Privacy Policy

Last updated: September 23, 2026.

Data controller

This Privacy Policy describes how personal data is collected, processed, retained and protected on the dojosell.com website, the app.dojosell.com platform and the artificial-intelligence chatbot service named "Ki" (together, the "Service").

• Controller: Gonzalo Patricio Ayesa
• CUIT (Argentine taxpayer ID): 23-27319089-9 (Monotributista — simplified tax regime)
• Address: Ciudadela 2027, Don Bosco, Partido de Quilmes, Province of Buenos Aires, Argentine Republic
• Email for privacy matters: legal@dojosell.com

Hereinafter, "Dojosell", "the Controller" or "we". The processing of personal data is governed by Law No. 25,326 on the Protection of Personal Data of the Argentine Republic, its Regulatory Decree No. 1558/2001 and the complementary rules issued by the Agency for Access to Public Information.

This Policy complements the Terms and Conditions of Use. In the event of any conflict between the two documents regarding personal data, this Policy prevails.

1. Who this Policy applies to

We distinguish two groups of people, because the data we process about each of them and our role regarding them are different:

• The Client: the individual or legal entity that creates an account at app.dojosell.com and contracts the Service for their own website or online store. Regarding their data, Dojosell acts as controller.
• The Visitor: the person who chats with the Ki assistant installed on a Client's website. Regarding those conversations, the controller of the data is the Client who installed the assistant, and Dojosell acts solely as processor on the Client's behalf and instructions, in accordance with Article 25 of Law No. 25,326.

This distinction matters: if you chatted with a Ki assistant on a business's website and wish to exercise rights over that conversation, you may contact that business or write to us at legal@dojosell.com and we will handle your request.

2. Data we collect from the Client

When you create an account and use the Service, we collect:

• Registration data: name, email address, password (stored in encrypted form, never in readable text), business website address and preferred language.
• Assistant configuration data: business name, type of activity, bot name and personality, welcome message, colours, custom instructions, contact email and scheduling settings.
• Documents the Client voluntarily uploads: catalogues, FAQs, terms and conditions or other files whose content the assistant uses to answer. Their content is determined exclusively by the Client.
• Billing and payment data: contracted plan, subscription dates and status, and transaction identifiers. We do not store credit card numbers or complete financial data: payment is processed entirely on the systems of Mercado Pago or Stripe, which act as controllers of that information.
• Data if you sign in with Google: name, email address and account identifier, provided by Google when you authorise access.
• Connected store data: if the Client voluntarily links their online store to Dojosell, we store that store's identifier, the access credential the platform gives us and the list of permissions the Client granted. That credential is what allows us to query the store on the Client's behalf; the Client may revoke it at any time by uninstalling the application from their platform's panel or, on WooCommerce, by deleting the access keys from their site's panel. We also store a copy of the synchronised catalogue (products, prices and availability), which contains no personal data.
• Pro trial record: the free Pro plan trial is granted only once per store and per email address. To enforce this, when we grant it we store the store's identifier and a derived, irreversible value (hash) of the account's email address, calculated on its basic form (without "+" aliases and, for Gmail, without dots). We do not store the address itself, and the hash does not allow it to be recovered.

3. Data processed in the assistant's conversations

When a Visitor chats with a Ki assistant, we store the text of that conversation, the date, the number of messages exchanged and, where applicable, the data the Visitor provided to book an appointment (name, email address and telephone number).

On this point we make the following commitments, which are implemented in the system:

• We do not retain Visitors' IP addresses. To limit abuse of the service, a derived, irreversible value (hash) of the IP address is used, associated only with a daily message counter, which is automatically deleted on a periodic basis. The IP address itself is not stored.
• The Client may delete the content of conversations at any time from their panel, individually or in batches. Deletion is final and irreversible: the text of the messages is erased and only the statistical record that the conversation existed (date and number of messages) is kept, without its content.
• Automatic deletion after six months. The content of any conversation the Client has not deleted is automatically erased six months after the last message. The purpose of this feature is for the Client to spot what information is missing from their documents, and that period is sufficient for it.
• Dojosell does not access the content of its Clients' conversations or documents. Dojosell's internal administration panel shows only quantities and aggregated metrics; it does not allow conversations or documents to be read. This restriction is implemented in the system itself and does not depend on a discretionary decision.

