personal data protection rules.
2. Our role for each kind of data
| Data | Our role |
|---|---|
| Our customers' account data (platform users, company data, billing) | Controller (Responsable) |
| Data of the end customers who write to each business's WhatsApp (conversations, contact, orders, appointments) | Processor (Encargado): we process it on behalf of and under the instructions of the business, which is the Controller towards its end customers |
Each business is responsible for informing its end customers and obtaining their authorization, including consent to receive WhatsApp messages.
3. Data we process
About our customers and their users: name, email, password (held by our authentication provider, never in plain text), role and permissions; company name, tax ID, address, phone, logo, website, opening hours, industry; billing and platform usage data.
Received through Meta's WhatsApp Business Platform, when a business connects its account:
- Identifiers of the WhatsApp Business Account (WABA), its phone numbers and business portfolio; verified name and number quality.
- A business access token issued by Meta, stored encrypted.
- The business's message templates and their review status.
- About end customers: WhatsApp phone number or the user identifier WhatsApp assigns for that business, username and profile name when WhatsApp shares them, message content (text, images, documents, audio, location, button replies), and delivery statuses (sent, delivered, read, failed).
Generated on the platform: conversations, leads, service requests, bookings, quotes, surveys, internal notes, handovers to a human, and technical logs (which do not include message content).
We do not intentionally process sensitive data. If an end customer includes it in a message, it is processed only to answer them.
4. Why we use it (purposes)
- Provide the platform: receive and send each business's WhatsApp messages from its own number.
- Generate automatic replies through an artificial-intelligence assistant limited to the business's information (products, prices, hours, bookings, orders), and let a person from the business take over the conversation at any time.
- Manage the bookings, appointment reminders, quotes, requests and surveys that the business configures.
- Manage our customers' accounts, security, support and billing.
- Comply with legal obligations and requests from authorities.
We do not use conversation content to train or improve artificial-intelligence models, ours or third parties', and we do not sell personal data.
AI provider. Data processed by our artificial-intelligence provider (OpenAI) is transmitted only to generate the assistant's replies, and is processed in the United States. Under OpenAI's terms for its API, OpenAI keeps it for up to 30 days for security and abuse monitoring, unless the law requires a longer period, and does not use it to train artificial-intelligence models.
5. Who we share data with (processors and third parties)
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Meta Platforms (WhatsApp Business Platform) | Sending and receiving WhatsApp messages | Messages, numbers/identifiers, templates | United States and the other countries where Meta operates — Meta also acts under its own terms |
| OpenAI (sub-processor) | Language model that drafts replies and represents the business's knowledge | Only the conversation turns needed and the business's documents. Before text is sent to the model we apply automatic masking of emails, card numbers and phone numbers: they leave replaced by labels. It is a reduction measure, not a guarantee: it does not cover other data, such as names, addresses or identity documents, or the information in the business's catalog, and the rest of the content is sent | United States (processing outside Colombia) |
| Supabase | Database, authentication and file storage | All platform data | United States (Oregon) |
| Hetzner | Servers running the platform | All data in transit and processing | United States (Hillsboro, Oregon) |
| Cloudflare | Delivery network and traffic protection | Web and API traffic | Global |
| Vercel | Hosting of the web application | Browsing data of platform users | Global |
| Resend | Email delivery (invitations, notifications, exports) | Email address and notice content | Brazil (São Paulo region). Resend is a United States company |
| Grafana Labs (Grafana Cloud) | Technical performance traces | Technical identifiers and timings; no message content or phone numbers | United States |
These providers may process the data only to provide their service to us. Several are outside Colombia, so there is an international transmission of data. Locations may change; if they do, we will update this table and give notice of material changes as section 13 says.
6. How long we keep it
- Messages and conversations: while the business's account is active, or the shorter period the business configures (90 days, 180 days or 1 year).
- On account cancellation or a deletion request: deleted within 15 business days, except what we must keep under a legal or contractual duty (for example accounting and tax records, and the delivery-evidence records described below).
- Delivery-evidence records (which message was sent, its status — sent, delivered, read or failed — and the date): 5 years after the business cancels its account. They do not include the message content, and the recipient's phone number is stored transformed so that it cannot be read; they are still personal data. We keep them on the business's instruction, as evidence of its own sends, and to be able to demonstrate the data subject's authorization and compliance with the law; for that reason a deletion request does not apply to these records during that period.
- Technical logs: at most 30 days.
- Disconnecting a business's WhatsApp account does not delete its stored conversations: they follow the periods in this section until the business asks for their deletion.
7. Data subject rights
You may: know, update and correct your data; request proof of the authorization; be informed about how your data is used; revoke the authorization and request deletion when there is no legal duty to keep it; access your data free of charge; and file complaints with the Superintendence of Industry and Commerce (SIC) after completing the procedure with us.
How to exercise them: write to privacidad@logistalk.com or use the form at https://logistalk.com/legal/data-deletion, stating your name, ID, the business you wrote to (if you are an end customer), your request and a way to reply.
- Queries: answered within 10 business days, extendable by 5 business days with notice of the reason.
- Claims (correction, update, deletion, revocation): answered within 15 business days, extendable by 8 business days with notice of the reason.
If you are an end customer of a business, you may contact the business or us; if you write to us, we coordinate with the business and answer within the same terms. To stop receiving messages from a business, ask the business in the chat, write to us at privacidad@logistalk.com or block its number on WhatsApp; WhatsApp also lets you stop marketing messages from the chat.
8. Users who connected with Facebook
If you connected your business's WhatsApp Business Account using Facebook Login, you can request deletion of the associated data by removing the LogisTalk app in your Facebook settings (Settings & privacy → Settings → Apps and websites) and also sending the form above or an email to privacidad@logistalk.com, so that we can identify your request and answer you.
9. Artificial intelligence
Automatic replies are generated by an artificial-intelligence assistant that only handles the business's topics. They may contain mistakes; the business supervises its assistant and the end customer can ask to talk to a person at any time.
10. Security
AES-256-GCM encryption of each business's credentials; signature validation of every notification we receive from Meta; separation of each business's data; permission-based access control; encrypted connections (HTTPS); technical logs without message content. No system is infallible; if an incident affects your data we will inform you and report it to the SIC when required.
11. Cookies
We use strictly necessary cookies to keep platform users signed in. On the pages where a business connects its WhatsApp we load Meta's JavaScript SDK, which may set its own cookies. We do not use advertising cookies or third-party analytics.
12. Minors
The platform is not directed at people under 18. Businesses must not use it to process minors' data without meeting the legal requirements.
13. Changes to this policy
We will publish any change on this page with its effective date and notify customers by email 15 days in advance when the change is material.
Effective: from October 15, 2026.