Last updated: October 2026
Privacy Policy
This text was written in good faith to describe exactly how MAATICA works today. It has not yet been reviewed by a lawyer.
MAATICA is a multi-tenant inbox for businesses. It brings the conversations a business has on WhatsApp, Instagram, Facebook Messenger and its website chat widget into one place, and lets an AI assistant (running on Amazon Bedrock) answer them, with the business's team able to take over at any time.
In short
- We store the messages people send to the businesses that use MAATICA, plus the names, phone numbers and account IDs that the messaging platforms deliver with them.
- Access tokens for connected Facebook, Instagram and WhatsApp accounts are kept encrypted, on our servers only.
- We do not sell data, we do not use it for advertising, and we do not train AI models with it.
- You can ask for your data to be deleted at any time: see Data deletion.
1. Who we are and our role
MAATICA ("we", "us") is a software service operated from Argentina by Rodolfo Nahuel Ramos. Privacy contact: nahuelramos.nr@gmail.com.
We play two roles:
- Service provider (processor) for the businesses that use MAATICA ("business customers"). When you message a business that uses MAATICA, that business decides what happens with the conversation; we process it on its behalf and following its instructions.
- Controller for our own data: the accounts of business customers and their team members, people who contact us, and the business-prospecting data described in section 2.6.
2. Information we process
2.1 Business customers and their team
- Account data: email address, tenant (business) identifier and role. Passwords are handled by Amazon Cognito and never seen by us. The dashboard keeps your session and preferences in your browser's local storage; it does not use cookies.
- Content the business provides to configure its assistant: product catalog, prices, stock, policies, FAQs, instructions, documents, links to public Google Sheets and the business's own website pages (which we read and index).
- Activity in the dashboard: replies written by operators, notes, tags, tasks, settings changes and audit records.
2.2 Connected Meta accounts
When a business connects a Facebook Page, an Instagram professional account or a WhatsApp Business number, we store:
- The account identifiers and display names: Page ID and name, Instagram account ID and username, WhatsApp Business Account ID, phone number ID and display phone number.
- The access token that Meta issues for that account and the permissions granted. Tokens are stored encrypted at rest in AWS (AWS Secrets Manager), are used only by our servers to send and receive messages, and are never sent to anyone's browser.
2.3 People who message a business that uses MAATICA ("end customers")
| Data | Details |
|---|---|
| Identifiers | WhatsApp: your phone number (WhatsApp ID). Messenger: your Page-scoped ID (PSID). Instagram: your Instagram-scoped ID. Website widget: a random conversation ID. |
| Profile name | WhatsApp: the profile name WhatsApp sends with your message. Messenger: your name, read with Meta's User Profile API. Instagram: your username (or name). Widget: the name the business's website passes, or a random "guest" label. |
| Message content | The text of your messages and the replies from the business or its assistant, including captions and file names. |
| Media | For photos, audio, video and files you send, we store only a reference (the media ID or link Meta provides) and fetch the file from Meta when an operator opens it. We do not keep copies. Files that operators upload to send to you are stored for 7 days. |
| Conversation metadata | Channel, timestamps, read and delivery status, whether a human took over, and, if you arrived from an ad or link, the referral information Meta provides. |
| Information derived by AI | Conversation summaries; details you mentioned (for example your name, budget or products of interest); intent; a sentiment score; a lead score; and draft follow-up messages for the business to review. |
2.4 Online store integrations
If a business connects Tiendanube, we sync its catalog and recent orders (order number, status, items, totals, tracking and the buyer's email address) so the assistant can answer questions about them. If it connects Mercado Libre, we read its listings and questions.
2.5 Visitors to maatica.ai and people who contact us
Our website does not use cookies, analytics or advertising pixels. The home page loads fonts from Google Fonts, so your browser connects to Google when you open it (these legal pages do not). If you email us, we keep the email to answer you.
2.6 Business prospecting
To find businesses that might need MAATICA, we compile publicly available business information (business name, category, city, and public phone, email, website and social profile links) from open sources such as OpenStreetMap, Overture Maps and public websites and directories. An AI assistant may draft a first message, but we never send automated messages: a person decides whether to contact a business. You can ask us to remove your business at nahuelramos.nr@gmail.com.
2.7 Technical logs
Our servers record technical logs (request time, IP address, user agent, errors) to keep the service secure and working.
