EVA privacy policy

What EVA is

EVA is business management software that DEC Creative Studio provides to companies. One of its features connects the company's WhatsApp, through Meta's official WhatsApp Business Platform, so that its team can read and reply to messages from its customers and guests inside EVA.

This page explains what we do with that data. If you have messaged a company that uses EVA on WhatsApp, it concerns you too: this is the part that affects you.

Who is who

• The company you message (for example, the agency managing your holiday rental) decides what your messages are used for. It is the controller of your data.
• DEC Creative Studio, the trading name of TALENTRA S.A.S. (tax ID CUIT 30-71961789-8, Ramón Lista 3583, Rosario Sud (2000), Santa Fe, Argentina, info@decreativestudio.com), only processes it on behalf of that company and following its instructions. It is the processor.

What data EVA processes

• From people who send WhatsApp messages: phone number, WhatsApp profile name, message content (text and, if sent, photos, audio or documents), date and time, and the status of each message (sent, delivered, read).
• When the number is connected, and only if the company authorises it at that moment: the conversation history for up to the previous six months and the contacts saved in its WhatsApp Business app.
• From the company's team: name, email and which messages each person sent from EVA.

What for

• Showing the conversations to the company's team and sending its replies.
• Recognising who is writing, by matching the number against data the company already holds in EVA (its customers, contacts or bookings).
• If the company turns it on: analysing its conversations with artificial intelligence to suggest answers to frequently asked questions, which a person at the company reviews and approves before they are used.
• If the company turns it on: suggesting or sending automatic replies with artificial intelligence, based only on the answers the company itself has approved. The company can turn it off at any time, and a person can step into any conversation.

We do not use this data for advertising, we do not sell or share it, and it is not used to train artificial intelligence models.

Who else processes it

Only the providers EVA needs in order to work, on our behalf and under contract:

• Meta Platforms (WhatsApp Business Platform): the channel the messages travel through.
• Render Services, Inc.: hosts EVA's servers and database in Frankfurt (Germany, European Union).
• Vercel, Inc.: serves EVA's web interface; it does not store messages.
• Anthropic, PBC: the artificial intelligence model, only when the company has turned on the artificial intelligence features (suggested answers or automatic replies).

Where any of them is outside the European Union, transfers are made with the safeguards required by the General Data Protection Regulation (the European Commission's standard contractual clauses or equivalent frameworks). TALENTRA S.A.S. is based in Argentina, a country the European Commission recognises as providing an adequate level of protection.

How we protect it

• All connections are encrypted.
• WhatsApp access keys are stored encrypted and are never shown to anyone.
• Each company's data is kept separate from every other company's.
• Within the company, only the people who have been given permission can see the conversations.

How long

For as long as the company uses EVA, or for as long as it decides. If the company disconnects WhatsApp or stops using EVA, we delete its conversations within 30 days at most, unless it asks us for a copy first or a law requires us to keep them.

Your rights and how to have your data deleted

You can ask to access, correct or delete your data, object to or restrict its use, or take it to another service.

• If you messaged a company on WhatsApp: ask that company, as it is the controller. We help it do so.
• You can also write to us at info@decreativestudio.com with the subject "Delete my EVA data", giving your phone number and the company you messaged. We will pass it on to the company and confirm the deletion within 30 days at most.

If you live in the European Union, you can also complain to the data protection authority of your country (in Spain, the AEPD).

The owner of personal data has the right to access it free of charge at intervals of no less than six months, unless a legitimate interest is shown, as set out in Article 14(3) of Law No. 25,326. The ACCESS TO PUBLIC INFORMATION AGENCY (AAIP), as the supervisory authority under Law No. 25,326, has the power to deal with complaints and claims from anyone whose rights are affected by a breach of the personal data protection rules.

Changes

If we change this policy, we will update the date above and notify the companies that use EVA before the change takes effect.