Privacy policy

At Howe we build tools with AI agents so that people who sell online can run and create their business: the catalog, orders, prices, competition and their own store. This Privacy Policy describes what personal data we process when you use howe.com.ar, the application (app.howe.com.ar) and our services (together, the "Services"), what we use it for, who we share it with and what rights you have. When we say "Howe", "we", "our" or "us" we mean whoever provides the Services, based in the City of Buenos Aires, Argentina.

We are committed to respecting your privacy and to keeping secure the information we obtain from you or about you. This policy is governed by Law 25,326 on Personal Data Protection of the Argentine Republic and its complementary rules.

There are two different situations. The data of your account and of the people who write to us is processed by us, as controllers. The data of your business and of the buyers of your store is processed on your behalf and following your instructions, as processors: that is the case for what you load into Howe, what we bring in from the platforms you connect and what people leave when they buy from your Howe store. Section 4 explains what that means.

If something isn't clear, write to us at hola@howe.com.ar.

1. Personal data we collect

We collect the following personal data.

Data you give us:

• Account data: when you create an account, your name, your email address and your password, which is stored protected by a hash function and never in readable text. Also the name of your organization and, if you add people to your team, its members and their roles.
• Content: what you write or upload to Howe: your requests to the agent and their conversations, supplier lists (Excel, CSV or PDF), documents, images and other files, and the rules and preferences you ask it to remember.
• Business data: your catalog (products, variants, prices, stock and photos), your suppliers, costs and orders, and the settings of your channels and of your Howe store.
• WhatsApp phone number: if you turn on notifications and approvals through WhatsApp, we store your number in international format, your consent and the verification of the number.
• Contact data: if you write to us or request a demo, your name, your email, the name of your business, where you sell, what you want to see and the message you leave.

Data from the platforms you connect: when you connect Mercado Libre, Tiendanube or another platform, we receive what that platform lets you authorize: listings, prices, stock, orders and shipments, and the access credentials (tokens), which we store encrypted. We don't store data about your buyers from Tiendanube.

Data from the buyers of your Howe store: when your Howe store receives an order, we store what's needed to fulfill it: name, contact details, shipping address and, if needed to invoice, ID number or tax ID. We process it as explained in section 4.

Data we receive from your use of the Services:

• Technical logs: IP address, browser and device type, date and time of each request to our servers and the pages or actions used.
• Audit log and agent events: who changed what and when, approvals, and the steps the agent takes (which tools it used and what it proposed).
• AI usage: how much artificial intelligence each organization uses, to apply each plan's limits.

We don't collect data for advertising and we don't build profiles of people for commercial purposes.

2. How we use personal data

We use personal data to:

• provide, maintain and improve the Services: create your account, connect your channels, run the agent, show you your catalog and your orders and host your store;
• process your requests to the agent with artificial intelligence models and return proposals, documents and answers;
• let you know about what needs your attention, such as a change to approve or a security notice, and answer your messages and demo requests;
• protect the security of the Services, prevent abuse and fraud, and maintain the audit log;
• comply with legal obligations and respond to requests from authorities.

We don't train models with your business data or your conversations. To improve the Services we use technical and usage data, not the content of your business.

Automated decisions. The AI agent proposes changes: it doesn't apply them to your channels without your approval or without an autonomy policy you chose, and a price that loses you money is never applied automatically in any mode. Every change keeps how things were before, so it can be undone.

3. Who we share personal data with

We don't sell your personal data. We share it only in these cases:

• Providers that help us deliver the Services: infrastructure and network (Cloudflare, which hosts the site, provides access to the application and stores the encrypted backups); artificial intelligence (Anthropic, whose models process the requests to the agent and which runs the agent's web search and reading); email (Resend, which delivers the contact form messages to our mailbox); and messaging (Meta, through the official WhatsApp API, if you turn that channel on). They receive only what is needed to do their job.
• The platforms you connect: when you approve a change, we send it to the platform through its official API (for example, a new price to Mercado Libre).
• Your team: the other people in your organization see what their role allows.
• Authorities: when the law requires it, through a court order or a request from a competent authority.
• Reorganizations: if Howe merges, is sold or is reorganized, the data may pass to the new controller, which will have to respect this policy. We'll let you know.

When we send your content to an AI model, it's only to answer the request you made.

4. The data of your business and your buyers

When you use Howe to run your business, you are the controller of your buyers' and customers' data, and Howe processes it on your behalf, as a processor: we use it only to provide you with the Services, following your instructions, and we don't use it for our own purposes.

