Clapp Privacy Policy

1. Controller

The controller of the data described in this policy is Senzil, Argentina ("Clapp"). Privacy contact: privacidad@clapp.ar.

2. Who it applies to

People who create a Clapp account or are invited to a team (owners, receptionists, professionals, agents, etc.) and people who contact us.

It does not apply to the data a business enters about its own customers (bookings, records, payments, messages). For that data the business is the controller and Clapp acts as processor, under Annex A of the Terms of Service. If you are a customer of a business that uses Clapp, see its policy (on its portal, at /privacidad) or contact it directly.

3. What data we process

• Account: first and last name, email, phone (if you add it), language, password (stored only as a hash) and, if you turn on two-step verification, its encrypted secret key and recovery codes as hashes.
• Business and billing: business name, industry, country, tax details to invoice the plan and payment history. Card data is handled by Mercado Pago; Clapp does not receive it.
• Security and sessions: date and IP of the last sign-in, failed attempts, open sessions, devices registered for push notifications and your acceptance of these documents (version, date, IP and browser).
• Activity: a log of the actions taken in the account (who created, changed or deleted what and when), for security and so the business can audit its team.
• Use of the Clappi helper: the questions you ask and whether the answer helped, to improve its answers.
• Communications: the messages you send to support and the emails we send you (security notices, billing, service updates).

4. Purposes and legal basis

We do not make automated decisions with legal effects on you. Today Clappi answers with rules, without artificial intelligence; if that changes, we will update this policy first.

5. Who we share data with

With the providers that help us run the Service (sub-processors), only for that purpose and under contracts that require them to protect it:

With the business you work for: the owner and those with permission see your name, your access and your activity within that business.

With authorities, when a law or court order requires it.

If Clapp is sold or merged, the data would pass to the new owner, who will remain bound by this policy; we would let you know beforehand.

6. International transfers

Data is hosted on Amazon Web Services and Neon servers in the United States. These transfers rely on standard contractual clauses and the security commitments of those providers, in accordance with Law 25.326, the LGPD and the GDPR.

7. How long we keep it

• Account data: while the account exists and up to 90 days after it is closed.
• Sessions: expire after 7 days without use and at most 30 days after sign-in.
• Activity log: 18 months in the database; then it is archived privately for security and legal obligations.
• Conversations with Clappi: 12 months.
• Emails sent: the content for 90 days and the record of the sending for 24 months.
• Clapp’s billing: the periods required by tax law.
• Acceptances of these documents: while the account exists and for the statute of limitations of legal claims.

8. Security

We use encrypted connections (HTTPS), hashed passwords, encryption of integration credentials and keys, optional two-step verification, lockout after repeated attempts, expiring sessions, activity logs, isolation between businesses and backups. No system is infallible: if an incident affects you, we will notify you and report it to the authority when required.

9. Cookies and browser storage

The admin app uses one necessary cookie (clapp_rt) to keep your session secure and the browser’s local storage for your preferences (language, theme, home screen). We do not use advertising cookies or third-party tracking tools in the app.

Each business’s booking portals have their own cookie notice, managed by the business.

10. Your rights

You can ask to access, rectify, update or delete your data, object to a processing, ask for portability or withdraw a consent. You can change much of your data yourself in My profile. For the rest, write to privacidad@clapp.ar from your account’s email; we reply within the periods set by the law that applies to you (in the EU, within one month).

If you are a team member of a business, some data (such as the activity log) also belongs to the business, which may need to keep it.

In Argentina, the AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, as the Supervisory Authority of Law No. 25.326, has the power to hear complaints and claims from anyone whose rights are affected by non-compliance with personal data protection rules.

If you are in Brazil you can turn to the ANPD, and if you are in the European Union, to the data protection authority of your country.

11. Minors

Clapp is not intended for people under 18 and we do not knowingly create accounts for them.

12. Changes to this policy

If we change this policy materially, we will notify you in the app or by email and ask you to accept the new version. The date above shows the last update.