Login

Personal Data Processing Policy

Personal Data Processing Policy – DatSOR

Effective Date: July 14, 2025 (Updated in June 15th, 2026)

DatSOR, a brand of 17466382 CANADA INC. (hereinafter, “DatSOR”, “we”, “us”, or “our”), a corporation legally incorporated under the laws of Canada, is committed to protecting the personal information of our website visitors, clients, partners, and collaborators, as well as the personal data we process on behalf of our clients.

This Global Privacy Policy is designed to align with the most rigorous international regulatory frameworks, including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), the European Union’s General Data Protection Regulation (GDPR), the European Union Artificial Intelligence Act (EU AI Act) [1], the California Consumer Privacy Act (CCPA/CPRA), Brazil’s Lei Geral de Proteção de Dados (LGPD), and Latin American data protection laws, including but not limited to:

  • Colombia: Ley 1581 de 2012
  • Mexico: Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)
  • Peru: Ley N° 29733
  • Argentina: Ley N° 25.326

1. Scope of This Policy

This policy governs all personal data collected and processed by DatSOR through:

  • Our website: www.datsor.com (including registration forms, waiting lists, contact forms, and cookies).
  • Our AI-Powered Sales Automation Platform (“the Service”) when contracted and used by our business Clients.

2. Processing Roles: Data Controller vs. Data Processor

  • DatSOR as Data Controller: For contact information, registration details, billing information, and commercial data we collect directly from you (as a website visitor or business Client), DatSOR acts as the Data Controller. We determine the purposes and means of this processing.
  • DatSOR as Data Processor: For conversations, messages, contact details, and multimedia information of the End-Users interacting with our AI agents through the Client’s WhatsApp or Instagram accounts, the Client acts as the Data Controller. The Client determines the purpose of the interaction. DatSOR processes this data strictly on behalf of the Client and in accordance with their contractual instructions.

3. Information We Collect

A. Data Provided Directly by the Client or Visitor

  • Forms and Registration: Name, email address, phone number, company name, and job titles of representatives.
  • Billing Data: Financial information, billing address, and payment methods processed securely through third-party payment gateways.
  • AI Training and Configuration Data: Product catalogs, price lists, return policies, Frequently Asked Questions (FAQs), and any other commercial documentation provided by the Client to calibrate the AI agent. The Client guarantees they possess the necessary rights and authorizations to share this information.

B. End-User Data (Conversations and Multimedia)

  • Chat History: The full text of conversations held through the Client’s WhatsApp Business or Instagram Business accounts.
  • Multimedia Files: Photos, videos, voice notes, and documents sent by end-users during the chat.
  • Metadata: User identifiers, dates, timestamps of messages, and originating phone numbers.

C. Automatically Collected Information

  • IP addresses, browser type, operating system, referring URLs, pages visited, and timestamps collected through essential and analytical cookies.

4. Legal Basis for Processing (DatSOR as Controller)

We process personal information of our clients and website visitors based on the following legal grounds:

  1. Consent: For sending newsletters, marketing communications, or signing up for waiting lists.
  2. Contractual Necessity: To enable your account, process payments, and deliver the AI Sales Agent Service.
  3. Legal Obligation: To comply with tax, corporate, and security laws in Canada and other applicable jurisdictions.
  4. Legitimate Interests: To optimize the security of our website, prevent fraud, and improve the technical performance of our platform, provided these interests do not override your fundamental rights.

5. Use of Information and Artificial Intelligence Operations

A. Service Functionality and AI Training

  • Specific Training: The commercial information and catalogs provided by the Client are used exclusively to train and calibrate the AI agent assigned to that Client’s account. DatSOR does not use a Client’s private or commercial information to train general-purpose language models, safeguarding the Client’s intellectual property and trade secrets.
  • Model Optimization & Meta AI Restraints: To improve our platform’s performance, DatSOR may analyze aggregated, anonymized, and de-identified technical usage metrics (such as API call latencies, volume patterns, and error logs) to optimize our SaaS infrastructure. In strict compliance with Meta’s Developer Policies, DatSOR does not, and will not, use Customer Data (conversational texts, metadata, or messaging logs passing through Meta’s WhatsApp or Instagram APIs) to train or fine-tune general-purpose artificial intelligence models or third-party large language models (LLMs).

B. Multimedia Processing and Content Generation

  • Visual Editing and Generation: Subject to the Client purchasing our AI Marketing Plan, our designated employees and authorized personnel may process photos and videos provided as User Content to edit, optimize, or generate promotional assets on behalf of the Client. The Client acknowledges and agrees that they do not have direct access, user accounts, or licenses to these underlying design and editing tools.
  • Authorized Sub-processors and Third-Party Safeguards: Multimedia processing under the AI Marketing Plan is performed securely through professional third-party platforms, specifically Nano Banana. DatSOR maintains strict agreements with Nano Banana prohibiting them from utilizing our Clients’ or End-Customers’ multimedia files to train their own commercial models. The Client is encouraged to review their privacy practices directly at: Nano Banana Privacy Policy: https://nanobanana.com/privacy-policy
  • AI Transparency: In compliance with the EU AI Act and global transparency standards, multimedia content generated or significantly modified by our AI systems will include origin metadata or transparent digital watermarks indicating its artificial creation.

