Legal

FinisAI Privacy Policy

Last updated: 12 August 2026

This Privacy Policy describes how Grupo Hurtado SpA, Chilean tax ID (RUT) 78.193.568-9, domiciled in Santiago, Chile, as owner and operator of the FinisAI platform, collects, uses, stores, discloses and protects personal data related to its websites, applications, services and associated channels.

This Policy applies, as applicable, to:

• finisai.tech;
• app.finisai.tech;
• FinisAI applications and services;
• contact forms;
• commercial communications;
• messaging channels connected to FinisAI;
• integrations enabled by our customers;
• interactions with artificial intelligence agents operated through FinisAI.

For questions or requests regarding privacy and personal data protection, write to privacidad@finisai.tech.

1. Who is responsible for FinisAI

FinisAI is operated by:

• Grupo Hurtado SpA
• RUT: 78.193.568-9
• Address: Santiago, Chile
• Privacy contact: privacidad@finisai.tech

Depending on the service and the specific processing, Grupo Hurtado SpA may act:

As data controller

When it directly determines the purposes and means of processing personal data, for example in relation to:

• FinisAI users;
• prospective customers;
• business contacts;
• website visitors;
• account administration;
• billing;
• platform security;
• FinisAI’s own communications.

As data processor

When it processes personal data on behalf of a FinisAI customer company and following its instructions. For example, when a customer uses FinisAI to manage:

• conversations with their own customers;
• contacts;
• sales opportunities;
• quotes;
• messages;
• documents;
• tasks;
• business processes.

In those cases, the customer company normally determines the purpose of the processing and FinisAI provides the infrastructure and processing needed to deliver the contracted service.

2. What FinisAI is

FinisAI is a business platform that uses software, automation and artificial intelligence systems to help organizations turn conversations, data and events into business actions.

Among other capabilities, FinisAI can help to:

• handle inquiries;
• interpret requests;
• organize conversations;
• identify sales opportunities;
• look up catalogs;
• prepare quotes;
• follow up;
• generate tasks;
• organize business information;
• prepare responses;
• execute previously authorized actions;
• coordinate processes through artificial intelligence agents.

Available functionality depends on the contracted configuration and on the integrations each customer enables.

3. Data we may process

Depending on how a person or company uses FinisAI, we may process the following categories of information.

3.1 Identification data

For example:

• first name;
• last name;
• company;
• role;
• email address;
• phone number;
• business identifiers;
• information needed to create or administer an account.

3.2 Commercial information

For example:

• company or organization;
• products or services inquired about;
• quote requests;
• sales opportunities;
• service history;
• commercial preferences;
• background provided during a negotiation;
• opportunity status;
• quotes and proposals.

3.3 Conversations and messages

FinisAI may process communications carried out through channels enabled by the user or the customer company, including, as applicable:

• web chat;
• email;
• WhatsApp;
• forms;
• other messaging or communication services integrated in the future.

This data may include both the content of the message and the technical metadata needed to process it.

3.4 Platform usage information

We may process information relating to:

• sign-in and sign-out;
• use of features;
• actions performed;
• date and time;
• IP address;
• browser;
• device;
• errors;
• technical events;
• session identifiers;
• audit records.

3.5 Information provided through integrations

When an organization connects external systems to FinisAI, the platform may process information coming from those systems according to the instructions and permissions the customer configures. Those integrations may include, among others:

• messaging platforms;
• email;
• CRM;
• ERP;
• storage systems;
• productivity tools;
• payment systems;
• business services.

FinisAI should access only the information necessary to deliver the authorized functionality.

4. What we use the data for

We may process personal data for the following purposes, as applicable:

• providing FinisAI services;
• creating and administering accounts;
• authenticating users;
• managing permissions;
• processing conversations;
• responding to inquiries;
• identifying commercial or operational intent;
• preparing opportunities and quotes;
• executing functionality requested by authorized users;
• maintaining conversation history and continuity;
• providing support;
• improving the stability and operation of the platform;
• preventing fraud and abuse;
• maintaining security;
• recording audit and traceability;
• managing contracts and commercial relationships;
• billing for services;
• complying with legal obligations;
• investigating incidents;
• responding to data protection requests;
• developing and improving FinisAI functionality in a manner compatible with applicable obligations.

We will not use personal data for purposes incompatible with those for which it was collected without a valid legal basis where one is required.

5. Artificial intelligence

FinisAI uses artificial intelligence systems to deliver certain platform functionality. These systems may act, for example, to:

• interpret natural language;
• understand a request;
• classify intent;
• summarize information;
• query authorized tools;
• prepare responses;
• identify missing information;
• recommend actions;
• prepare documents;
• help complete business processes.

