Privacy Policy

The controller of the personal data described in this policy is Paul Werner Osinga León, who operates the platform under the ListoAgent brand, identified with NIT 700.291.675-8, domiciled in Bogotá D.C., Colombia.

Website: https://www.listoagent.net. General contact e-mail: [email protected].

This policy applies to the website, the administration panel and the conversational infrastructure of ListoAgent. It is written under the European Union General Data Protection Regulation (GDPR) and Colombia's Statutory Law 1581 of 2012 and Decree 1377 of 2013. This English version is a faithful translation of the Spanish privacy policy. The Personal Data Processing Policy (in Spanish) sets out the Colombian regime and the procedure for exercising your rights in detail.

For any matter related to your personal data, including exercising your rights, write to [email protected]. The responsible area is the Data Protection Officer of ListoAgent. It is a free, monitored channel; you do not need special forms or a lawyer to use it.

If you want us to delete your data, you can also use the public data deletion request form, available without an account.

ListoAgent plays two different roles, and it matters which one applies to you:

ListoAgent as controller

For the data of its own customers (the businesses that hire the platform and their administrator users), billing, visitors to this website, people who write to the contact addresses, and the platform security logs.

ListoAgent as processor

For the content of the messages exchanged with each business's end customers, contact profiles, per-contact memory summaries, the knowledge documents the business uploads and campaign audiences. We act on this data only on the customer business's instructions.

ListoAgent staff access a customer business's data only when needed to handle a technical support request or an error, at that business's request or with its authorization, and without extracting or sharing it.

When you exercise a right (access, rectification, erasure or another) over a conversation you had with a business, we do two things: we forward your request to that business, which decides about your data, and we accept it directly through [email protected] or the data deletion form, so you always have a way to ask for deletion even if you do not know whom to ask. If the request is for erasure, we carry it out on the data we store and notify the business.

When the data does not come directly from you, we receive it from the business you talked to (for example, your name in its address book or your commercial history) or from Meta Platforms, which gives us your phone number and the profile name you set in WhatsApp when you send us a message.

Data you give us

• Customer account: name, e-mail address, password (stored only as a hash), company name, role and workspace.
• Platform configuration: channel and language model provider credentials the business registers in the panel (encrypted at rest), the agent persona, skills and knowledge documents.
• Sales contact: name, e-mail address, company and message sent through the website contact form.
• Conversations: the text, audio files and attachments you send to a business on WhatsApp or Telegram, together with your phone number or Telegram identifier and profile name.

Data generated by using the service

• Contact profile and memory: automatic summaries of the conversation (for example, the product you asked about) that the assistant uses so it does not repeat questions.
• Technical logs: system logs, message delivery statuses and, when you open a link sent in a campaign, the date of the click and your browser's user agent. We do not record your IP address on clicks.
• Browser preferences: the panel theme and language, stored on your own device. See the Cookie Policy (in Spanish).
• Google user data, only when a customer business connects Google Calendar: see section 7.

Data we receive from third parties

From Meta Platforms (WhatsApp Business Cloud API) and Telegram we receive the messages you send, your identifier on that network and your profile name. From customer businesses we receive the contact data they upload for their campaigns and the information they keep about you in their mini-CRM. From Google, only what section 7 describes.

We do not ask for sensitive data (health, ethnic origin, political opinions, beliefs, sex life, biometric data). If you include it spontaneously in a conversation, it is processed only to answer you and under the responsibility of the business you are talking to.

We process your data only for the following purposes, each with its legal basis under Article 6 GDPR:

Providing the service the customer business hired

Creating and managing accounts, authenticating users, routing messages and billing. Basis: performance of a contract, Art. 6(1)(b).

Answering conversations on behalf of the customer business

Receiving your message, generating an answer with a language model, keeping the conversation history and the contact's memory. Basis: the instructions of the controller business under the processing agreement, Art. 28; the legal basis towards you is determined by that business (usually Art. 6(1)(b) or 6(1)(f)).

Reflecting bookings in the business’s Google Calendar

Only when the customer business connects Google Calendar (section 7). Basis: performance of the contract with the customer business, Art. 6(1)(b), and the authorization its administrator gives on Google’s consent screen.

Sending messaging campaigns

Delivering template messages to audiences the customer business defines. Basis: prior consent (opt-in) collected by the business, Art. 6(1)(a); the business must be able to prove it.

