1. Data controller
RUC (Ecuador tax ID): 0924133440001
Samborondón, Guayas province, Ecuador
Email: info@vengalastudio.com
Phone: +593 99 434 7446
This policy describes how Vengala Studio collects, uses, stores and deletes personal information through its website and through the software platforms it develops and operates for its clients, including its integration with Meta's WhatsApp Business Platform.
2. Dual role: controller and processor
Vengala Studio processes personal data in two different roles, and the rules change depending on the case.
As controller. When you contact Vengala Studio directly — through the website form, by email or on WhatsApp — we decide the purpose and use of that data.
As processor. When we operate software, messaging systems or automations on behalf of a business client, the end users' data belongs to that client. The client decides how it is used; we only process it following their instructions and our contract. In those cases, to exercise your rights you should contact the business you communicated with. We forward and handle those requests in coordination with that business.
3. Data we collect
Through the website: name, email address, phone number and the content of the message you send through our forms. Also technical browsing data such as IP address, browser type, pages visited and session length, collected through cookies and analytics tools.
Through the WhatsApp Business Platform: phone number, WhatsApp profile name, the content of the messages exchanged (text, images, audio, documents and location when the user sends them), and conversation metadata such as date, time and delivery status.
From our business clients: contact and identification details of the company and its authorized people, as well as the configuration information of their WhatsApp Business account.
We do not intentionally collect special categories of data — health, ethnic origin, religious beliefs, sexual orientation, biometric or genetic data. If a user includes such data in a message on their own, it is handled under the same confidentiality conditions and deleted according to the timeframes in this policy.
We do not knowingly collect data from minors. If we detect that we have received a minor's data without their guardian's authorization, we delete it.
4. How we use the data
We use the information to answer inquiries and provide support; to operate the messaging, automation and management systems our clients hire; to deliver, maintain and improve our services; to meet legal, tax and contractual obligations; and to prevent fraud and platform abuse.
We do not sell personal data. We do not hand it to third parties for advertising or sell contact lists. Data obtained through the WhatsApp Business Platform is used exclusively to provide the service hired by the business client that owns that data, and never for advertising by Vengala Studio or third parties.
5. Legal basis
We process personal data in accordance with Ecuador's Organic Law on Personal Data Protection, based on the data subject's consent, the performance of a contract or pre-contractual measures, compliance with a legal obligation, or legitimate interest where the data subject's rights do not prevail.
In the case of WhatsApp, when a user starts a conversation with a business, they consent to exchanging messages within that conversation. That consent can be withdrawn at any time by asking to opt out through the same channel.
6. Who we share data with
We share information only with providers needed to deliver the service, under confidentiality and data processing agreements:
- Meta Platforms, Inc. — WhatsApp Business Platform infrastructure.
- Hosting and cloud infrastructure providers — storage and operation of the systems.
- Language model and artificial intelligence providers — processing messages in conversational assistants, when the contracted service includes it. These providers operate under agreements that prohibit using the data to train their models.
- Competent authorities — when there is a legal obligation or a valid court order.
Each business client can only access the data in its own account. Data from different clients is kept isolated from each other.
7. International transfers
Part of the infrastructure we use is located outside Ecuador. When transferring data to other jurisdictions, we require providers to offer contractual protection guarantees equivalent to those of Ecuadorian law.
8. How long we keep data
| Type of data | Retention period |
|---|---|
| Website inquiries without a contract | 12 months |
| WhatsApp messages and metadata | For the duration of the contract with the business client, and up to 90 days after it ends |
| Business client data | During the contractual relationship, plus 7 years for tax obligations |
| Technical and security logs | 12 months |
| Web analytics data | 26 months |
Once these periods end, the data is permanently deleted from active systems. Backup copies are overwritten in cycles of up to 90 days.
9. Data deletion
Anyone can request the deletion of their data by writing to info@vengalastudio.com with the subject "Data deletion", including the associated phone number or email and the business they communicated with.
We handle the request within 15 business days. When we act as processor, we forward the request to the responsible business client and confirm the deletion once it's done.
When a contract ends, we delete or return all of the client's user data within the following 90 days, as the client instructs.
10. Your rights
As a data subject, you have the right to access your data, correct inaccurate or incomplete data, delete it, object to its processing, request portability in a structured format, restrict processing while a challenge is resolved, withdraw your consent at any time, and not be subject to decisions based solely on automated processing that produce legal effects.
To exercise these rights, write to info@vengalastudio.com. We respond within 15 business days. If you believe your rights were not respected, you can file a complaint with Ecuador's Superintendency of Personal Data Protection.
11. Security
We use TLS encryption in transit for all communications, role-based access control under the principle of least privilege, two-factor authentication on administrative accounts, audit logs of access to client data, encrypted backups and data segmentation between clients.
No system is completely invulnerable. If a breach compromises personal data, we notify the affected data subjects and the supervisory authority within the timeframes required by law.
12. Cookies
Our website uses cookies necessary for it to work and analytics cookies to understand how the site is used. You can block or delete them from your browser settings; some features may stop working properly.
13. Changes to this policy
We may update this policy. When a change is substantial, we will publish it on this page with a new update date and, where applicable, notify active clients by email.
14. Contact
For any questions about this policy or how your data is handled:
