Urpi Privacy Policy
Last updated: November 6, 2026
This is a translation for convenience. The Spanish version at urpi.app/privacy is the legally binding one.
Urpi is a messaging and customer service tool for businesses. A business connects its WhatsApp number to Urpi, its clients write to that number, and the business replies from the Urpi app, with its team and with artificial intelligence (AI) agents.
This policy explains what data we process, how, why, for how long, and how to request its deletion. Deletion instructions are at urpi.app/en/data-deletion and the terms of service at urpi.app/en/terms.
1. The essentials
- If you write to a business on WhatsApp, that business decides about your data. Urpi processes it on the business's behalf and on its instructions.
- Your messages are stored and may be processed automatically by AI systems.
- Urpi does not use WhatsApp messages to train or improve AI models.
- Urpi does not sell personal data.
- You can request deletion of your data by writing to contact@urpi.app.
2. Who is who
Urpi is a service of Fernando Ismael Beltrán Martínez, domiciled in Ambato, Ecuador. His RUC (tax ID), full legal address and phone number are provided on signing up, and to any data subject who requests them at contact@urpi.app.
- Email: contact@urpi.app
| Person | What data | Who is the controller | Urpi's role |
|---|---|---|---|
| End client: someone who writes to a business on WhatsApp | Number, name, messages and related data | The business | Processor: processes the data in the name and on behalf of the business |
| Business member: someone who uses the Urpi app | Their account data | Urpi | Controller |
| Business member | Messages they write to clients | The business | Processor |
| Business | Its account, billing and connection data | Urpi | Controller |
The business has its own privacy policy, and it is the one that must inform you of its purposes and legal basis. This policy does not replace it.
Urpi uses Meta's WhatsApp Business Platform as a technology provider. Urpi is an independent product. Meta and WhatsApp do not sponsor or endorse Urpi.
3. If you write to a business on WhatsApp
3.1 What data we process
| Data | Where it comes from |
|---|---|
| Phone number | WhatsApp, when you write |
| Your WhatsApp profile name, if you share it | |
| Text of your messages and of the business's replies | You, the business and its AI agents |
| Identifiers, date and time of each message | |
| Delivery status (sent, delivered, read, failed) and read marks | WhatsApp and the Urpi app |
| Inputs and outputs of AI systems, which may include parts of your messages | Urpi's AI systems |
3.2 How and why we process it
On the business's behalf, Urpi:
- receives your messages through WhatsApp and stores them in a database;
- shows them to the business's team in the app, so they can read and reply;
- processes them with AI agents to understand your query and reply to you;
- sends the replies and records whether they were delivered and read.
Urpi does not use this data for its own purposes, for advertising or to build profiles of people. It does not share it with other businesses either: each business's data is kept separate.
3.3 Legal basis
The business, as controller, defines the legal basis. It is usually handling your order, a contractual relationship with you, or your consent. See the business's privacy policy.
The business's acceptance of our terms is not consent given on your behalf.
3.4 How long we keep it
We keep this data for 24 months from the client's last message, or for the period the business sets. We also delete it when it is no longer needed to provide the service, or if Urpi stops operating. If you or the business request deletion, what is described at urpi.app/en/data-deletion applies.
3.5 Sensitive data and minors
Avoid sending health data or other sensitive data, full card numbers, bank accounts or identity documents through this channel.
WhatsApp does not tell us the age of the person writing. If you are under 15, your legal representative must authorize the processing of your data and act for you. If a business serves minors, it must take the additional measures the law requires.
4. Artificial intelligence
Urpi processes personal data through AI systems. This processing is automated. We do it on the business's behalf and for these purposes:
- Understanding the message. The message text is sent to an AI provider, which indicates what the person seems to want. This does not include your phone number as a separate field, but the text may contain personal data if you write it.
- Preparing and sending replies. AI agents generate replies according to how the business configures them.
- Recording what happened. We store the inputs and outputs of these systems, and usage and cost data.
AI replies may contain errors. The business's team can read the conversation and reply from the app. The business must offer you a clear way to talk to a person: ask for it in the same chat, or use the contact details in its profile.
Urpi does not use AI to make, by itself, decisions that produce legal effects on you. If a business makes such a decision based wholly or partly on automated assessments, you have the right not to be subject to it, to receive an explanation, to give your opinion and to challenge it. That right is exercised before the business. Urpi helps you with it.
4.1 Model training
Urpi does not use WhatsApp messages to train, fine-tune or improve AI models, nor anonymized, aggregated or derived versions of them, and does not authorize its AI providers to do so.