Handling your enquiries and requests

Answering the contact form and rights requests. Basis: legitimate interest in answering whoever writes to us, Art. 6(1)(f), and legal obligation for rights requests, Art. 6(1)(c).

Security and abuse prevention

System logs, access control, detection of improper access, tenant isolation. Basis: legitimate interest in protecting the platform and its users, Art. 6(1)(f).

Measuring campaign effectiveness

Counting opens of tracked links and conversions reported by the business's website. Basis: legitimate interest of the customer business, Art. 6(1)(f), limited to aggregate data and without IP addresses.

Complying with legal obligations

Keeping accounting records, answering requests from authorities, notifying security incidents. Basis: legal obligation, Art. 6(1)(c).

The legitimate interests we rely on

When we rely on Article 6(1)(f), our legitimate interests are: keeping the platform secure and available, answering whoever contacts us and letting the customer business know the aggregate result of its campaigns. We have weighed those interests against your rights and limited the data to the minimum necessary. You can object at any time (see section 11).

For the purposes of Article 22 GDPR: the assistant does not take decisions that produce legal effects concerning you or similarly significantly affect you (it does not approve credit, set personalized prices or refuse services). It only informs and guides; any decision with effects on you is taken by the customer business with human involvement. If you believe you have been subject to a relevant automated decision, you have the right to obtain human intervention, to express your point of view and to contest the decision.

The assistant may generate inaccurate answers. The customer business decides what information it gives the assistant and who supervises its behaviour.

ListoAgent offers an optional booking integration with Google Calendar. It is only turned on when an administrator of a customer business decides to connect their Google account from the booking module of the panel. Visitors to the website and the people who talk to the assistant never sign in with Google and never give us data from their Google account.

The permission we request and why

When the account is connected we request two Google Calendar scopes, one for each thing the booking feature does: https://www.googleapis.com/auth/calendar.calendarlist.readonly, read-only, to list the calendars of the connected account so the administrator can choose where bookings are recorded; and https://www.googleapis.com/auth/calendar.events, to create, update and delete the booking events in the calendar the administrator chose. We do not request access to Gmail, Google Drive, contacts or any other Google service.

Connections made before 16 October 2026 may still hold the broader https://www.googleapis.com/auth/calendar permission until the administrator disconnects and connects the account again. ListoAgent uses it only for the same two operations described above.

The data we access and how we use it

• The list of calendars of the connected account (identifier and name), when the account is connected and when the administrator chooses or changes a calendar. We store the identifier of the calendar the administrator chooses as the default and of any calendar assigned to a staff member or resource; the names of the other calendars are not stored. A calendar identifier can be the e-mail address of the connected account (Google uses it for the primary calendar).
• The booking events that ListoAgent itself creates in the chosen calendar: we create one when a booking is confirmed, update it when the booking changes and delete it when the booking is cancelled. Each event contains the name of the appointment type, the start and end date and time and, as attendees, the name and e-mail address the end customer gave when booking and the name and e-mail address of the providers or resources the customer business linked to that service in the panel. Google sends each attendee the event invitation and the notices when the booking is rescheduled or cancelled. The end customer's phone number is never sent to Google. Of each event we keep only the identifier and the version tag (etag) Google returns, so that we can update or delete it later.

The purpose is to reflect in the business's own calendar the appointments booked through ListoAgent, a feature the administrator turns on and sees in the panel, and to have Google Calendar e-mail the end customer and the invited providers or resources about the appointment, its changes and its cancellation. We do not read the content of any other event in the calendar and we do not query its free/busy availability: the availability the assistant offers comes from the schedules the business configures in the panel, not from Google Calendar. For that reason no Google Calendar data reaches the assistant or any language model provider.

How we store and protect it

We store the refresh token Google issues when the account is connected, encrypted at rest with AES-256-GCM and bound only to the customer business that connected it, together with the scopes granted. No other customer business can use it. The identifiers of the calendars in use (the default one and any assigned to a staff member or resource) are stored with the booking records and the staff and resource settings. The e-mail address the customer business enters for each provider or resource is stored with those same settings, and the end customer's name and e-mail address are part of the booking record. We never store the short-lived access token: it is obtained when needed and discarded. The data travels encrypted (HTTPS/TLS) between Google, our servers and the panel.

