1. Data Controller
Tenkiu SAS, NIT 123456789-0, headquartered in Ibagué, Colombia. Contact: contact@tenkiu.app
2. Data We Collect
- Identification: name, phone number, optional email.
- Messaging data: metadata and content needed to process orders (retained for 6 months).
- Voice messages: audio files and transcriptions when you send voice messages via WhatsApp.
- Approximate location: to match merchants with nearby customers.
- Usage & cookies: anonymous analytics to improve the experience.
3. Purposes
- Authenticate and link the merchant's WhatsApp number.
- Process orders, deliveries, and Tenkius transactions.
- Provide AI-powered customer service and order automation.
- Generate AI content and performance metrics.
- Transcribe voice messages for text-based processing.
- Billing, accounting, and legal compliance.
4. Legal Basis
User consent and execution of the service contract. Compliance with legal obligations (billing, fraud prevention).
5. Data Retention
Account data: while the account is active. Message history: up to 6 months. Voice messages and transcriptions: up to 6 months. Accounting records: 5 years. After retention periods, data may be anonymized or deleted.
6. Data Sharing & Third-Party Processors
Your data may be shared with the following third parties under strict confidentiality and data processing agreements:
- Cloud Infrastructure: Firebase, Google Cloud Platform (data storage, hosting).
- Payment Gateways: For processing Tenkius purchases and transactions.
- AI Service Providers: OpenAI and Anthropic (Claude) process WhatsApp messages to provide automated customer service, order processing, and product recommendations. These providers act as data processors and are contractually prohibited from using your data for their own purposes, including AI model training.
- WhatsApp / Meta Platforms: To send and receive business messages via WhatsApp Business API.
- Legal Authorities: When required by law or to protect our legal rights.
6.1 AI Processing of WhatsApp Messages
When you interact with a business via WhatsApp on Tenkiu, your messages may be processed by artificial intelligence systems (OpenAI GPT-4 and Anthropic Claude) to:
- Understand your inquiries and provide relevant responses
- Process orders and calculate totals
- Recommend products from the business catalog
- Transcribe voice messages (with your consent)
Important Guarantees:
- ✅ Your conversation data is used exclusively to provide Tenkiu services
- ✅ AI providers are contractually prohibited from training their models on your data
- ✅ Your data is not shared with other businesses or used for marketing
- ✅ Message content is retained for a maximum of 6 months
- ✅ Business owners can disable AI processing through their dashboard at any time
6.2 WhatsApp Business Solution Compliance
Tenkiu complies with the WhatsApp Business Solution Terms (effective January 15, 2026), including:
- We do not track or build individual user profiles from WhatsApp data (beyond message content needed for service delivery)
- We do not sell, license, or distribute WhatsApp conversation data to third parties
- AI providers process data as Third Party Service Providers under strict contractual obligations
- Business Solution Data is not used to train AI models
- We maintain appropriate security measures to protect your WhatsApp conversations
7. Meta / WhatsApp Business API Processing
To send and receive messages via WhatsApp, your data (phone number, messages, and interactions) is processed by Meta Platforms, Inc. according to their Privacy Policy: https://www.facebook.com/about/privacy.
Our Privacy Policy URL is configured in the "Privacy Policy URL" field of the Meta Developer Portal and the WhatsApp Business Account settings.
By using the Embedded Signup flow, you authorize Meta to verify and activate your WhatsApp Business Account.
8. Data Subject Rights
You have the following rights regarding your personal data:
- Access: Request a copy of your data
- Rectification: Correct inaccurate information
- Erasure: Delete your account and associated data
- Objection: Object to specific data processing activities
- Portability: Export your data in machine-readable format
- Restriction: Limit processing in certain circumstances
All data subject requests can be submitted via contact@tenkiu.app. We will respond within 30 days.
Note: Business owners control whether AI is enabled for their WhatsApp conversations. If you have concerns about AI processing of your messages, please contact the business directly.
9. Voice Message Processing
If you send voice messages via WhatsApp, they may be transcribed using AI technology (OpenAI Whisper or Google Cloud Speech-to-Text) to enable text-based processing and search.
What we do:
- Store original audio files securely in Firebase Storage
- Generate text transcriptions for internal processing
- Use transcriptions to provide AI-powered responses
- Retain audio files for the same period as text messages (6 months)
Your rights:
- You can request deletion of voice messages at any time
- Audio files and transcriptions are not shared with other users or businesses
- AI providers may temporarily process audio for transcription but do not retain copies
10. Security Measures
TLS encryption, OTP hashing, role-based access control, encrypted backups.
