Privacy Policy

Effective Date: April 12, 2026 | Last Updated: July 6, 2026

1. Who We Are

Inboundra ("we," "us," "our") is an AI-powered receptionist service provider based in Puerto Rico. We provide automated text messaging services (SMS, WhatsApp, and Messenger) on behalf of our business clients to qualify leads and schedule appointments. Our website is inboundra.io.

2. Information We Collect

When you interact with our AI assistant (for example, 'Sofía') via text message, we may collect:

• Your phone number (provided by the messaging platform)
• Your name (if you provide it during conversation)
• Your email address (if you provide it)
• Your physical address or municipality (for service area verification and appointment scheduling)
• Precise location data — if you share your location via WhatsApp's built-in location feature (a pin, a Google Maps link, or an Apple Maps link), we receive the latitude/longitude coordinates of that pin and store the corresponding Google Maps URL so the visiting consultant can find the property. Sharing your location is always at your own initiative; we do not request continuous location access or background tracking.
• Information about your property (roof type, homeownership status) relevant to the service inquiry
• Your electricity bill range (for solar energy qualification purposes)
• Conversation messages exchanged with our AI assistant
• Images you send (photos of your roof, electricity bills, panels, or any picture you choose to share via WhatsApp) — these images are processed by an AI vision model so the assistant can understand the content and respond appropriately. The image bytes are sent to our AI provider (Anthropic) for that single response and are not retained by the provider. The original image and a brief AI-generated description are stored alongside your conversation record under the same retention window described in Section 6.
• Voice notes you send via WhatsApp — voice messages are transcribed to Spanish text by an AI speech-to-text model so the assistant can understand and respond. The audio is sent to our transcription provider (OpenAI) for that single transcription and is not retained by the provider for training. The transcribed text is stored alongside your conversation record under the same retention window described in Section 6.
• Web links (URLs) you share with the assistant — when you send a link, the assistant may visit the public page to read its title, description, and any preview image so it can respond in context. We only fetch publicly accessible URLs over HTTPS, never login-protected pages. We do not retain the page content beyond what is necessary to inform the assistant's response in that conversation.

Business client account and billing information. If you are a business client of Inboundra (not a consumer texting one of our AI assistants), we additionally collect and retain account and billing information: your name and business name, contact email, the services contracted, and records of invoices and payments (amounts, dates, payment status). Card and bank details are collected and processed directly by our payment processor, Stripe — we never see or store your full card or bank account numbers. Billing records are retained for as long as required for accounting, tax, and audit obligations, which may extend beyond the deletion windows described in Section 6.

3. How We Use Your Information

We use your information to:

• Qualify your inquiry and determine if you are eligible for our client's services
• Schedule appointments on your behalf with our client's sales team
• Send you booking confirmations and appointment reminders
• Respond to your questions about our client's products and services
• Improve our AI assistant's performance and accuracy

4. Data Ownership

Your data is owned by the business you contacted (our client). Inboundra acts as a data processor on behalf of our clients. We maintain your data in custody solely for the purpose of providing our services.

5. Data Sharing

We share your information with:

• The business client whose service you inquired about (for appointment scheduling and follow-up)
• Third-party service providers necessary for delivering our services (messaging platforms, calendar services, database hosting)
• AI service providers — to power the assistant's understanding of text, images, and voice notes, we send the relevant content to: Anthropic (text generation and image vision via the Claude model family) and OpenAI (Spanish voice-note transcription via the Whisper model). Both providers operate under their own privacy and data-handling policies and process content only for the duration of the request; neither retains your content for model training under their default API terms.
• Payment processing — for business clients, Stripe processes subscription payments and invoices under its own privacy policy; we receive from Stripe only the payment status, amount, and the billing email provided at checkout.

We do not sell your personal information to third parties.

6. Data Retention and Deletion

We retain your personal data only as long as necessary to provide our services and comply with legal obligations.