Retention of Google user data

Refresh token and scopes granted

While the integration is connected. They are deleted immediately when you disconnect Google Calendar in the panel.

Calendar identifiers (the default one and any assigned to a staff member or resource)

Kept with the booking and event records and with the staff and resource settings, like the event identifiers: they are deleted with the account's data (section 10), or earlier if you ask us at the privacy address. Disconnecting Google Calendar does not delete them.

Identifier and version tag of each event we created

Together with the booking they belong to, while the customer business keeps its account, so that the event can be updated or deleted. They are deleted with the account's data (section 10), or earlier if you ask us at the privacy address.

E-mail address of the providers and resources

While the provider or resource is registered in the panel: the customer business can change or clear it at any time from the panel, and it is deleted with the account's data when the account is deleted (section 10).

Calendar list and access token

We store neither: they are used at the moment they are needed and discarded.

Who receives Google user data

• Railway Corp. (United States), our hosting and database provider, stores the encrypted token and the identifiers described above on our behalf.
• Cloudflare, Inc. (United States), the reverse proxy for all web traffic, carries the calendar list, encrypted, when the administrator views it in the panel; it does not store it.
• The end customer and the invited providers or resources, who receive from Google Calendar the event invitation and its updates: the name of the appointment type, the date and time, and the names and e-mail addresses of the other attendees, as Google shows them in the invitation.
• The administrators of the customer business that connected the account, who see the calendar list and the sync status in the panel.

No language model provider receives Google user data, nor does any e-mail, messaging or file storage provider, and we do not share it with anyone beyond the recipients above. The full list of our providers is on the subprocessors page (in Spanish).

What we do not do

We do not sell Google user data and we do not share it: we do not transfer it to third parties except as necessary to provide the integration or when the law requires it. We do not use it for advertising, including personalized, retargeted or interest-based advertising, and we do not use it to train, develop or improve artificial intelligence or machine learning models, whether general or specific.

No person reads Google user data unless: (a) we have the explicit consent of the customer business to handle a technical support request or an error; (b) it is necessary for security purposes, to investigate abuse or attacks; or (c) it is needed to comply with applicable law.

How to disconnect and delete access

1. The administrator can disconnect Google Calendar at any time from the booking module of the panel. When they do, we ask Google to revoke ListoAgent's access, immediately delete the stored token and cancel any pending syncs. Events already created stay in your calendar and you can delete them from Google Calendar.
2. Disconnecting completes even if Google does not confirm the revocation. You can see ListoAgent's access in your Google account, and you can confirm or remove it at any time at https://myaccount.google.com/permissions.
3. To have us delete the remaining Google-derived data (the calendar and event identifiers), write to [email protected] or use the data deletion form.

We share data only with the following categories of recipients:

• Customer businesses, which receive the conversations and profiles of their own contacts, as controllers.
• Messaging platforms (Meta Platforms for WhatsApp; Telegram if the business enables it), which carry the messages. Meta is a direct provider of the customer business under the WhatsApp Business Terms.
• Infrastructure providers for hosting and the database, which process data on our behalf under contract.
• Language model providers, which receive the conversation content to generate the answer, only the ones each customer business configures in its panel. They never receive Google user data (section 7).
• Google LLC (Google Calendar), only when the customer business connects its Google Calendar: it receives the booking data described in section 7, including the end customer's name and e-mail address and those of the invited providers or resources, to create the event and send them the invitation.
• Public authorities, when a rule or a binding order requires it.

The full, up-to-date list, with the location of each provider, is on the Subprocessors and providers page (in Spanish). ListoAgent is not a data business: we do not sell, share or monetize personal data, nor hand it over for third-party advertising; we only disclose it to the recipients above to the extent needed to provide the service or comply with the law.

ListoAgent operates from Colombia and its infrastructure and language model providers are in the United States; the WhatsApp platform operates from Ireland and the United States. Colombia has no adequacy decision from the European Commission, and the United States has one only for organizations certified under the EU-U.S. Data Privacy Framework.

For transfers outside the European Economic Area we rely on the Standard Contractual Clauses approved by the European Commission (Decision 2021/914), incorporated in the processing agreements with each provider, supplemented by encryption in transit and at rest and by a transfer impact assessment. When a provider is certified under the Data Privacy Framework, that certification is used as an additional safeguard.