5. If you are a business or a business member
For this data, Urpi is the controller. It comes from you, the business or Meta.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email and password hash (we do not store the password itself) | Creating and managing the account; giving access to the app | Performance of the contract | For the contract and 1 year after |
| Business name, phone number and time zone | Providing the service and support | Performance of the contract | For the contract and 1 year after |
| Billing data you give us (such as legal name, RUC or ID number, email and address) | Issuing the subscription receipt and meeting tax duties. We do not store card data or process payments in the app | Performance of the contract and legal obligation | As long as tax law requires |
| Meta connection data: WhatsApp Business account, number and business portfolio identifiers; connected number; connection status | Connecting the number, sending and receiving messages | Performance of the contract | The account row stays as history for 1 year after disconnecting |
| WhatsApp token and number PIN, encrypted | Operating the number on the business's behalf | Performance of the contract | Until the number is disconnected. They are deleted immediately on disconnecting |
| Message templates: name, language, category, text, examples and Meta review status | Creating templates and following their review | Performance of the contract | For the contract and 1 year after |
| AI system usage and cost records | Calculating costs and operating the service | Performance of the contract | For the contract and 1 year after |
| Record of acceptance of the terms and of the business's policy: version, date and time, account, IP and device | Proving acceptance and performing the contract | Performance of the contract | 5 years after the contract ends |
| Public page with the business's privacy policy, if it uses our model: the business's name, address, phone and email | Publishing that policy, at the business's request | Performance of the contract | For the contract |
| Rights requests and their replies | Handling them and keeping a record, as the law requires | Legal obligation | 5 years |
We also use account and connection data to protect the service, detect improper access and comply with Meta's terms. If Meta asks, we give it the list of businesses using Urpi with their contact details.
5.1 Data we obtain from Meta
When a business connects its number through Meta's Embedded Signup, Urpi receives an access token and its account identifiers. We use two permissions:
whatsapp_business_messaging: receiving messages from the business's clients, sending replies from its number, and knowing delivery and read status.whatsapp_business_management: reading the connected number, subscribing our app to the account's events and cancelling that subscription, registering the number on the WhatsApp API, and creating and querying message templates.
We only process this data on behalf of the business, at its request and to provide the service to it.
5.2 What happens when a number is disconnected
When a number is disconnected, from the app or because Meta tells us our access ended, we delete its token and PIN and stop sending and receiving messages. This does not delete messages or clients: for that, see urpi.app/en/data-deletion.
6. Who we share data with
| Recipient | Why | Where |
|---|---|---|
| The business you write to | To serve you. It is the controller of your data | Its location |
| Meta (WhatsApp Business Platform) | Carrying messages and operating the connection | May be outside Ecuador |
| Cloud hosting providers | Hosting the app and the database | May be outside Ecuador |
| Artificial intelligence providers | Understanding messages and generating replies | May be outside Ecuador |
| Authorities | Only when the law requires it | Ecuador or another country, as applicable |
Meta applies its own terms and privacy rules.
Urpi hires hosting and AI providers to provide the service and does not authorize them to use the data for their own purposes. Some may be outside Ecuador, so data may leave the country. Urpi makes no other transfers of data to third parties for their own use. If that changes, we will first report the recipient, the purpose and the safeguards.
7. Your rights
You can exercise these rights free of charge:
- access;
- rectification and updating;
- deletion;
- objection;
- annulment;
- limitation and suspension of processing;
- portability: receiving your data in a structured, common, machine-readable format, under the conditions of the law;
- not being subject to a decision based solely or partly on automated assessments;
- revoking your consent at any time, if that was the basis of the processing. Revocation does not affect what was processed before.
7.1 How to exercise them
Write to contact@urpi.app. State your names, ID or passport number, an email or reply address, the data concerned and what you request, and attach anything that supports your request. We must verify your identity or representation.
If you are a client of a business, the fastest way is to ask the business. If you write to us, also tell us which business you wrote to and from which number. We will forward your request to the business within 2 working days, let you know, and support you in getting a reply. If you request deletion, we will delete your data within the stated period even if the business does not reply, except what a law requires keeping. Anyone can request it: see urpi.app/en/data-deletion.
7.2 Deadlines
| Request | Maximum time |
|---|---|
| Suspension of processing | 3 working days |
| Revocation of consent | 3 working days |
| Any other rights request | 10 working days |
If information is missing, we may ask for clarification once, within 5 working days. You will have 10 working days to give it. We record each request and its reply.
7.3 Complaints
If you get no reply or disagree with it, you can complain to Urpi at contact@urpi.app, and file a complaint with Ecuador's Superintendencia de Protección de Datos Personales through its digital channels at spdp.gob.ec. You can also use any civil, criminal or constitutional actions that apply.
8. What happens if you don't provide your data or it is wrong
- End clients: WhatsApp delivers your number and message when you write. If you don't want them processed, don't write to the business through this channel and use another of its contact routes. If your data is wrong, the business may not serve you well.
- Businesses and members: without account and billing data we cannot provide the service. If it is wrong, you may lose access or receive incorrect invoices.
9. Databases, other purposes and security
Your data is stored in a Urpi database, hosted as stated in section 6.
We only use data for the purposes described here. If we want to use it for a new purpose as controller, we will tell you first.
We protect data with administrative, technical and physical measures. Among them: the token and PIN are stored encrypted, we verify the signature of events arriving from WhatsApp, and each business's data is kept separate. No system is infallible. If a breach puts your rights at risk, you will be notified within the legal deadlines.
To report a security vulnerability, write to contact@urpi.app.
10. Changes to this policy
We will publish any change on this page with its date. If an important change affects your rights, we will notify you first through the available means.