Rolling retention for active customers. For individuals actively engaging with our AI assistant, we retain:

• Conversation messages and metadata (phone number, name, qualification answers) for up to 180 days from your last message with us. After that window, content is purged from active storage; aggregate, non-identifying counts may persist in anonymized form for operational analytics.
• Precise location data (WhatsApp location pins, latitude/longitude) is governed by the same 180-day window and is deleted alongside the rest of your conversation record.
• Images, voice-note transcriptions, and AI-generated descriptions of shared media or web links are governed by the same 180-day window and are deleted alongside the rest of your conversation record. Original audio for voice notes is retained only as long as needed to produce the transcription and is then discarded.
• Meeting records are retained while the appointment is upcoming and for up to 90 days after the scheduled date, whichever is later.
• You may request earlier deletion at any time (see Section 7).

End of service agreement. When our service agreement with a business client terminates:

• Your data is exported to the business client within 48 hours
• Your data is deleted from Inboundra's systems within 30 days
• Consent records are retained for 4 years per TCPA statute of limitations

Legal holds. If we receive a valid legal request or regulatory inquiry, retention windows may be paused solely for the specific data subject to that request, for as long as legally required.

7. Your Rights Under Puerto Rico Law 47-2021

Under Puerto Rico's Data Privacy Act (Law 47-2021), you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Deletion: Request deletion of your personal data
• Portability: Request your data in a machine-readable format
• Objection: Object to the processing of your personal data

How to exercise these rights. You may make any of these requests directly through the same WhatsApp or SMS number you have been messaging — our AI assistant automatically recognizes and routes data-rights requests to a human handler. Any of the following phrases (in Spanish or English) will trigger a data-rights request, and our list is illustrative rather than exhaustive:

• Deletion (ES): "borra mis datos", "elimina mi info", "elimina mis datos", "borrar mi cuenta", "bórrame"
• Deletion (EN): "delete my data", "erase my data", "remove my information"
• Access / portability (ES): "quiero acceso a mis datos", "qué información tienen de mí", "exporta mis datos"
• Access / portability (EN): "I want my data", "show me my data", "export my data"
• Rectification (ES): "rectifica mis datos", "corrige mi info"
• Rectification (EN): "fix my data", "update my info"
• Objection (ES): "objeto al procesamiento", "no autorizo el uso"
• Objection (EN): "I object to processing", "I don't consent to your processing of my data"

Marketing opt-out. Separately from the rights above, you can stop receiving any marketing messages from our AI assistant at any time by replying STOP, PARE, CANCELAR, BAJA, ALTO, SACAME, DETENTE, or BASTA (or similar phrases in Spanish or English such as "no me escribas", "déjame en paz", "unsubscribe", "leave me alone"). Marketing opt-outs take effect immediately.

Response time. Per Puerto Rico Law 47-2021, Article 18, we respond to data-rights requests within 10 business days from receipt. Requests received through our automated system are logged with a timestamp and deadline that our team reviews daily.

You can also contact us directly at alejandro.figueroa@inboundra.com for any request or complaint regarding your data.

8. Automated Messaging and Consent

Our AI assistant sends automated text messages. By submitting your phone number through our client's lead capture forms, you consent to receive automated messages. You may opt out at any time by replying PARE, STOP, CANCELAR, BAJA, ALTO, SACAME, DETENTE, or BASTA to any message.

9. AI Disclosure

Our assistant is an artificial intelligence system, not a human. The assistant (whose name varies by business client — for example, 'Sofía') identifies itself as an AI in every first interaction and will disclose its AI nature if asked directly.

10. Security

We use industry-standard security measures to protect your data, including encrypted database storage, role-based access controls, and regular security audits.

11. Contact Us

Inboundra (Alejandro Figueroa)
Email: alejandro.figueroa@inboundra.com
Puerto Rico

12. Changes to This Policy

We may update this policy from time to time. The "Last Updated" date at the top reflects the most recent revision.