Privacy Policy

2. What data is collected

Recauda.ai processes only the data strictly necessary to manage collections:

• End customer data: names, phone numbers, emails, and national or tax identification.
• Payment receipt images, which may include bank details and amounts.
• The content of WhatsApp messages exchanged with the end customer.
• Client company data: legal name, tax ID (RUC), bank details, and contact details of its users.

3. How data is used and legal basis

Data is used to send reminders and account statements over WhatsApp, generate payment links, receive and validate receipts, generate receipt documents, and record payments in the company accounting.

The basis for processing is the performance of the contractual relationship between the company and its end customer, compliance with legal and accounting obligations, and the legitimate interest in managing collections in an orderly way. The client company is responsible for having a legal basis to contact its customers.

4. Subprocessors

To provide the service, Recauda.ai relies on providers that process data on its behalf:

• OpenAI: processes message text to classify intent and answer the FAQ.
• Twilio: sends and receives WhatsApp messages, including numbers, messages, and media.
• Google Cloud: stores receipts and hosts the application.
• Intuit (QuickBooks Online): receives customers, invoices, and amounts, only if the company connects its account.

5. International transfers

The subprocessors above operate infrastructure located outside Panama. As a result, processing may involve the international transfer of personal data to different jurisdictions.

These transfers are made only to providers that offer adequate contractual and technical safeguards for data protection.

6. Retention

Data is retained while there is an active relationship with the client company and for the periods required by applicable legal and accounting obligations.

Recauda.ai applies soft-delete: records marked as deleted stop being operational but may be retained for audit and compliance purposes, and are later purged according to the retention policy.

7. Data subject rights

Under Law 81 of 2019, data subjects may exercise their rights of access, rectification, and deletion, among others.

Since in most cases the client company is the data controller, requests from end customers are handled through that company. Recauda.ai works with the company to address such requests and can receive inquiries at info@oruslabs.ai.

8. Security

Recauda.ai applies technical and organizational measures to protect data: encryption of third-party credentials, strict isolation between companies, an audit log, passwords protected with Argon2, and encrypted file storage.

To request the details of these measures, write to info@oruslabs.ai.

9. Contact

For any question about this policy, the processing of personal data, or general legal matters, write to info@oruslabs.ai.