Privacy policy

1. Controller

Michinauta is the controller of the personal data collected through this platform. The establishment is in Germany, so this policy follows the General Data Protection Regulation (GDPR, DSGVO). The address and registration number are published in the Impressum when the registration details exist. Until then, this page does not replace that notice.

2. Data we collect

• Account data: RUC, legal name, trade name, address, phone, email, and password (stored encrypted).
• Customer data: identification, legal name, email, phone, and address that your agency enters.
• Tax data: electronic receipts (invoices, credit notes), XML, access keys, and the electronic signature (.p12, encrypted).
• Technical data: IP address, access logs, session cookies, and campaign attribution parameters (source, medium, and campaign).
• Funnel analytics: an anonymous session identifier generated in your browser (not linked to your identity) and, when present, the campaign parameters. It does not include your IP address or the browser user-agent.

3. Purpose and legal basis

We process your data to:

• Provide invoicing and business management (performance of the contract).
• Verify your identity and email when you register.
• Send receipts to the SRI on your behalf.
• Improve the security and stability of the service.
• Measure the aggregate performance of our pages and acquisition campaigns.

4. Storage and security

Data is stored on servers in Switzerland (Infomaniak Public Cloud). The electronic signature (.p12) is stored encrypted with a dedicated key. We take daily database backups, kept locally for 14 days, replicated and encrypted end to end in Swiss Backup (Infomaniak, Switzerland) with a 90-day retention. All public traffic uses HTTPS.

5. Sharing with third parties

We do not sell or rent your data. We share information only with:

• SRI Ecuador: electronic receipts sent as the law requires.
• Email provider (SMTP): to send account verification.
• Cloudflare: protection, delivery of the site, and aggregate web metrics, without personalized advertising.
• Payphone, if your agency turns it on: it is your agency's payment gateway, not Michinauta's, and it runs with the credentials you upload. Michinauta does not hold that money. Charges for your Michinauta subscription do not go through Payphone. When a customer pays, the amount and a reference are sent, and the customer continues on Payphone's payment page. On an invoice, the reference carries the receipt number and the agency's trade name, or the legal name if there is no trade name. On an experiences booking (activity or transfer), the reference carries the booking type and the first characters of its identifier: it does not include the receipt number or the agency name.
• Anthropic (Claude), if the Help assistant is on: the question text and Michinauta content already published, which the assistant uses to answer, are sent to the Anthropic API in the United States. The electronic signature and passwords are never sent. Anthropic deletes what was sent and what it answered within 30 days and, by default, does not use it to train its models. The assistant lives inside the ERP, in the Help panel: it is off by default and the agency administrator must accept it expressly. If it is also used to load the catalog, the photo you choose to upload is sent as well; that photo can contain names, a RUC, or other third-party data visible in it, so photograph only what needs to be read.

Sending data to the assistant is a transfer to the United States. It does not rely on an adequacy decision: it relies on standard contractual clauses under Article 46 of the GDPR. This page neither states nor denies that the recipient holds any extra certification. Inside the ERP assistant, consent is asked before the first use and can be withdrawn at any time from the Help panel, where the button for that is: once withdrawn, the assistant is no longer called.

6. Your rights

Under the GDPR (DSGVO), you can exercise these rights:

• Access: know what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete your data.
• Restriction: ask us to limit processing in the cases the law provides.
• Portability: receive, in a structured format, the data you gave us when processing is based on the contract or on consent.
• Objection: object to certain processing.
• Complaint: lodge one with the competent supervisory authority.

Send your request to [email protected]. We will answer within one month.

7. Retention

We keep your data while your account exists. If you cancel the subscription, the account moves to the Free plan and stays active: it is not suspended, and your data remains available for you to look up or export.

There is no automatic deletion of your account data: it is planned as a next improvement and is not implemented yet. Until then we delete your data on request, through the channel in section 6. That one-month period is the time we have to answer you, not a deletion deadline: within that period we will confirm when it is done.

We do delete one thing automatically, even while your account is active: the access records described in section 2 — which include IP address and user-agent — are deleted after 90 days.

In every case we keep electronic receipts and their accounting backups for the minimum period required by Ecuadorian tax rules, even if you ask us to delete the rest of your data. The backups described in section 4 can still contain information already deleted until their own retention ends.

8. Cookies

We use cookies that are strictly necessary for session authentication (NextAuth). We store the first campaign attribution in the browser so we can attach it to registration. We do not use advertising cookies or third-party advertising profiles.

9. Funnel analytics (anonymous identifier)

To understand how visitors arrive and move through registration, we record anonymous events of our acquisition funnel (arrival on the home page, opening the registration form, and completed registration). Each event includes a session identifier generated in your browser — not linked to your identity or to third-party advertising cookies — and, when present, the campaign parameters (source, medium, and campaign). These events never include your IP address or your browser user-agent.

We keep these events for up to 12 months. Automatic deletion when that period ends is planned as a next improvement and is not implemented yet; until then, expired records can be deleted manually on request.

10. Changes

We may update this policy. We will email you about significant changes. The current version is always on this page.