Privacy policy

1. Controller

Controller: Gino Scattolon Felix, owner of the sole proprietorship Michinauta, Friedrich-Ebert-Str. 26, 35037 Marburg, Germany. Email: info@michinauta.com.

The establishment is in Germany, so this policy follows the General Data Protection Regulation (GDPR, DSGVO). Further details in the Legal Notice.

We have not appointed a data protection officer because the law does not require one (§ 38 BDSG): fewer than 20 people work on personal data in the business.

2. Data we collect

• Account data: RUC, legal name, trade name, address, phone, email, and password (stored encrypted).
• Customer data: identification, legal name, email, phone, and address that your agency enters.
• Tax data: electronic receipts (invoices, credit notes), XML, access keys, and the electronic signature (.p12, encrypted).
• Technical data: IP address, access logs, and session cookies.
• Payment data for your subscription: processed by Stripe or, for Travel and Workshop subscriptions paid in crypto, by Triple-A; Michinauta receives the payment status and reference, never your card or wallet details.
• Funnel analytics, only if you accept it: an anonymous session identifier generated in your browser (not linked to your identity) and, when present, the campaign parameters (source, medium, and campaign). It does not include your IP address or the browser user-agent.

For the customer data that your agency, workshop or bodega enters on the platform, that business is the controller: Michinauta processes it on its behalf, as processor, under the data processing agreement (DPA, Art. 28 GDPR). If you have questions about that data, contact that business first.

3. Purpose and legal basis

We process your data for these purposes, each with its legal basis under the GDPR:

• Provide invoicing and business management: performance of the contract (Art. 6(1)(b)).
• Verify your identity and email when you register: pre-contractual steps and performance of the contract (Art. 6(1)(b)).
• Send receipts to the SRI on your behalf: it is part of the service you sign up for, so it relies on performance of the contract (Art. 6(1)(b)). The duty to issue the receipts is your business's, under Ecuadorian law.
• Charge your subscription and keep its invoices: performance of the contract (Art. 6(1)(b)) and German tax and commercial record-keeping duties (Art. 6(1)(c)).
• Protect the security and stability of the service (access logs, rate limits, Cloudflare protection): legitimate interest in defending the service and its users against abuse and attacks (Art. 6(1)(f)).
• Measure the performance of our pages and campaigns: only with your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG), which you give or refuse in the notice when you arrive.
• Answer questions in the Help assistant: your agency's consent (Art. 6(1)(a)), see section 5.
• Handle your WhatsApp inquiry and offer you a demo: pre-contractual steps at your request (Art. 6(1)(b)) and our legitimate interest in answering whoever writes to us (Art. 6(1)(f)); see section 10.

Where Ecuador's Organic Law on Personal Data Protection (LOPDP) applies, these purposes rely on the conditions in Art. 7: consent for specified purposes (point 1), compliance with a legal obligation (point 2), pre-contractual steps or performance of contractual obligations (point 5), and Michinauta's or a third party's legitimate interest only after balancing it against your interests and fundamental rights (point 8).

Providing the registration data is required to enter into the contract: without it we cannot create the account. No other data is mandatory. We do not make decisions based solely on automated processing, including profiling (Art. 22).

4. Storage and security

Data is stored on servers in Switzerland (Infomaniak Public Cloud). The electronic signature (.p12) is stored encrypted with a dedicated key. We take daily database backups, kept locally for 14 days, replicated and encrypted end to end in Swiss Backup (Infomaniak, Switzerland) with a 90-day retention. All public traffic uses HTTPS. Infomaniak acts as a processor. Switzerland has an adequacy decision from the European Commission, so hosting the data there needs no additional safeguards.

5. Sharing with third parties

We do not sell or rent your data. We share information only with:

• SRI Ecuador: electronic receipts sent as the law requires. Ecuador has no adequacy decision from the European Commission: the transfer relies on Article 49(1)(b) and (c) of the GDPR, because it is necessary for performing the contract you conclude with us (point b) and for a contract concluded in your interest (point c).
• Zoho Corporation B.V. (Zoho Mail, Netherlands): sends the platform's emails, such as account verification and notices, from its data centers in the European Union (Netherlands and Ireland). It acts as a processor; any access from outside the EU is governed by the standard contractual clauses in its processing agreement.
• Cloudflare, Inc. (United States): protects and delivers the site. Only if you accept analytics does it also count aggregate visits with Cloudflare Web Analytics, without cookies or personalized advertising. The transfer to the United States relies on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified, and on standard contractual clauses under Article 46 of the GDPR.
• Umami Software, Inc. (United States): only if you accept analytics, it counts visits with Umami Cloud, without Umami cookies. If you use ?no-medir, Michinauta stores the technical umami.disabled preference described in section 8. Umami receives the page visited without identifiers or tokens (we replace them before sending), the referring page, campaign parameters and technical browser data; your IP address is used only in passing to estimate the country and is not stored in the statistics. The data is hosted in its European Union region. It acts as a processor under its data processing agreement, which incorporates the European Commission standard contractual clauses (module two) for any access from the United States.
• Triple A Technologies Pte. Ltd. (Singapore), only if you pay a Travel or Workshop subscription in crypto: processes that payment on its checkout page and receives the amount, the order reference, and the details you give on that page. Singapore has no adequacy decision from the European Commission: the transfer relies on standard contractual clauses under Article 46 of the GDPR.
• Stripe Payments Europe, Ltd. (Ireland): processes the payment of your Michinauta subscription. Stripe may pass data to Stripe, Inc. in the United States, relying on the EU-U.S. Data Privacy Framework and standard contractual clauses. For its own duties, such as fraud prevention and financial regulation, Stripe acts as an independent controller.
• Payphone, if your agency turns it on: it is your agency's payment gateway, not Michinauta's, and it runs with the credentials you upload. Michinauta does not hold that money. Charges for your Michinauta subscription do not go through Payphone. When a customer pays, the amount and a reference are sent, and the customer continues on Payphone's payment page. On an invoice, the reference carries the receipt number and the agency's trade name, or the legal name if there is no trade name. On an experiences booking (activity or transfer), the reference carries the booking type and the first characters of its identifier: it does not include the receipt number or the agency name.
• Cal.com, Inc. (United States), if you book a demo: manages the demo call bookings you request through the scheduling link on the site: name, email, chosen time and whatever you write in the booking form. It acts as a processor under its data processing agreement. The transfer to the United States relies on the EU-US Data Privacy Framework, under which Cal.com is certified, and on standard contractual clauses (Implementing Decision (EU) 2021/914) for anything the framework does not cover. Its subprocessors, including Amazon Web Services and Vercel, are listed at trust.cal.com.
• Anthropic (Claude), if the Help assistant or AI Analysis is on: the question text and Michinauta content already published, which the assistant uses to answer, are sent to the Anthropic API in the United States. The electronic signature and passwords are never sent. Anthropic deletes what was sent and what it answered within 30 days, unless its automated systems flag it as a possible violation of its usage policy, in which case it may keep it for up to 2 years, or the law requires it to be kept. By default, it does not use it to train its models. The assistant lives inside the ERP, in the Help panel: it is off by default and the agency administrator must accept it expressly. If it is also used to load the catalog, the photo you choose to upload is sent as well; that photo can contain names, a RUC, or other third-party data visible in it, so photograph only what needs to be read. In Michi Viajes, Michi Taller and Michi Bodega, AI Analysis (Pro plan) sends only aggregate figures for the business over the last 30 days (sales or invoicing, margin, receivables and other totals), without names of customers, travelers or products, license plates or ID numbers, and it also requires the administrator to accept it expressly. In Michi Bodega it is accepted with the same notice as the Help assistant.