For data subjects in Colombia, transfers to countries the Superintendence of Industry and Commerce has not declared to have an adequate level of protection are made with your express and unequivocal authorization, or under the exceptions of Article 26 of Law 1581 of 2012, in particular the performance of a contract between you and the controller. You can request a copy of the applicable safeguards by writing to [email protected].

We keep data only for as long as it is needed for the purpose that justified collecting it:

Customer account and configuration

While the account is active and up to 30 days after it is cancelled, to allow export and reactivation. It is deleted afterwards.

Conversations, contact profiles and memory

While the customer business keeps its account and does not ask for their deletion. They are deleted when the business deletes the contact or the conversation, when you ask and the request succeeds, or when the account is cancelled.

Knowledge documents and campaign audiences

While the customer business keeps them uploaded; they are deleted when removed or when the account is cancelled.

Google user data

As described in section 7: the token and scopes until the integration is disconnected; the calendar and event identifiers with the bookings and settings they belong to.

System technical logs

By default, 7 days; the customer business can configure another window in its panel. Campaign delivery statuses and clicks are kept with the campaign.

Panel session

The session token expires after 7 days and is deleted on sign-out.

Correspondence and rights requests

Up to 3 years from closure, as proof of how they were handled.

Accounting and tax records

For the periods required by Colombian tax and commercial law.

When each period ends, the data is deleted or irreversibly anonymized. Backups are overwritten in short cycles and are not restored except to recover the service.

Under the GDPR (Articles 15 to 22) and Law 1581 of 2012, you have the right to:

• Access: know whether we process your data and obtain a copy.
• Rectification: correct inaccurate data or complete incomplete data.
• Erasure: have us delete your data when it is no longer needed, you withdraw your consent or it was processed unlawfully.
• Restriction of processing: have us freeze the use of your data while its accuracy is checked or an objection is resolved.
• Objection: object, on grounds relating to your particular situation, to processing based on legitimate interest; and object in any case to direct marketing.
• Portability: receive the data you gave us in a structured, commonly used and machine-readable format, and transmit it to another controller.
• Not to be subject to automated decisions with legal or similar effects, as described in section 6.

To exercise them, write to [email protected] stating which right you are exercising and the phone number or e-mail address you talked or registered with, so that we can find your data. We answer within one month (GDPR) or within the periods of Law 1581 (detailed in the Personal Data Processing Policy), whichever is more favourable to you. Exercising these rights is free of charge.

If your data is under the responsibility of a customer business, besides handling your request we forward it to that business so that it can also resolve it (section 3).

When processing is based on your consent (for example, receiving campaigns on WhatsApp), you can withdraw it at any time without affecting the lawfulness of the processing before the withdrawal. To stop receiving campaigns, just reply STOP or any message asking to unsubscribe; the platform records the opt-out and the business must not include you in an audience again without new consent. You can also withdraw it by writing to [email protected]. A customer business can withdraw the Google Calendar authorization as described in section 7.

If you believe the processing of your data breaches the law, you have the right to lodge a complaint with a supervisory authority:

• In Colombia, with the Superintendence of Industry and Commerce (SIC), Delegation for the Protection of Personal Data, www.sic.gov.co. Under Article 16 of Law 1581 of 2012, a complaint to the SIC is only admissible after the enquiry or claim procedure with the controller or processor has been exhausted.
• In the European Union, with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement (GDPR, Article 77). The list of authorities is at edpb.europa.eu.

We would appreciate it if you wrote to [email protected] first: most matters are resolved directly.

Providing your data is not a legal obligation. However, to open a customer account we need a name, an e-mail address and a password; without them we cannot provide the service. To talk to a business on WhatsApp or Telegram, those platforms necessarily give us your identifier and profile name; without them the message cannot be answered. Connecting Google Calendar is optional: bookings work without it. Any other data (for example, what you share voluntarily in a conversation) is optional, and its absence only limits the assistant's ability to help you.

If in the future we wanted to process your data for a purpose other than the one it was collected for, we will inform you before starting that processing and, where applicable, ask for your consent (GDPR, Articles 13(3) and 14(4)).

We may update this policy to reflect legal, technical or service changes. Substantial changes will be communicated to customers by e-mail and to end users through a notice on this website before they take effect. The effective date appears at the top of the document.