6. International Data Transfers and Sub-processing

To provide continuous global services, personal data is stored and processed in data centers located in the United States and Canada, under Amazon Web Services (AWS) infrastructure, and may be securely transferred to specialized technology sub-processors (such as language and image processing API providers).

By using our Service or Website, you understand that your information may be transferred outside your country of residence. DatSOR implements international transfer mechanisms, such as Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring a level of data protection substantially equivalent to the standards required in your home country.

7. How We Share Information

DatSOR does not sell, rent, or trade personal data belonging to its clients or end-users. We only share information under the following circumstances:

  • With the Client: All chat histories and multimedia processed by the AI are shared directly with the corresponding Client, who is the Data Controller of that data.
  • With Authorized Sub-processors: Cloud infrastructure providers (AWS), our authorized secure payment gateways or merchants of record (such as PCI-DSS compliant providers), and specialized multimedia and AI processing platforms (specifically Nano Banana, whose privacy practices can be reviewed at https://nanobanana.com/privacy-policy), operating under strict contractual obligations of confidentiality and security in accordance with applicable laws.
  • With Meta Platforms: Data transmitted through WhatsApp and Instagram Business is additionally governed by Meta’s privacy policies and terms.
  • Legal Compliance: When required by a court order or competent government authority under Canadian law or other applicable jurisdictions.

8. Data Security and Retention

  • Security: We implement advanced technical, administrative, and organizational measures (such as SSL/TLS encryption in transit, encryption at rest, strict access controls, and internal audits) to safeguard information against loss, theft, or unauthorized access.
  • Client Data Retention: We retain Client data as long as the commercial relationship remains active and for the applicable legal statute of limitations (typically between 5 and 7 years due to Canadian tax regulations).
  • Chat Retention (End-Users):  DatSOR retains conversational data in accordance with the terms of your Service Agreement. 
  • Standard Native Accounts: Conversation histories on standard Meta accounts are stored natively and are governed by Meta’s policies and your own account configurations. 
  • Website Chat & Direct WhatsApp API Lines: Conversational logs processed through direct WhatsApp API (Cloud API) integrations or Website Chat are hosted on our secure AWS infrastructure. Upon termination of your Service Agreement, access to these histories via our platform will cease immediately. To comply with data minimization requirements, all such data will be permanently and securely deleted or irreversibly anonymized from our active servers within thirty (30) days post-termination, unless a prior export is requested by the Client as outlined in our Terms and Conditions.

9. Responsibilities of Our Clients (As Data Controllers)

Since the Client acts as the Data Controller for their End-Users’ data, the Client agrees to:

  1. Legal Basis: Obtain informed consent from their users or possess a valid legal ground to collect their data and interactions through channels like WhatsApp or Instagram.
  2. Transparency Notices: Provide a visible privacy notice to end-users explaining that AI-powered conversational agents are used and that their data is processed by third-party providers (such as DatSOR) for commercial management.
  3. Rights Requests: Directly address and manage data rights requests submitted by their end-users. DatSOR will provide reasonable technical assistance in accordance with the signed service agreement.

10. Data Subject Rights (including ARCO Rights)

Depending on your jurisdiction (Canada, European Union, USA, or Latin America), data subjects have the right to:

  • Access the personal data we hold about them.
  • Rectify or update inaccurate or incomplete data.
  • Erasure/Deletion of their personal data when it is no longer necessary for the purposes for which it was collected.
  • Object to or restrict the processing of their data for specific purposes (such as direct marketing).
  • Portability of their data in a structured, commonly used format.
  • Withdraw consent previously granted, without affecting the lawfulness of processing based on consent before its withdrawal.
  • Limit the use of decisions based purely on automated processing.

To exercise these rights (when DatSOR acts as the Data Controller) or to inquire about our privacy practices, please contact our Data Protection Officer (DPO):

  • Legal Entity: 17466382 CANADA INC. (DatSOR)
  • Contact Email: support@datsor.com
  • Contact Phone: +1 (365) 880-0712
  • Mailing Address: Niagara Falls, Ontario, Canada.

If you reside in the European Union or a country with a data protection authority, you also have the right to lodge a complaint with your local supervisory authority or with the Office of the Privacy Commissioner of Canada (OPC).

11. Changes to This Policy

We reserve the right to update this policy periodically to reflect platform innovations, AI model changes, or global legislative amendments. We will post the updated version in this section along with the revised effective date. Your continued use of the service constitutes acceptance of the current terms.