• Meta Platforms Ireland Limited (Ireland), if you message us on WhatsApp: provides the WhatsApp Business service (today the WhatsApp Business app; the Cloud API if we turn on the bot) that carries the messages with our number +49 1523 9607430: your phone number, the content of the messages and their technical details (type, time, status). It acts as processor under its data processing terms (Meta Global Processor Terms). Its sub-processors are mostly in the United States: that transfer relies on the EU-U.S. Data Privacy Framework, under which Meta is certified, and on standard contractual clauses (Commission Implementing Decision (EU) 2021/914) for anything the framework does not cover. Your own WhatsApp account is managed by WhatsApp under its terms, which you accepted when you started using it.
• Kapso, Inc. (United States), only if we turn on the WhatsApp bot: not involved today: a person answers the messages. If we turn on the bot, we will say so in this policy before doing it. Kapso would connect our number to Meta's Cloud API while we keep using the WhatsApp Business app: it would receive and send the messages (your phone number, your profile name, the content and its technical data) and store them on its platform. It acts as processor under its Data Processing Addendum, which is accepted with its terms of service. It processes the data in the United States and in Chile, through its affiliate Kapso SpA, and its Data Processing Addendum also allows processing in the other countries where Kapso and its sub-processors operate. None of this processing relies on an adequacy decision: every transfer outside the European Economic Area, including those to the United States and Chile, relies on the standard contractual clauses (Implementing Decision (EU) 2021/914, Module Two) incorporated in its Data Processing Addendum. Its sub-processors, among them Render, PlanetScale and Cloudflare, are listed at kapso.com/subprocessors. To draft its replies, the bot sends the conversation text from our server to the Anthropic API in the United States, under the deletion and no-training terms described above; that transfer also relies on standard contractual clauses under Article 46 of the GDPR.
• Hotelbeds, if your agency enables hotels, activities or transfers: hotel searches send the destination, stay dates, occupancy and children's ages; bookings send the booking holder's first and last names, which the integration repeats in the occupant entries for each room, along with children's ages, rateKey and an internal reference. Activities searches send the destination, dates and ages; bookings send the holder's first and last names, email and phone when provided, participants' first and last names, ages and types, rate and answers to activity questions. Transfers send the origin, destination, date and time, numbers of adults, children and infants; bookings send the holder's contact details, rate and reference, flight or train details and remarks when provided. The purpose is to search for and manage the relevant booking. With the agency's own credentials, the agency contracts directly with the provider: Michinauta only transmits data on the agency's instructions; the provider's role and transfer safeguards are governed by the agency's contract with Hotelbeds. In managed mode, using Michinauta's credentials, Hotelbeds is a recipient of Michinauta. Its official policy identifies Hotelbeds Spain, S.L.U. (Spain); that registered office does not mean that all data is processed exclusively there. Under the GDPR, sending data to the Spanish entity is not a third-country transfer; for the Ecuadorian regime, the distinction at the end of this section applies, without equating an EU location with an SPDP adequacy decision.
• DePay AG (Switzerland), if your agency configures this cryptoasset gateway: the payment script and its configuration receive integration or paymentToken, blockchain, token, amount, recipient wallet, and return URL; the flow also communicates the transaction identifier and status. They are used to present and process your agency customer's payment, not to charge the Michinauta subscription. The agency contracts directly with it using its own credentials configured per agency. Michinauta only transmits data on the agency's instructions; the provider's role and transfer safeguards are governed by the agency's contract with DePay. Its Swiss registered office alone does not determine all processing countries or a safeguard under the LOPDP.
• Binance Pay, if your agency configures this gateway: to create and track the payment it receives the invoice reference, the amount in USD, a description that may include the trade name, goods metadata, and the return, cancellation, and notification URLs; the flow records the transaction identifier and status. It is used to process your agency customer's payment, not the Michinauta subscription. The agency contracts directly with it using its own credentials configured per agency. Michinauta only transmits data on the agency's instructions; the contracting entity, provider's role and transfer safeguards are governed by the agency's contract with Binance Pay.
• OpenFreeMap (Hyperknot Software Kft., Hungary), when the hotel map is shown: the browser requests the tiles directly, which exposes the IP address and technical request data to deliver the map and protect the service. The provider states that it does not store IP addresses in access logs by default; error logs may retain the IP address and URL for 7 days, and during security incidents it may temporarily log the IP address for no more than 30 days. It may use Cloudflare. Hungary is in the European Union. Delivery may take place through Cloudflare, already described in this section 5; no processing country is attributed to each request.

