Privacy notice

Mariano Arael Romero Texis, an individual doing business (persona física con actividad empresarial) who offers ISSA (Intelligent Support & Service Assistant) under the trade name ISSA by Alrit.dev, located in Toluca, Estado de México, México, is the controller of your personal data (the "Controller", "we").

For any privacy matter, including exercising your rights, write to [email protected]. That mailbox is handled by the person in charge of personal data, who also acts as data protection officer (encarregado, Brazil) and data protection contact (European Union and United Kingdom).

It covers people who visit holaissa.com, use the demo, create an account, belong to the team of a customer organization, use the mobile app or write to us.

ISSA is a system that supports a business team: it answers its customers or patients with an AI assistant, books appointments, follows up and hands chats to people. The business decides about the data of those customers or patients and is their controller; we process it on its behalf as a processor, under the Data processing addendum. If you wrote to a business that uses ISSA, send your requests to that business; if you write to us, we will forward them.

• Identification and contact: name, email, phone, business name and industry.
• Account and security: password (its hash only), second authentication factor if you turn it on, sessions, IP address, browser and the record of the version, date and IP with which you accepted our documents.
• Billing: plan, period, payment history and the tax data you give us to issue the CFDI invoice (RFC, legal name, tax regime and postal code). Stripe receives your card details; we never see the full number.
• Usage and technical: server logs, pages visited, errors and security events.
• Demo: what you write about your business and products, the conversation with the trial assistant and the email you leave, if you choose to.
• Mobile app: the device identifier used to send you notifications.
• Support and communications: what you tell us when asking for help and our replies.

We do not ask for sensitive data for our own purposes. If a clinic turns on ISSA Salud, its patients’ health data is processed only on the clinic’s behalf, encrypted per organization, under the Health data addendum; we never use it for our own purposes.

They are necessary for your relationship with us:

• Creating and managing your account and organization, authenticating you and keeping the service secure.
• Providing the service: assistant, inbox, calendar, notices, follow-ups, CRM, catalog, voice, API and the integrations you set up.
• Charging, issuing invoices and telling you about renewals.
• Handling support, rights requests, the demo you asked for and communications about the service.
• Preventing fraud and abuse, and meeting legal and tax obligations and requests from authorities.

We may also use your data to send you product news, event invitations and surveys, and to build statistics to improve ISSA. They are not necessary for the service.

If you do not want us to use your data for these purposes, write to [email protected] at any time or use the unsubscribe link in each email. Opting out does not affect the service or your account.

In Mexico we process your data with your tacit consent when you accept this notice, except where the law does not require it. Where Brazil’s LGPD or the GDPR of the European Union and the United Kingdom apply, we rely on:

• Performance of the contract: account, service, billing and support.
• Compliance with legal obligations: invoicing, accounting and requests from authorities.
• Our legitimate interest: security, fraud prevention, service improvement and communications to business customers, always with the option to object.
• Your consent, where the law requires it; you can withdraw it at any time.

We share data with the providers that help us run the service, who act as processors on our instructions with confidentiality and security duties: Hostinger, Cloudflare, Anthropic, Groq, Vapi, Meta (WhatsApp, Messenger, Instagram), Resend, Stripe, Facturama, Expo. The list with their purpose, location and data is on the Sub-processors page.

We also process data with the integrations you connect (for example Google Calendar, Zoho CRM or your own webhooks), under those services’ terms. We only transfer data to third parties without your consent where the law allows it, such as requests from a competent authority or the defense of rights.

Several providers are outside your country, mainly in the United States. For data from the European Economic Area we use the European Commission’s standard contractual clauses; for the United Kingdom, its addendum or equivalent agreement; for Brazil, the ANPD standard clauses; and in every case we require by contract protection equivalent to this notice.

• Account and organization: while they are active. If the owner asks to delete the organization, everything is erased after a 7-day grace period during which it can be canceled.
• Conversation messages: deleted automatically after 12 months.
• Emails left in the demo: 90 days. Panel notifications: 30 days. Resolved improvement suggestions: 180 days.
• Invoices and tax records: as long as tax laws require (in Mexico, at least five years).
• Backups: rotated every 14 days, so erased data disappears from them within that time.

You can access your data, rectify it, cancel it or object to its processing, withdraw your consent and limit its use or disclosure. Send your request to [email protected] with your name, a way to reply to you, a document proving your identity or that of your representative, a clear description of the data and of the right you exercise, and any document that helps locate them.

We will reply within 20 days of receiving the complete request and, if it applies, carry it out within the following 15 days, under the Federal Law on the Protection of Personal Data Held by Private Parties (2025) and its rules. You can also sign up for Profeco’s Public Registry to Avoid Advertising.

Inside the product, the owner can export all their organization’s data and schedule its deletion from the settings.

You have the right to confirm whether we process your data, access it, correct it, anonymize, block or delete it when unnecessary or excessive, to portability, to know who we share it with, to withdraw your consent and to object to a processing. Write to our data protection officer at [email protected]. You can file a complaint with the National Data Protection Authority (ANPD).

You have the rights of access, rectification, erasure, restriction, portability and objection, to withdraw your consent and not to be subject to decisions based solely on automated processing with legal effects. Write to [email protected]; we will reply within one month. You can complain to the supervisory authority of your country of residence or, in the United Kingdom, to the Information Commissioner's Office.

If the law requires us to appoint a representative in the European Union or the United Kingdom, we will publish their contact details here.

In the last 12 months we have collected these categories of personal information, from you directly or from your use of the service and only for the purposes in this notice: identifiers (name, email, phone, IP), commercial information (plan and payments), internet activity (use of the site and the service) and professional information (business and role).

We do not sell or share personal information, as defined by the California Consumer Privacy Act (CCPA/CPRA), nor use it for cross-context behavioral advertising. We do not use sensitive information to infer characteristics.

Depending on your state of residence, you can ask to know what data we hold, access, correct or delete it, and not be discriminated against for exercising your rights. Write to [email protected]; we will verify your identity and reply within 45 days. You can act through an authorized agent.

ISSA is a service for businesses and is not directed at people under 18. We do not knowingly collect their data for our own purposes.

We only use cookies and browser storage necessary for the site to work; we do not use advertising or analytics cookies. The details are in the Cookie policy.

We apply the measures described on the Security page. The AI assistant answers messages, but we do not make decisions with legal or similarly significant effects about you based solely on automated processing, nor build advertising profiles.

We will publish any change on this page with a new version. If a change affects your rights or the purposes, we will email you before it takes effect.

If you believe your rights were infringed, you can go to Mexico’s personal data protection authority (since 2025, the Ministry of Anti-Corruption and Good Governance), to the ANPD in Brazil, to the supervisory authority of your country in the European Economic Area or the United Kingdom, or to your state authority in the United States.