Handover to a person. If the Client has entered a WhatsApp number or a contact email in their panel, the assistant may offer the Visitor to continue the conversation with a person. On accepting, the Visitor is sent to that external service — WhatsApp, for example — which belongs to a third party and is governed by its own policies. Dojosell does not transmit the content of the conversation or any Visitor data to that third party: it only opens the channel. What happens from then on is between the Visitor and the Client.

We recommend that Clients inform their Visitors, in their own privacy policy, that the site uses a conversational assistant. Furthermore, neither Dojosell nor the assistant requests sensitive data within the meaning of Article 2 of Law No. 25,326, and Visitors are advised not to provide it in the chat.

4. Data processed when looking up an order

Clients whose plan includes it may enable the assistant to inform the Visitor of their order status and, where the store's platform provides it, the shipment tracking, by querying the connected store at the time of the question. This feature processes data about a person who bought on the Client's site, so we describe it in detail.

• What the Visitor is asked for. The order number and the email address used for the purchase. The assistant only answers if both match that order exactly. If they do not match, the answer is generic and does not even reveal whether the order exists, so that nobody can find out other people's data by trying numbers.
• What is queried in the store. Order number, contact email (only for that verification), date, order, payment and shipping status, carrier, delivery method, name of the pick-up point where applicable, estimated timeframes, and tracking code and link.
• What is not queried. We do not request the buyer's address, telephone number or identity document from the platform. This limitation is implemented in the request we make to the store itself: that data never reaches our servers, so it cannot be recorded anywhere.
• What is kept. The order number and email address the Visitor types in the chat form part of the text of the conversation and are kept and deleted like the rest of it, as set out in sections 3 and 9. The information returned by the store is used to write the answer and is not stored separately.

Regarding this data, the controller remains the Client, as owner of the store and of the relationship with their buyer; Dojosell acts as processor, as with the rest of the conversations.

5. Technical data, cookies and analytics

We use cookies and similar technologies that are strictly necessary for the Service to work, in particular to keep the Client signed in to their panel. Without them the Service cannot operate.

In addition, the dojosell.com website uses Google Analytics and Google Ads to measure site usage and the effectiveness of advertising campaigns. These tools collect browsing data through Google's own cookies. You can review how Google processes that data in its own policies, and opt out of analytics using the opt-out add-ons Google provides or your browser settings.

The app.dojosell.com platform also records operational technical data, such as application errors, for the sole purpose of detecting and fixing faults.

6. Purpose of processing

Data is processed exclusively to:

• Create and manage the Client's account and give them access to the Service.
• Provide the contracted Service, including generating the assistant's answers from the information the Client has uploaded.
• Process payments and issue the corresponding documentation.
• Send essential operational communications: account confirmation, password reset, usage notices, trial expiry and subscription status.
• Answer the Visitor about their order status and, where the platform provides it, their shipment tracking, when the Client has enabled that feature.
• Provide technical support when the Client requests it.
• Detect and prevent abusive or fraudulent use or use contrary to the Terms and Conditions, including the repeated granting of the free Pro plan trial.
• Comply with legal, tax and accounting obligations.

We do not sell, rent or transfer personal data to third parties for commercial or advertising purposes. We do not use the content of Clients' conversations or documents to train artificial-intelligence models.

7. Third parties involved in processing

To provide the Service we rely on providers acting as processors, each limited to the purpose indicated:

• Anthropic PBC — processing the text of conversations using language models, in order to generate the assistant's answers.
• Railway Corp. — hosting of the application and the database.
• Resend — sending transactional emails.
• Functional Software, Inc. (Sentry) — logging of technical application errors.
• Mercado Pago and Stripe, Inc. — payment processing and subscription management.
• Google LLC — sign-in with a Google account, site analytics and advertising.
• Tiendanube / Nuvemshop — only for Clients who voluntarily connect their store. The connection is used to synchronise their product catalogue and, on the plans that include it, to query an order's status and shipment tracking when a Visitor asks. The permissions granted are read-only over products, orders and fulfilments, plus the one needed to install the assistant in the store.
• WooCommerce — only for Clients who voluntarily connect a WooCommerce store. In this case no third party is involved: the query is made directly to the Client's site, with read-only access keys that the Client authorises from their own site, to synchronise the product catalogue and, on the plans that include it, to query an order's status when a Visitor asks.

