Privacy Policy.

1. Who we are

Kualy® is a lead intelligence platform that helps businesses capture, qualify, and manage their sales prospects. Our platform includes a CRM, an AI-powered WhatsApp chatbot, and integrations with Google Calendar and Meta.

Legal identification of the data controller (responsable)

Pursuant to article 16 of the Mexican Federal Law on Protection of Personal Data (LFPDPPP), the party responsible for the processing of personal data through Kualy® is:

2. What data we collect

Account data

• Full name and email address (required to create an account)
• Authentication data via Google OAuth (if you choose to sign in with Google)
• Password (stored encrypted — we never see it in plain text)

Usage data

• Pages visited and actions taken within the platform
• IP address, browser type, and device information
• Session duration and frequency of use

Lead data (your customers' data)

• Contact information captured through your forms or WhatsApp bot
• Conversation history with the AI chatbot
• Lead scores and qualification data generated by Kualy's AI

3. Use of Artificial Intelligence

What the AI does

• Automated message responses: generates replies to leads on WhatsApp based on the business context the user configures.
• Lead scoring: automatically classifies leads as Hot, Warm, or Cold based on conversation signals (intent, budget, urgency, fit).
• Bot configuration: generates initial bot personality and response patterns during onboarding based on the business description you provide.

AI provider and data processing

The AI is powered by Google's Gemini API. To generate responses and scores, we send the following data to Google:

• The content of conversation messages (lead messages and bot replies)
• The business context configured by the Kualy user (industry, services, tone)
• Aggregated lead information (name if shared, intent signals, conversation history)

We do not send payment information, passwords, or personal identification documents to the AI provider.

Important: data may be used to improve Google's services

Kualy® currently uses Google's free tier of the Gemini API. According to Google's API terms, content sent through the free tier may be used by Google to improve its services and train future AI models. We are evaluating migration to the paid enterprise tier (Vertex AI), where this does not occur. We will update this policy when the migration is complete.

Automated decisions and your rights

The lead scoring (Hot/Warm/Cold) is an automated decision made without human review at the moment of classification. This score may influence how the business prioritizes attention to a lead. You have the following rights:

• Right to information: understand the general criteria used to classify your lead.
• Right to human review: request that a person review and reconsider any automated decision that affects you.
• Right to object: request that your conversations not be processed by AI and be handled by humans only.
• Right to deletion of your score: request that your automated classification be deleted from our systems.

To exercise these rights, write to privacy@getkualy.com with your request and identification. We respond within 20 business days.

AI disclosure to leads

If you are a Kualy user (business), you agree that you are responsible for disclosing to your leads that they are interacting with an automated AI system when they message your WhatsApp number. This is required by EU AI Act Article 50, Meta WhatsApp Business Policy, and LFPDPPP Mexico.

4. How we use your data

• Provide the service: authenticate users, display dashboards, process leads
• Improve the platform: analyze usage patterns to fix bugs and improve features
• Communicate with you: send transactional emails (password reset, account confirmation)
• Security: detect and prevent fraud, abuse, and unauthorized access
• Legal compliance: comply with applicable laws and regulations

We do not use your data for advertising purposes or to build advertising profiles.

5. Data sharing

We do not sell, rent, or trade your personal data. We only share data with trusted service providers necessary to operate Kualy:

• Supabase — authentication and database hosting (data stored in the US)
• Vercel — web hosting and deployment (data stored in the US)
• Meta (WhatsApp Business API) — for Elite plan chatbot functionality
• Google — for Google OAuth sign-in and Calendar integration
• Google (Gemini API) — for AI-powered lead qualification, message generation, and lead scoring. Conversation content is sent to Google's Gemini API for processing.
• Stripe — for payment processing and subscription management. We do not store full card details; Stripe handles all payment data per their privacy policy.
• PostHog — for anonymized product analytics. Personally identifiable information is not used for analytics targeting.

All providers are contractually required to protect your data and may not use it for their own purposes.

6. Data retention

• Account data is retained for as long as your account is active
• Lead and CRM data is retained for the duration of your subscription
• After account deletion, data is purged within 30 days
• Anonymized analytics data may be retained indefinitely

7. Your rights

Depending on your location, you may have the following rights over your personal data:

• Access: request a copy of the data we hold about you
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your personal data
• Portability: request your data in a machine-readable format
• Objection: object to certain types of processing

To exercise any of these rights, contact us at privacy@getkualy.com

8. Cookies

Kualy uses minimal cookies — only those strictly necessary for authentication (session tokens) and security. We do not use advertising or tracking cookies.

9. Security

• All data is transmitted over HTTPS/TLS encryption
• Passwords are hashed using bcrypt — we never store plain-text passwords
• Access to production data is restricted to authorized personnel only
• We conduct regular security reviews of our infrastructure

10. Contact

For privacy-related questions or to exercise your rights:

We will respond to all privacy requests within 30 business days.

If you are not satisfied with our response

If you believe your rights under LFPDPPP have not been properly addressed, you may file a complaint before the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI):

• Website: home.inai.org.mx
• TELINAI: 800 835 4324 (toll-free in Mexico)
• Email: atencion@inai.org.mx