Privacy Policy

Last updated: September 28, 2026

1. Who processes your data

The platform is operated by Carmelo Jesús Chery Martino, natural person, owner of the commercial establishment FromChats under Operating Notice No. 8-878-783-2026-574428213 of the Ministry of Commerce and Industry of the Republic of Panama, with address at District of La Chorrera, Panamá Oeste Province, Republic of Panama.

Contact email for data-protection matters: soporte@fromchats.com.

This policy is governed by Law 81 of 26 March 2019 on the protection of personal data of the Republic of Panama and its implementing regulation, Executive Decree 285 of 28 May 2021.

1.1 Controller and processor

• End clients' data (people who book with a business): the controller is the business with which the booking is made. FromChats is the processor (the “database custodian” under Law 81) that processes the data on that business's behalf and according to its instructions. That mandate and its conditions are set out in the Terms and Conditions the business accepts when it registers.
• Data of account holders, affiliated businesses and ambassadors: the controller is FromChats.

A client's profile (name, phone number and email) is unique across the whole platform, so that they do not have to register again with each business. However, each business only sees its own appointments, notes and conversations with that client, never those of other businesses.

2. What data we process

2.1 Account

• Name, nickname, email address and phone number
• Password, stored encrypted, or the Google sign-in data
• Date and version of the Terms and of this Policy accepted

2.2 Affiliated business

• Name, type of business and contact details
• Location and address
• Opening hours, services, prices and team
• Subscription data and its charges

2.3 Appointments and conversations

• Appointments: business, service, professional, date, time and status
• Chat messages: text, images and voice notes. Voice notes are transcribed to text and the audio is not kept
• Message metadata (date, time, channel)
• Notes and tags the business assigns to its clients

2.4 Data by type of business

• Paperwork agencies: identity document and the documents for procedures that the client provides. The image of an identity document is sensitive data (biometric) under Law 81 and Executive Decree 285 (art. 18): the agency only processes it with the client's prior and express consent, given before booking, on the web or in the chat, and recorded in the same way as health consent.
• Home cleaning: service addresses, with their coordinates and access instructions.
• Health (psychology and similar): health data, which are sensitive data under Law 81. They are processed only with the client's prior and express consent, given before booking, on the web or through the chat, and recorded with its date, the channel and the version of the text accepted. That consent also covers their transfer to the providers in section 4. The assistant does not ask the reason for the consultation.

2.5 Ambassadors

• Name, email, phone number, city, country and social network
• Businesses they sponsor
• Date and version of acceptance of the program terms

2.6 Subscription payment

The subscription is charged through dLocal Go. FromChats does not store your card: the number, expiration date and security code are entered on the dLocal Go page and processed by that provider. For each charge we keep the identifier, the amount, the currency, the date and the status.

2.7 Location

The directory's “near me” feature calculates distance in your browser: your position is not sent to our servers.

3. What we use them for and on what legal basis

• Providing the service: handling conversations with the assistant, managing appointments and showing the information to the business. Basis: the contractual or commercial relationship you request (Law 81, arts. 6 and 8).
• Automated responses: generating the assistant's responses using artificial intelligence. Basis: the same relationship.
• Health data: managing appointments with health businesses. Basis: your express consent (Law 81, art. 8).
• Identity documents at paperwork agencies: managing your appointments and procedures. Basis: your express consent (Law 81, arts. 8 and 13).
• Charging the subscription to affiliated businesses. Basis: the subscription contract.
• Security and prevention of abuse of the platform. Basis: our legitimate interest in protecting the service and its users.
• Service improvement: analyzing aggregate use of the site. Basis: our legitimate interest in knowing what works; you can object (section 9).
• Communications: notices about appointments, the account and the subscription. Basis: the contractual relationship. We do not send advertising.
• Legal compliance: meeting legal, tax and regulatory obligations. Basis: the legal obligation.

The assistant replies and books automatically, but it does not make decisions that produce legal effects on you or build profiles to evaluate you. The business's staff can read the conversation and assist you directly.

4. Providers that process data

We share data with the following providers, only to the extent necessary to provide the service:

• Meta (WhatsApp Cloud API and Instagram): sending and receiving messages. United States.
• Telegram: sending and receiving messages. Various countries.
• OpenAI: assistant responses, image reading and voice note transcription. United States.
• Groq: backup artificial intelligence provider when the main one does not respond. United States.
• Google: sign-in, maps, site usage statistics (Google Analytics) and bot protection (reCAPTCHA). United States.
• Jitsi Meet: video calls for online sessions. European Union and United States.
• Mailjet: sending emails. European Union.
• Cloudflare R2: file storage. United States and European Union.
• DeepL: translation of the content the business publishes. European Union.
• dLocal Go: charging the subscription to businesses. Uruguay and other countries in the region.
• Competent authorities: where there is a valid legal requirement.