Sending data to the assistant is a transfer to the United States. It does not rely on an adequacy decision: it relies on standard contractual clauses under Article 46 of the GDPR. This page neither states nor denies that the recipient holds any extra certification. Inside the ERP assistant, consent is asked before the first use and can be withdrawn at any time from the Help panel, where the button for that is: once withdrawn, the assistant is no longer called.

For processing subject to the LOPDP, Resolution SPDP-SPD-2026-0004-R distinguishes this regime from the European one: an actual international transfer to a country or recipient without an adequate level must rely on appropriate safeguards under Arts. 20 to 22 or another permitted ground or authorization. Art. 20 lists the safeguards and Art. 21 their conditions; Art. 22 recognizes the RIPD model clauses between controllers. Art. 23 clarifies that engaging a processor is not in itself a transfer under Ecuadorian law, and Art. 24 treats using model clauses for that engagement as voluntary good practice. For the United States, the SPDP has not issued an adequacy decision. A European Commission adequacy decision or the EU-U.S. Data Privacy Framework is not equivalent to an SPDP decision.

6. Your rights

Under the GDPR (DSGVO), you can exercise these rights:

• Access: know what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete your data.
• Restriction: ask us to limit processing in the cases the law provides.
• Portability: receive, in a structured format, the data you gave us when processing is based on the contract or on consent.
• Objection: object, on grounds relating to your particular situation, to processing based on legitimate interest (Art. 21).
• Withdraw consent: at any time, without affecting the lawfulness of earlier processing. Analytics is changed from "Privacy preferences" at the foot of every page; the assistant, from the Help panel.
• Complaint: lodge one with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement (Art. 77).

Where the LOPDP applies, you may also exercise the rights under the names and with the scope given by that law:

• Access: know and obtain your personal data and information about its processing, free of charge.
• Rectification and updating: correct and update inaccurate or incomplete data.
• Erasure: ask for data to be deleted where a statutory ground applies.
• Objection: object to or refuse processing in the cases established by law.
• Portability: receive your data in a compatible, current, structured, commonly used, and interoperable format where applicable.
• Suspension of processing: obtain suspension of processing in the circumstances provided by law.
• Not to be subject to decisions based solely or partially on automated assessments: request human intervention and challenge an automated decision, including profiling, where it produces legal effects or affects your fundamental rights and freedoms.

The competent supervisory authority for Michinauta is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit, HBDI), Wilhelmstraße 7, 65185 Wiesbaden, Germany, datenschutz.hessen.de.

For processing subject to the LOPDP, you may also complain to Ecuador's Superintendencia de Protección de Datos Personales (SPDP).

Send your request to info@michinauta.com. For GDPR rights we will answer within one month. For requests subject to the LOPDP, the rights of access, rectification and updating, erasure, and objection must be handled within 15 days (Arts. 13 to 16).

Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 6(1)(f)). If you object, we will stop processing your data for that purpose unless we show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Write to us through the channel given above.

7. Retention

We keep your data while your account exists. If you cancel the subscription, the account moves to the Free plan and stays active: it is not suspended, and your data remains available for you to look up or export.

There is no automatic deletion of account data: it is planned as an upcoming improvement and has not yet been implemented. We delete business data on written request through the channel in section 6, with confirmation within 30 days. This contractual period does not extend shorter legal deadlines applicable to data subject requests, including the 15 days under the LOPDP.

We do delete two things automatically, even while your account is active: the access records described in section 2 — which include IP address and user-agent — are deleted after 90 days, and the funnel events in section 9 after 12 months.

When your business requests deletion, we first provide it with the complete export through Configuración → «Descargar todos mis datos», in JSON format, and then delete all of the business data from active systems, including tax records. Your business, as controller, has the obligation to retain its records and must keep the export; Michinauta, as processor, does not act as an archive after the contract. Backups in section 4 follow their own retention (14 days locally and 90 days remotely) and are not covered by the deletion confirmation.

After deletion we keep only a record of which version of the terms and of the data processing agreement (AVV) the business accepted and when, with the internal identifiers of the business and of the account that accepted, without name, RUC, email or IP address. We keep it as controller, to be able to prove the contract in the event of a claim (Art. 6(1)(f) and Art. 17(3)(e) GDPR), until the claims arising from the contract are time-barred.

