Privacy policy

Expedientes SpA, RUT (Chilean tax ID) 78.537.143-7, domiciled in Rancagua, Chile («Expedientes»). For any matter regarding your personal data, write to us through the contact form (in Spanish).

Your data as a user. If you create an account or sign in to Expedientes, we process your data to provide you the service. We are the controller of that data, and this policy describes it.

Your clients' data. What you store in your account about your clients —their names, contacts, documents and matters— is your decision: you are the controller of that processing and Expedientes is the processor. We process it only to provide you the service, following your instructions, and not for our own purposes. If a client of yours wants to exercise their rights over that data, they must contact you; we help you with whatever you need to respond to them. The conditions of that engagement are in section 7 of the Terms of service.

If you do not have an account and a professional asks you for documents or sends you documents. You come in through a link you receive by email, and for that we process your email, a verification code, what you upload and your IP address. What you upload or receive is part of the account of the professional who requested it, and they are the controller; we protect access to the link, so that no one but you uses it.

• Identification and access: your name, your email and your password. The password is stored as an irreversible hash; no one, including us, can read it.
• Account and billing: your account name, country, time zone, the billing details you register, and the history of payments and tax documents. If you pay month to month by card, what the payment provider lets us see of it: the brand and the last four digits. For each payment attempt, when it was made, from which IP address and with which browser: that is what makes it possible to respond to a dispute over a charge.
• Use of the service: when you sign in, from which application, failed sign-in attempts, and what you do in your account, which stays in its history for you and your team.
• Support: whatever you write to us when you contact us.

We do not collect data about you from other sources and we do not use advertising trackers.

• To provide you the service you signed up for: creating your account, letting you sign in, storing your information and charging you. Basis: performance of the contract.
• Security: detecting unauthorized access attempts, locking credentials after failed attempts, and logging what our team does on your account. Basis: our legitimate interest in protecting the service and yours in protecting your information.
• Legal obligations: issuing and keeping tax documents. Basis: compliance with the law.
• Notifying you of what happens with your account: a failed charge, an invitation, a link to change your password. We do not send commercial emails without your consent.

We do not make automated decisions that affect you, we do not create profiles, and we do not use your data for advertising. The service is not intended for people under 18, and we do not knowingly process data of minors as users.

Only with those we need to operate the service, and only what they need to do their part:

• Hosting: Akamai (Linode), with servers in Los Angeles, United States. The application and the database, encrypted at rest, live there.
• Email: Postmark, from the United States, to send you the service's emails.
• Payments: Flow, from Chile, which processes payments and, if you pay month to month, stores your card to charge it. It receives your name, your email and the amount of each charge. Your card details are received by Flow, or by the payment method you choose on its page; we neither receive nor store them.
• Network: Cloudflare, from the United States. Everything that reaches Expedientes from the internet goes through its network, which protects it from attacks and delivers it to our servers. For that it sees your IP address and every request your browser makes, encrypted end to end; it does not keep the content of your account.
• Checking that you are a person: also Cloudflare, with its Turnstile service. When you sign in, create an account or request a link to change your password, your browser runs a check you do not see, to stop automated programs that try passwords or create accounts in bulk. For that, Cloudflare receives your IP address, technical data about your browser and connection, and the page where the check takes place; it does not receive your email or your password. Cloudflare uses that data to tell people from programs and to improve that detection, as it explains in its Turnstile privacy policy. If the check fails, you can turn off your VPN or blocker, or use another browser.

International transfer. Hosting, email and network are in the United States, so your data and your clients' data are stored and processed there. The United States does not currently have a decision declaring it a country with an adequate level of protection; the transfer relies on the data protection clauses each of those providers signs with us, under which they undertake to protect the data, to use it only to provide us the service, and not to disclose it. Flow is in Chile.

We do not sell your data or your clients' data, and we do not disclose it to third parties for their own purposes. If an authority requires it from us by law, we hand it over to the extent the law obliges us, and we inform you when possible.

AI assistants. Expedientes does not send data to artificial intelligence services on its own initiative. Your account can connect its own AI assistant, and is responsible for it: if an owner turns the feature on and an authorized person connects the assistant they chose, what that assistant reads from the account is sent to whoever provides that assistant, who may process it outside Chile. It is not our provider: it is chosen by whoever connects it, and Expedientes does not control what it does with that information. Your email and the account's billing details are not handed over to it. The conditions are in section 7 of the Terms of service.

• Personal data —emails, RUTs, phone numbers— is stored encrypted, and each document you upload is encrypted with its own key. The database is encrypted at rest.
• Our team does not see the content of your account: our internal tools do not show them your clients, matters, notes or documents. The only thing they can do with it is recover something deleted, at your request and with your approval, and that is logged.
• Everything our team does on an account or a person is recorded in a log with who did it, when and why.
• Credentials are locked after several failed attempts. You can close your open sessions from the application.
• If we suffer a security breach affecting your data, we notify the Agencia de Protección de Datos Personales (the Chilean data protection authority) and you, without delay, in the cases the law requires and whenever it may affect you; we also notify the owner of an account when it affects their clients' data, so they can meet their own obligations.

• While you have an account: what you store, for as long as the account exists. What you delete stays 30 days in the trash and up to 90 more days in retention, from where only our team can recover it at your request. «Eliminar definitivamente» (delete permanently) deletes immediately and without retention.
• When you delete the account: we keep its information —including the invoices and receipts you issued to your clients— for 90 days, and then delete it permanently. Within that period you can ask us for an export to take it with you.
• The invoices and receipts we issue to you for the service: for the time tax law requires.
• Access and security logs: 12 months.
• Consents to connect an AI assistant: each time a person connects an assistant, we record who did it, in which account, to which assistant, with which permissions, which text they accepted, when, from which IP address and with which browser. We also record how it ended: whether the person disconnected it, whether an owner removed their authorization or turned the feature off. We record the same when an owner turns the feature on or off and chooses who can use it. The IP address is stored encrypted. This record is not modified or deleted while the account exists, because it is the evidence of what each person authorized. Our team consults it when it is necessary to prove what was authorized and when.
• What each call from an AI assistant delivers: when it was, in which account, on behalf of which person, with which connection, which action it requested, and which clients, matters, notes or documents it received in the response. We store only the identifiers, never what the assistant searched for or the content it received. It serves to investigate a misused connection and to know what information got out if there is a security breach. Our team consults it only for that. We keep it for 12 months.
• The data of each payment attempt —when, from which IP address and with which browser—: for as long as that charge can be disputed, because it is what makes it possible to respond to the dispute.
• Pending sign-ups: if you sign up and do not verify your email, the sign-up is discarded when the link expires.

You have the right to access your data, to rectify it, to request its erasure, to object to a processing, to the portability of the data you gave us, and to have its processing blocked while a complaint is resolved.

Much of this you can do yourself from the application: see and correct your name and email, change your password, and delete your account. For portability, we prepare an export of your information at your request. For everything else, write to us through the contact form (in Spanish), stating which right you are exercising. We respond within the legal period, and if the request does not apply we explain why.

If you are not satisfied with our response, you can file a complaint with the Agencia de Protección de Datos Personales.

We use only the cookies needed to keep your session open and to remember interface preferences, such as the theme. We do not use advertising or cross-site tracking cookies.

If we change this policy we will notify you by email and in the application, at least 30 days in advance when the change is relevant. The current version is always on this page.