In addition, data may be disclosed to administrative or judicial authorities where there is a legal obligation to do so.

8. International data transfer

Several of the providers mentioned operate servers outside the Argentine Republic, mainly in the United States of America. Therefore, the processing of data involves an international transfer, which is carried out within the framework of Article 12 of Law No. 25,326 and its complementary rules, and is necessary for the performance of the contractual relationship with the Client. By using the Service, the Client gives informed consent to that transfer.

9. Retention periods

We keep each category of data only for as long as necessary to fulfil the purpose for which it was collected:

• Content of conversations: up to six months from the last message, or less if the Client deletes it earlier.
• Connected store credential: for as long as the integration remains linked. If the Client uninstalls the application from their platform, the credential ceases to be valid and cannot be used again.
• Account data, configuration and uploaded documents: for as long as the account remains active, which includes the time after the trial period ends: once the trial is over the assistant stops answering, but the configuration and documents are kept so that the Client can resume the Service where they left off. Upon cancellation or closure of the account, they are deleted within the following twelve months, unless a legal retention obligation remains.
• Pro trial record: the store identifier and the email address hash described in section 2 are kept even after the account is closed, for as long as Dojosell offers the free Pro plan trial, because their only purpose is to prevent it from being granted more than once to the same store or the same person. They are not used for any other purpose.
• Transaction records and documentation with tax or accounting effects: for a period of ten years, in accordance with the retention obligation set out in Article 328 of the Argentine Civil and Commercial Code and applicable tax regulations.
• Technical error logs: for short periods defined by the service provider, for the sole purpose of diagnosing faults.

The Client may request early deletion of their account at any time by writing to legal@dojosell.com, except for data subject to legal retention obligations.

10. Rights of the data subject

Every person has the right to request access to, rectification, updating and deletion of their personal data, and to object to certain processing, in accordance with Articles 14 to 16 of Law No. 25,326.

To exercise these rights, write to legal@dojosell.com stating your name, the email address associated with the account and the right you wish to exercise. We may ask you for additional information to verify your identity, for the sole purpose of preventing a third party from accessing someone else's data. Requests are answered within the legal deadlines: ten calendar days for access and five business days for rectification, updating or deletion.

The data subject has the right to exercise the right of access free of charge at intervals of no less than six months, unless a legitimate interest is shown, in accordance with Article 14, paragraph 3 of Law No. 25,326.

The Agency for Access to Public Information, as the Supervisory Authority of Law No. 25,326, has the power to handle complaints and claims filed in relation to non-compliance with personal data protection rules.

11. Information security

We adopt technical and organisational measures intended to preserve the confidentiality, integrity and availability of data, in accordance with Article 9 of Law No. 25,326. These include:

• Encryption of communications using HTTPS throughout the Service.
• Storage of passwords using cryptographic key-derivation functions, so that they cannot be recovered or read.
• Isolation of each Client's data: the system verifies on every operation that the requested information belongs to the account requesting it.
• Access restriction: the internal administration panel does not allow access to the content of Clients' conversations or documents.
• Authentication of notifications received from external platforms by verifying their cryptographic signature.
• Verification of the buyer's email address before reporting any order data, and a generic answer when verification fails.
• Minimisation at source: only the necessary fields are requested from the connected store, so data that is not used never enters the system.
• Error monitoring to detect anomalous behaviour.

No system is completely invulnerable. In the event of a security incident affecting personal data, we will take the appropriate corrective measures and notify those affected and the supervisory authority where required.

12. Minors

The Service is intended exclusively for persons over 18 years of age with legal capacity to contract. We do not knowingly collect data from minors. If we become aware that a minor's data has been registered without due authorisation, we will delete it.

13. Changes to this Policy

We may update this Policy to reflect changes in the Service or in applicable regulations. The date of the last update is shown at the beginning of the document. When changes are substantial and affect the processing of Clients' data, we will notify them by email or through a notice in the panel, reasonably in advance of their entry into force.

14. Contact

For any enquiry, request or complaint relating to the processing of personal data, you may write to legal@dojosell.com.