Privacy Policy

1. Two kinds of data, two different roles

This is the most important distinction in this document.

YOUR ACCOUNT DATA: your name, your email, your billing details. Here we are the CONTROLLER: we decide what we use them for (giving you the service and billing you).

DATA INSIDE YOUR CONTRACTS: the names, ID numbers, tax IDs, addresses and other details of your tenants and the parties to your contracts. Here we are a PROCESSOR: we handle them only on your instructions, because the controller of that data is YOU. The terms are in the DPA.

2. What account data we process

• Identity: name, email address, password (hashed, never in plain text).
• Company: legal name and tax ID, if you provide them.
• Usage: which contracts you created and when, to bill you and to show you your consumption.
• Billing: payment details are processed by our payment provider; we do not store card numbers.
• Technical: IP address and access logs, for security and abuse prevention.

3. What we use it for, and on what legal basis

• Providing the service and billing you — performance of the contract.
• Warning you about expiries and the status of your contracts — performance of the contract.
• Security, fraud prevention and UAFE compliance — legal obligation and legitimate interest.
• Improving the product using aggregated data that does not identify you — legitimate interest.
• Marketing communications — only with your consent, which you can withdraw at any time.

4. What we do NOT do

• We do not sell your data, or your tenants’. To anyone.
• We do not use your documents to train artificial intelligence models.
• We do not receive, store, process or log your signing certificate (.p12) or its password.
• We do not profile you or make automated decisions with legal effects on you.

5. Who we share it with

Only the providers needed for the service to work, and only what they need. Each is listed individually, with its location and its function, in the DPA.

We would also hand data to an authority where a legally valid order compels us.

6. International transfers

Some providers process data outside Ecuador. In those cases we require adequate safeguards (contractual clauses and equivalent security commitments) under the LOPDP. The detail is in the DPA.

7. How long we keep it

• Account data: while the account is active.
• Contracts and documents: while the account is active. When you close it, they stay available for you to download for 6 months; after that they are deleted.
• Billing records: as long as Ecuadorian tax rules require.
• Access and audit logs: up to 12 months.

8. Your rights

You may request access, rectification, deletion, objection, portability and restriction of processing, and withdraw any consent you gave. Write to support@askroby.io and we will respond within the time limits set by the LOPDP.

If you believe we handled your request badly, you may complain to Ecuador’s Superintendency for Personal Data Protection.

9. Security

We encrypt data in transit and at rest, isolate each company’s data at the database level, and restrict internal access to the minimum necessary. You can read the detail on the Security page.

If a breach affecting your data occurs, we will notify you and report it to the authority within the legal deadlines.

10. Cookies

We use only the cookies needed to keep you signed in. We use no advertising cookies and we do not sell your browsing.

11. Minors

The service is for businesses and adults. We do not direct it at minors and do not knowingly collect their data.

12. Contact

Controller: AskRoby ([LEGAL NAME], tax ID [RUC]). Email: support@askroby.io. WhatsApp: +593 99 061 2230.