We do not sell, rent or transfer personal data for advertising or marketing purposes.

4.1 International transfers

Several of these providers are located outside Panama, mainly in the United States and the European Union, so your data is subject to international transfer. In accordance with article 33 of Law 81 and article 51 of Executive Decree 285, these transfers are based on:

• their being necessary to provide the service you request or contract (your booking, your account or the subscription);
• for health data and for the identity documents processed by paperwork agencies, your express consent (Law 81, arts. 13 and 33);
• and, where the provider offers them, its data-protection contractual clauses.

You can ask us for more information about these safeguards at the email address above.

5. Security

• Encryption of data in transit via HTTPS/TLS
• Passwords stored with a secure hash function (bcrypt)
• Chat files accessible only through signed links that expire
• Role-based access control: each business only accesses its own data

No security measure is infallible. If a security breach occurs that poses a risk to your data, we will notify ANTAI and those affected, through the registered email or phone number, within a maximum of 72 hours of becoming aware of it, stating what happened, which data were affected, what measures we took and what you can do (Executive Decree 285, art. 37). If it affects data we process on behalf of a business, we will inform that business immediately so it can notify, and we will help it do so.

6. How long we keep them

• Chat messages and their files: 365 days.
• Confirmation images: 7 days.
• Assistant's internal history: deleted after 365 days of inactivity.
• Technical logs: the time needed for security and error diagnosis.
• Account data: for as long as the account exists.
• Subscription charge records: for the period required by tax legislation, even after cancellation.

7. Your rights

Under Law 81 of 2019 and Executive Decree 285 of 2021, you have the right to:

• Access: know whether we process data about you, which data, where they come from and why, and obtain a copy.
• Rectification: correct inaccurate or incomplete data.
• Cancellation or deletion: request the erasure of your data when they are no longer needed, are inaccurate, are processed without a legal basis or you withdraw your consent.
• Objection: object, on legitimate grounds, to a particular processing.
• Portability: receive the data you gave us in a structured, commonly used format.
• Withdrawal of consent: revoke it at any time, with no retroactive effect.

To exercise them, write to soporte@fromchats.com stating which right you are exercising and which data it concerns. We may ask you to prove your identity, or your authority if you act for someone else. It is free of charge and we will reply even if we hold no data about you. Maximum time limits, in business days from receipt of the request:

• Access, cancellation and portability: 10 business days.
• Rectification: 5 business days.
• Objection: we stop processing those data as soon as we receive it, unless legitimate grounds prevent it, which we will explain to you.

When deleting your data, we will keep only what a law requires us to keep or what is needed to handle claims.

If your data is processed by a business as controller (for example, your appointments and conversations with that business), you may contact the business or us: we will handle the request on the business's behalf within the same time limits. If you receive no reply in time or are not satisfied, you may turn to the National Authority for Transparency and Access to Information (ANTAI), Personal Data Protection Directorate: protecciondedatos@antai.gob.pa.

8. Messaging (WhatsApp, Instagram and Telegram)

• Your messages pass through Meta or Telegram, which process them in accordance with their own privacy policies.
• The assistant replies automatically, and the business's staff can read the conversation and reply themselves.
• The conversation is kept for the period stated in section 6 to provide continuity of service.

9. Browser storage and cookies

• Session: your signed-in session is stored in your browser's local storage, not in a cookie.
• Our own cookies: locale (language) and theme (visual theme), which last 1 year.
• Google Analytics: tells us in aggregate how the site is used (pages visited, visit duration, device type and country). Its cookies are set by Google. We do not send it data that identifies you (name, email, phone number, content of conversations) or the codes of private links.

We do not use advertising cookies or tracking cookies for marketing purposes. You can set your browser to reject cookies, or install the Google Analytics opt-out add-on available at tools.google.com/dlpage/gaoptout.

10. Minors

Accounts are for persons over 18 years of age. Minors book through their father, mother or guardian, whose prior authorization is required by law (Executive Decree 285, art. 18). For health businesses, the business, as controller, must verify that authorization. If we detect that we have collected data from a minor without it, we will delete it.

11. Changes to this policy

We may update this policy. We will publish the new version on this page with its date and notify significant changes by email. With each new version, health businesses ask again for consent to process health data, and paperwork agencies for identity documents.

12. Contact