Invoices and accounting records for Michinauta's own subscription billing are kept for the periods set by German tax law (§ 147 AO): up to 10 years, and 8 years for accounting vouchers. They are then deleted.

8. Cookies

We use cookies that are strictly necessary for session authentication (NextAuth), and we store your choice in the consent notice in the browser, because without it we could not respect it (§ 25(2) TDDDG). If you pick a language in the selector, we keep it in the michinauta_idioma cookie for one year to show the site in that language; it is also strictly necessary, because you ask for it. Only if you accept analytics do we also store the anonymous funnel identifier and the first campaign parameters in localStorage, and load Cloudflare Web Analytics and Umami. If you refuse or withdraw consent, we delete those keys and stop sending events. We do not use advertising cookies or third-party advertising profiles.

If you open a page with ?no-medir, we store umami.disabled in localStorage to honour that Umami opt-out; ?no-medir=0 removes it. It is not analytics tracking: it is strictly necessary to remember that you asked not to be measured and lasts until you remove it, clear browser data, or use ?no-medir=0. The michinauta:tema:publico and michinauta:tema:app keys keep the light or dark theme preference in localStorage until you change or remove it; they are strictly necessary only where you requested that preference.

michinauta:chunk-reload is a technical sessionStorage record holding the attempt count and time of the last recovery attempt after a broken load: it allows up to 2 retries at least 30 seconds apart. Data older than 10 minutes is ignored but is not physically deleted at 10 minutes; it lasts until the tab session ends or sessionStorage is cleared. It is strictly necessary to prevent reload loops during that recovery.

In the relevant features, the michi_caja_dispositivo and michi_taller_dispositivo cookies keep an opaque cash-register or workshop device identifier for one year; they are strictly necessary only where that device is configured. The michi_taller_mecanico cookie holds encrypted mecanicoId, agenciaId, dispositivoId, and huellaPin claims for the mechanic session for no more than 12 hours; it is strictly necessary to maintain that session. All three are HttpOnly, SameSite=Lax and, in production, Secure.

9. Funnel analytics (anonymous identifier)

Only if you accept analytics, and to understand how visitors arrive and move through registration, we record anonymous events of our acquisition funnel (arrival on the home page, opening the registration form, and completed registration). Each event includes a session identifier generated in your browser — not linked to your identity or to third-party advertising cookies — and, when present, the campaign parameters (source, medium, and campaign). These events never include your IP address or your browser user-agent.

We keep these events for up to 12 months. After that they are deleted automatically by a process that runs every day.

10. Contact form, WhatsApp, waiting list and email

If you write to us through the contact form, we store your name, your email, the message, the page you sent it from and your IP address. If you join the waiting list for a country, we store your email, the country, your agency name (if you give it), the page of origin and your IP address.

In both cases we send you a confirmation email and receive an internal notice; both emails go through Zoho, already listed in section 5. If you write directly to the public email address, we process your message the same way in order to answer it.

If you message our number +49 1523 9607430 on WhatsApp, today a person from Michinauta answers from the WhatsApp Business app, Monday to Friday, 9:00 to 13:00 (Ecuador time). If we later turn on a bot that answers for us, we will say so here before turning it on. We store your name, your phone number, your email if you give it, a summary of your inquiry and the fact that it came through WhatsApp. If we turn on the bot, we will also store the conversation so it can answer with context. We do not store your IP address or send you a confirmation email; we receive an internal notice through Zoho. Meta and Kapso, listed in section 5, process the conversation as our processors.

Legal basis: answering your inquiry and handling your request, a pre-contractual step (Art. 6(1)(b)), and our legitimate interest in answering inquiries and preventing abuse (Art. 6(1)(f)). The IP address, and on WhatsApp your phone number, is used to rate-limit submissions and prevent abuse.

Retention: these records are not yet deleted automatically; automatic deletion is planned and not implemented. Until then we delete them on request, through the channel in section 6.

11. Changes

We may update this policy. We will email you about significant changes. The current version is always on this page.