11. Cookies
We use first- and third-party cookies for analytics (Google Analytics) and functionality. You can manage preferences in your browser settings.
12. Policy Changes
Updates will be published on this page and significant changes notified 30 days in advance.
13. DPO Contact
Data Protection Officer: contact@tenkiu.app
14. Shopkeeper-Specific Privacy Terms
If you operate a business on Tenkiu, additional data processing terms apply:
14.1 Shopkeeper as Data Controller
Critical: As a business owner using Tenkiu's WhatsApp integration, you are the Data Controller for all customer data collected through your WhatsApp conversations, including:
- Customer phone numbers and names
- Message content and conversation history
- Voice messages and transcriptions
- Order information (items, delivery addresses, payment details)
- Customer location data (if shared)
Tenkiu acts as your Data Processor, processing this data on your behalf according to your instructions and our agreement.
14.2 Your Data Protection Obligations
As a Data Controller, you must:
- Obtain customer consent: Ensure customers understand their messages will be processed by AI systems
- Respond to data requests: Handle customer requests for access, deletion, or correction of their data
- Maintain data security: Protect customer data you access through Tenkiu's platform
- Comply with data protection laws: Follow applicable regulations (GDPR, Colombian data protection law, etc.)
- Have a Privacy Policy: Inform your customers about how you process their personal data
- Report data breaches: Notify authorities and affected customers if a data breach occurs
14.3 Data We Collect About Shopkeepers
In addition to basic account data, we collect from shopkeepers:
- Business Information: Business name, type, description, location, operating hours
- WhatsApp Business Account Data: Phone number, business verification status, messaging limits
- Product Catalog: Product names, descriptions, prices, images, inventory levels
- Customer Conversations: Message history between you and your customers (retained for 6 months)
- Order Data: Orders created through your WhatsApp assistant, including customer details
- AI Configuration: Your AI settings, custom instructions, response style preferences
- Usage Analytics: AI message counts, Tenkius consumption, conversation metrics
- Payment Information: Wompi configuration, transaction history (if using payment integration)
14.4 How We Use Shopkeeper Data
- To provide WhatsApp Business API messaging services
- To process customer messages through AI systems on your behalf
- To manage order creation, updates, and fulfillment workflows
- To generate performance analytics and business insights
- To bill for AI usage and Tenkius consumption
- To improve AI response quality and platform features
- To comply with WhatsApp Business Solution Terms and Meta policies
- To detect and prevent fraud or policy violations
14.5 Data Sharing for Shopkeeper Services
Your business data may be shared with:
- Meta/WhatsApp: Business verification, message delivery, WhatsApp Business Account management
- AI Providers (OpenAI/Anthropic): Customer message processing on your behalf (as your Data Processor)
- Payment Processors (Wompi): If you enable payment integration for your customers
- Delivery Couriers: If you use Tenkiu's delivery assignment features (order details shared with assigned couriers)
- Your Customers: Through automated AI responses and order confirmations
14.6 Customer Data Access & Deletion
- You can view your customer conversations through the Tenkiu dashboard
- You can request conversation data exports by contacting contact@tenkiu.app
- If you delete your business account, all associated customer conversations are deleted within 30 days
- Conversation data is retained for up to 6 months, after which it may be deleted
- Customers can request deletion of their data either through you (as Data Controller) or by contacting Tenkiu at contact@tenkiu.app. When Tenkiu receives a deletion request, we will delete the data from our systems and notify you to delete it from your records as well.
14.7 AI Processing on Your Behalf
When AI systems process your customer messages:
- AI acts as a sub-processor under our data processing agreement with you
- Customer messages are sent to AI providers (OpenAI/Anthropic) only for generating responses
- AI providers are contractually prohibited from using your customer data for training or other purposes
- You can disable AI processing at any time through your dashboard settings
- You remain responsible for ensuring AI responses comply with your legal obligations
14.8 Your Responsibilities
As a business owner on Tenkiu, you are responsible for:
- ✅ Informing your customers that their messages may be processed by AI
- ✅ Obtaining necessary consents for data processing under applicable laws
- ✅ Responding to customer data subject requests (access, deletion, correction)
- ✅ Maintaining your own privacy policy that covers your use of Tenkiu services
- ✅ Protecting customer data you access through Tenkiu's platform
- ✅ Complying with all applicable data protection laws in your jurisdiction
- ✅ Notifying customers and authorities in case of data breaches