That means:

• you decide what data you load and connect, and you are the one who tells your buyers how you handle it and who answers their requests for access, rectification or deletion;
• we give you the tools to do it and, if a buyer writes to us, we ask them to contact your business and help you respond;
• when Tiendanube tells us that a customer's data must be deleted or handed over, we process it;
• the Howe store keeps the buyer data needed to ship and invoice; from Tiendanube we keep none.

If you are a buyer of a store built with Howe and want to exercise your rights, write to that store first.

5. Where data is processed: international transfers

Some of our providers process data outside Argentina. Anthropic's AI models and Cloudflare's network run in other countries, including the United States, and the encrypted backups are stored in Cloudflare storage in a European Union jurisdiction.

When data leaves the country, we work with providers that commit to protecting it and we take the safeguards required by Law 25,326 and its complementary rules, such as the model contractual clauses of the Agency for Access to Public Information (Resolution 198/2023).

6. How long we keep data

We keep personal data while your account is active and for as long as needed to provide the Services, comply with legal obligations, resolve disputes and enforce our agreements.

• If you ask to close your organization, we delete its data: products, orders, conversations, files and connections. Only what doesn't identify anyone remains in the audit log.
• Backups are made every night and replaced by newer ones: your data may remain in them for a limited time after it's deleted from the system.
• Buyer data is kept while your business needs it to fulfill the order and meet its legal obligations, such as tax ones, and is deleted or anonymized when it's no longer needed.
• Contact messages are kept for as long as needed to answer you and arrange the demo.

7. Your rights

Law 25,326 gives you the right to access your personal data, to ask for its rectification, updating and deletion and to know what it's used for. You can exercise those rights by writing to us at hola@howe.com.ar from your account's email, so that we can verify who you are. We respond within the deadlines the law sets: ten calendar days for an access request and five business days for rectification, updating or deletion. Access is free at intervals of no less than six months, unless you show a legitimate interest.

You can also withdraw your consent to receive WhatsApp notifications at any time, from your account or by writing to us.

If you are a buyer of a store built with Howe, write to that store first (section 4).

The Agency for Access to Public Information (Agencia de Acceso a la Información Pública), as the Control Authority of Law 25,326, has the power to handle the complaints and claims filed by those whose rights are affected by a breach of the rules in force on personal data protection.

8. How we protect data

We protect your data in several layers, and each one assumes the previous one can fail:

• Each business, isolated from the others. The code filters by organization and the database enforces it again, and the processes run with a database user without administrator privileges.
• Encrypted credentials. Mercado Libre and Tiendanube credentials are stored encrypted and never reach the browser or the AI model.
• Controlled access. Roles are checked on the server, passwords are at least 12 characters long, failed attempts are limited, sessions expire and the session cookie is secure. The application reaches the internet through a Cloudflare tunnel, with no open ports on our servers.
• An agent that only proposes. What the agent reads (lists, messages, descriptions) is treated as data and not as instructions, and on your channels it can only add changes to a list that you approve.
• Log and backups. There is an audit log that nobody can rewrite and every night a backup is made, encrypted and stored outside the server.
• Review. We work with OWASP's Top 10 and ASVS and, for the agent, with OWASP's Top 10s for AI, and every change that touches access or data goes through a security review. These are standards we work with, not certifications.

No system is completely secure. If a security incident affects your personal data, we'll let you know as soon as possible, at your account's email, with what happened and what you can do. If you find a flaw, write to us at hola@howe.com.ar: test only with your own account and without accessing other people's data.

9. Cookies and similar technologies

The howe.com.ar site doesn't use advertising or tracking cookies, or third-party analytics tools. The application uses a session cookie, needed to keep you signed in, and may store interface preferences in your browser, such as the theme. Cloudflare, which protects access to the application, may use its own authentication cookie. You can delete cookies from your browser; if you delete the session cookie, you'll have to sign in again.

10. Minors

The Services are for people who run a business and are not directed at people under 18. We don't knowingly collect personal data from minors; if you think we did, write to us and we'll delete it.

11. Links and third-party services

The Services connect with third-party platforms, such as Mercado Libre, Tiendanube and WhatsApp, and may link to other sites. Each one has its own privacy policy, which governs what it does with your data, and we recommend reading them. We connect as each platform requires, with OAuth authorizations and official APIs, and we never ask you for the password of those accounts.

12. Changes to this policy

We may update this policy. If the change is important, we'll let you know in advance by email or in the application, and the date above shows the last update.

13. How to contact us

To exercise your rights, ask a question or report a problem about this policy, write to us at hola@howe.com.ar or use the contact page.