3. How we use information
- To deliver each conversation to the business in real time and send its replies through the right channel.
- To generate automatic replies, summaries and suggestions for the business (section 4).
- To let the business pause the assistant, hand the conversation to a person, reply manually, tag and export its contacts.
- To keep the service secure, prevent abuse, fix errors and measure usage and costs.
- To answer you when you contact us.
Data from Meta platforms. We access Facebook, Instagram and WhatsApp data only through the permissions the business grants, and we use it only to provide MAATICA to that business, in line with the Meta Platform Terms and Developer Policies. We do not sell, license or buy that data, we do not use it for advertising or to build profiles outside the service, and we do not share it with data brokers.
4. Artificial intelligence
- Replies, summaries, intent detection and suggestions are produced by large language models that run inside Amazon Bedrock, in the AWS account that hosts MAATICA. Depending on the feature and the business's configuration, these are models developed by Anthropic (Claude), Amazon (Nova, Titan for search indexing) or Meta (Llama).
- According to AWS, Amazon Bedrock does not use prompts or outputs to train models and does not share them with the model developers. Sentiment scores may also be computed with Amazon Comprehend, which AWS operates under the AWS Service Terms.
- We do not train or fine-tune AI models with conversations.
- The business can switch the assistant off for any conversation and reply as a person. Follow-up messages that the AI drafts are sent only when an operator decides to send them.
- AI can make mistakes. The business remains responsible for supervising the replies sent in its name.
5. Features that apply only when a business enables them
The following features are being added. Each one applies only if the business turns it on and grants the corresponding Meta permission.
- WhatsApp Business app coexistencewhen enabled: if the business connects a number that it also uses in the WhatsApp Business app and accepts the sync, we import its contacts (names and phone numbers) and up to 180 days of chat history from that app.
- Instagram insightswhen enabled: metrics of the business's own posts and account (reach, views, saves, shares, interactions, follower changes).
- Competitor and hashtag analysiswhen enabled: public information of Instagram professional accounts and public hashtag results (for example follower counts and public posts) that the business chooses to follow. Content Intel can already read public data of the competitor accounts that the business names.
- Meta Ads insightswhen enabled: read-only performance data of the business's ad accounts (spend, impressions, reach, clicks, CTR, CPC, CPM and results). MAATICA does not create or change ads.
- Lead Adswhen enabled: the answers people submit in the business's Facebook or Instagram lead forms (only the fields the business defines), linked to the ad and form, shown in the inbox so the business can follow up, for example with an approved WhatsApp template.
5.1 Google accounts (Calendar, Sheets, Drive, Docs and Gmail)
A business can connect its own Google account in Settings > Connectors. We ask only for the permissions of the services it connects, and Google shows them on its consent screen:
- Google Calendar: the list of calendars (
calendar.calendarlist.readonly), free/busy times (calendar.events.freebusy) and the events MAATICA creates, moves or cancels (calendar.events). Used to avoid offering appointment slots that are already busy, to add booked appointments to the business's calendar, and to answer the team's questions about its agenda. - Google Sheets (
drive.file): only the spreadsheets that the user picks with the Google file picker in MAATICA, or that MAATICA created, for example a price list or a sales log. We cannot see any other spreadsheet or file. - Google Drive and Docs (
drive.file): only files and documents that MAATICA created or that the user opened with MAATICA, kept in a "MAATICA" folder. We cannot see any other file in the Drive. - Gmail (
gmail.send): sending an email from the connected account. Every email is shown to a member of the business's team and sent only after that person approves it. We cannot read the mailbox.
Google data is used only to provide these features to the business that connected the account. It is sent to the AI model (Amazon Bedrock) only as context for the request a team member makes, and the result can stay in that team's assistant history. Access tokens are stored encrypted on our AWS servers. The business can disconnect Google at any time in Settings > Connectors (we revoke the access and delete the token) or from its Google account.
Limited Use. MAATICA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we do not use Google user data for advertising; we do not sell it; we do not use it to develop, improve or train generalized AI or machine-learning models; we transfer it only as needed to provide or improve the features the business uses, for security, or to comply with the law; and no person at MAATICA reads it unless the business asks us to (for example, for support), it is needed for security or abuse investigation, or the law requires it.
