Privacy Policy

1. Two kinds of data, two different roles

ListoChat is a service that answers WhatsApp messages on behalf of a business. That means two groups of people are involved, and our role is different with each:

• The business that subscribes to ListoChat (the owner or manager and the people who use the dashboard). For their data we are the controller.
• The customers who message that business on WhatsApp. For that data the controller is the business itself; ListoChat handles it only as a processor, following the business’s instructions and solely to provide the service to it. If you messaged a business on WhatsApp and want to exercise your rights over those messages, the privacy notice that applies is that business’s; you can also write to us and we will put you in touch with it.

2. Personal data we handle

From the business that subscribes to the service:

• Name, email address and dashboard login account details (managed through our authentication provider).
• Business details: trade name, services and prices, opening hours, time zone, reply tone and, if you upload one, a logo.
• WhatsApp Business connection details: the phone number ID and access credentials, which are stored encrypted.
• Billing details: processed by our payment provider. ListoChat does not store card numbers; we only keep the customer ID and the subscription status.

From the customers who message the business(handled on the business’s behalf):

• WhatsApp phone number and the profile name WhatsApp shares.
• The content of the messages they send and of the replies ListoChat sends, with their date and time.
• On the Plus plan, the appointment details: service, date and time, and the name and phone number it was booked under.

We do not deliberately handle sensitive personal data. If a customer writes it spontaneously in a message, it stays in the conversation history like any other text; we recommend that businesses not ask for sensitive information through this channel.

If you use the upload-a-document feature to extract your list of services, the document is processed on the spot and is not stored: only the services text you confirm is saved.

3. What we use this data for

We use the data for the following necessary purposes:

• Receiving the business’s WhatsApp messages and generating and sending the reply.
• Showing the business its conversations, alerts and calendar in the dashboard.
• Emailing the owner when a conversation needs their attention, and when an appointment is booked.
• On the Plus plan, checking real availability and recording, showing and reminding of appointments.
• Charging the subscription and managing the account status.
• Keeping the service running and secure: abuse prevention, troubleshooting and an automatic daily check that each business’s WhatsApp connection is still active.
• Complying with legal and tax obligations.

Non-necessary purposes, which you can refuse without affecting the service: sending you communications about new features or ListoChat news. To refuse, simply reply to any of those emails or write to hola@listochat.app.

We do not sell personal data, we do not use it for third-party advertising, and we do not use the content of a business’s conversations for anything other than providing the service to that same business.

4. Who it is shared with (transfers and remissions)

To operate, ListoChat relies on providers that handle data on our behalf. These are remissions (processing on our behalf): each provider may only use the data to provide its service to us. Some are outside Mexico, so data may be stored or processed abroad.

For security and commercial confidentiality we do not publish the identity of each provider. If you are a data subject or a business with an active account and need to know it, write to us at hola@listochat.app and we will tell you.

Beyond this, we only share data when a competent authority requires it under the law, or when necessary to defend our rights. Your consent is not required in those cases (art. 37 LFPDPPP). How we handle requests from authorities is explained in section 12.

5. How long we keep it

We keep the data while the business’s account is active. On cancellation, the business can ask us to delete its conversations and appointments and we handle it within 30 calendar days of the request; absent a request, we delete or anonymize them within 12 months of cancellation. Billing records are kept for the period tax law requires.

WhatsApp credentials are deleted immediately when the business disconnects its number or cancels the service.

To ask us to delete your data, follow the steps on our data deletion page.

6. How we protect the data

• Each business’s WhatsApp credentials are stored encrypted (AES-256-GCM), never in plain text.
• Each business sees onlyits own conversations, appointments and alerts: every dashboard query is limited to the signed-in business, so someone else’s identifier returns no information.
• We cryptographically verify the signature of every incoming WhatsApp message and every payment event before processing it.
• Communications travel encrypted (HTTPS/TLS).
• Dashboard access requires authentication; administrative access is limited to a closed list of people.

No system is infallible. If a breach significantly affecting your rights were to occur, we would inform you without delay, as the law requires.

7. Your ARCO rights and how to exercise them

You have the right to access your data, to rectify it when it is inaccurate, to cancel it when you consider it is not needed, and to object to its use for specific purposes. You can also revoke your consent or limit the use or disclosure of your data.

To exercise them, write to hola@listochat.app with your name, a way to reply to you, a clear description of what you are asking for and a document proving your identity (or your authority, if you act on someone else’s behalf). We will reply within a maximum of 20 business days and, if the request is granted, carry it out within the following 15 business days.

If you are a customer of a business that uses ListoChat, direct your request to that business, which is the controller of that data. If you write to us, we will pass it on to them.

If you believe your right to data protection was violated, you can go to the competent personal data protection authority in Mexico.

8. Cookies and similar technologies

The site and the dashboard only use cookies needed to keep you signed in, to secure access and to remember the language you picked. We do not use advertising cookies or third-party trackers, and we do no profiling for advertising purposes. You can block cookies in your browser, but then you will not be able to sign in to the dashboard.

9. Automated decisions

WhatsApp replies are generated by an artificial intelligence model from the information the business itself loaded. On the Plus plan, the assistant can also hold an appointment within the hours and services the business defined. These actions do not produce legal effects or significantly affect people: cancelling or rescheduling an appointment, and any case outside what was planned, always goes to a person at the business. The business can pause the assistant at any time from its dashboard.

10. Minors

ListoChat is not aimed at minors and we do not knowingly collect data from minors. If a business serves minors through this channel, it is responsible for obtaining consent from whoever holds parental authority or guardianship.

11. Changes to this notice

We may update this notice when our practices, our providers or the law change. The current version is always published on this page with its update date, and if the change is relevant we will email the businesses with an active account.

12. Requests from authorities

When a government, judicial or law enforcement authority asks us for data:

• We review its legality, with the help of a lawyer when needed: that it comes from a competent authority, in writing, states its legal basis and reasons, and was properly served.
• We challenge or ask to narrow requests that are overly broad, lack a legal basis or arrive outside a valid legal process.
• We disclose only the minimum data the law requires.
• We keep a record of every request: date, authority, what it asked for, what we disclosed and why.

Unless the law prohibits it, we notify the affected business. The full policy is on our government requests page.

13. Contact

Questions about this notice or about how your data is handled: hola@listochat.app. Address: Mazatlán, Sinaloa, México.