6. Who helps us process data (subprocessors)
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, database (DynamoDB), file storage (S3), encrypted secret storage (Secrets Manager), sign-in (Cognito), logs (CloudWatch), AI (Bedrock, Comprehend) | United States (us-east-1 and other US regions); see section 7 |
| Anthropic, Amazon, Meta (as AI model developers) | Their models run inside Amazon Bedrock; per AWS, they do not receive the prompts or outputs | Within AWS |
| Meta Platforms | Delivering and receiving WhatsApp, Instagram and Messenger messages; profile names; connected-account features. Meta also processes this data under its own policies. | Meta's infrastructure |
| Tiendanube, Mercado Libre | Only if the business connects them: catalog, orders, listings and questions | Their infrastructure |
| Reading a public Google Sheet the business links; fonts on our home page; Calendar, Sheets, Drive, Docs and Gmail only if the business connects its Google account (section 5.1) | Google's infrastructure |
We do not sell personal data. We may disclose data if the law requires it, to protect people's safety, or to the business customer that owns the conversation.
7. International transfers
MAATICA runs on AWS in the United States, mainly in the us-east-1 region. Some AI requests use Amazon Bedrock cross-region inference, which can process a request in another AWS region (for "global" model profiles, outside the United States). Data travels encrypted, and AWS applies its contractual and technical safeguards. If you are in Argentina, these are international transfers under Law 25.326.
8. How long we keep data
| Data | Retention |
|---|---|
| Conversations, messages and contacts | While the business is a customer. They are not deleted automatically: we delete them when the business or the person asks (within 30 days), and within 90 days after the business closes its account. |
| Assistant memory of a conversation | Short-term memory 24 hours; per-customer memory (preferences, products of interest) 90 days. |
| Profile-name cache | 24 hours. |
| Files uploaded by operators | 7 days. |
| Access tokens of connected accounts | Until the business asks us to delete them or removes MAATICA from its Facebook or Instagram settings (see Data deletion). Disconnecting a channel in MAATICA stops its use immediately. |
| Tiendanube catalog and orders | Catalog 60 days, orders 90 days (refreshed while connected). |
| Instagram content analysis | Own posts 90 days; public snapshots of competitor accounts 30 days. |
| Business-prospecting records | Until they are no longer useful or you ask us to remove them; unused drafts 90 days. |
| Application logs | 14 days (API access logs about 30 days; security audit logs 90 days). |
| Database backups | Deleted data can remain in point-in-time backups for up to 35 days. |
| Records of deletion requests | 400 days, without the requester's identifiers, to prove we handled them. |
The features in section 5, when enabled, follow the same rule as conversations, except Meta Ads metrics (13 months) and Lead Ads answers (24 months).
9. Security
- Encryption in transit (HTTPS/TLS) and at rest (AWS-managed keys for the database, file storage and secrets).
- Each business's data is isolated by tenant and every request is checked against the signed-in user's business.
- Access tokens stay on our servers. Incoming messages from Meta are verified with Meta's signatures.
- Multi-factor authentication (authenticator app) is available for dashboard accounts; it is optional, not mandatory. Passwords require at least 8 characters with upper and lower case letters, numbers and symbols.
- If a security incident affects personal data, we will notify the affected businesses and, where required, the authorities.
No system is perfectly secure. We do not hold security certifications.
10. Your rights
You can ask to access, correct, update or delete your personal data, to object to its processing, or to get a copy. In Argentina these rights are granted by Law 25.326; the Agency for Access to Public Information (AAIP) is the supervisory authority and handles complaints. Depending on where you live, other laws may give you similar rights.
- If you messaged a business that uses MAATICA, you can ask that business, or write to us at nahuelramos.nr@gmail.com and we will handle it together with the business.
- To delete your data, follow the steps in Data deletion.
- We answer within the time limits set by law (in Argentina, 10 calendar days for access and 5 business days for correction or deletion) and never later than 30 days.
11. Children
MAATICA is a tool for businesses and is not directed at children. Business customers must be adults. Businesses are responsible for how they handle conversations with minors on their channels.
12. Changes to this policy
We update this policy when the product changes. The date at the top shows the latest version. We will tell business customers about important changes by email before they take effect.
13. Contact
For privacy questions or requests: nahuelramos.nr@gmail.com. Spanish version: Política de privacidad.