Depending on the functionality used, certain information from a conversation may be processed by technology providers specialized in artificial intelligence models. FinisAI seeks to limit the information sent to those services to what is necessary to deliver the corresponding functionality.

Artificial intelligence models should not, on their own, be treated as an authoritative source of business information. Information such as pricing, permissions, business status and internal data must be obtained, where applicable, from FinisAI’s authorized business sources.

6. Automated decisions and actions

FinisAI may use artificial intelligence agents and automation to recommend, prepare or execute certain business actions. The degree of automation depends on:

• the customer’s configuration;
• the permissions granted;
• the type of action;
• the rules configured;
• the applicable policies;
• the controls in place.

Certain actions may require human approval or intervention before execution. Where applicable, FinisAI will seek to provide reasonable mechanisms for human oversight, review or intervention regarding automated processes that produce significant effects for individuals.

7. Legal bases for processing

We process personal data only where a basis permitting such processing exists under applicable law. Depending on the case, processing may rely, among others, on:

• the data subject’s consent;
• performance of a contract;
• steps necessary to enter into or administer a contractual relationship;
• compliance with legal obligations;
• processing requested or authorized by a customer company;
• legitimate interests, where applicable law permits;
• other bases recognized by law in force.

Where FinisAI acts as processor on behalf of a customer company, the customer is responsible for determining the legal basis for the processing it carries out through the platform.

8. WhatsApp and other messaging channels

When a company enables WhatsApp Business Platform or another messaging channel within FinisAI, messages may be processed by:

1. the channel provider;
2. FinisAI;
3. the business systems authorized by the customer;
4. technology providers needed to deliver the contracted functionality.

The customer company is responsible for configuring and using those channels in accordance with applicable law and with the corresponding provider’s terms.

FinisAI may retain messages and associated metadata where necessary to:

• maintain conversations;
• provide the service;
• generate traceability;
• handle requests;
• execute authorized actions;
• resolve errors or incidents.

9. Providers and sub-processors

To operate FinisAI we may use technology providers delivering services such as:

• cloud infrastructure;
• hosting;
• databases;
• artificial intelligence;
• email;
• messaging;
• storage;
• observability;
• authentication;
• payment processing;
• security.

These providers may process data only where necessary to deliver their services to FinisAI and in accordance with the corresponding contractual and legal terms. FinisAI may maintain or publish additional information about its main providers or sub-processors where necessary.

10. International data transfers

Some technology providers used by FinisAI may operate infrastructure or process information outside Chile. As a result, certain personal data may be stored, accessed or processed internationally.

Where applicable, FinisAI will adopt the contractual, organizational or technical measures reasonably necessary for those transfers to be carried out in accordance with applicable law. Where FinisAI acts as processor, these operations may also be governed by the agreements entered into with the customer company.

11. Data retention

We will retain personal data for as long as necessary to:

• provide the contracted services;
• maintain the commercial relationship;
• fulfill the purposes disclosed;
• meet legal obligations;
• resolve disputes;
• maintain reasonable audit and security records.

Retention periods may vary depending on the nature of the data and the existing relationship with the user or customer. Once data is no longer necessary, it may be:

• deleted;
• anonymized;
• blocked;
• retained only where a legal obligation or justification exists.

Business customers may be subject to specific retention policies associated with their account or contract.

12. Information security

FinisAI uses technical and organizational measures intended to protect information against unauthorized access, loss, alteration, improper disclosure or destruction. These measures may include, as applicable:

• authentication;
• authorization;
• isolation between organizations;
• permission management;
• access controls;
• encryption provided by the technology infrastructure;
• secrets management;
• audit records;
• monitoring;
• backups;
• environment separation;
• controls over integrations and tools.

No computer system can guarantee absolute security. Should a significant incident be detected, FinisAI will take the measures reasonably necessary given its nature and applicable legal obligations.

13. Isolation between customers

FinisAI operates as a multi-company platform.

Data associated with one organization must be kept logically separate from data belonging to other organizations. Users should only access information belonging to organizations for which they are authorized.

14. Data subject rights

Individuals may exercise the rights granted to them by Chilean law in force on personal data protection. These may include, where applicable:

• access;
• information;
• rectification;
• modification;
• deletion or erasure;
• cancellation;
• blocking;
• objection;
• portability;
• withdrawal of consent, where applicable.

The availability and specific scope of each right depends on the law in force and on the circumstances of the processing.

To exercise a right, the data subject may write to privacidad@finisai.tech. The request must contain enough information to:

• identify the requester;
• identify the data or processing the right is exercised over;
• allow their identity to be reasonably verified;
• clearly explain the request.

We will not request information unnecessary to verify identity.

Specific instructions for requesting deletion are on the Data Deletion page.

15. Requests about FinisAI customers’ data

In certain cases, FinisAI acts solely as processor on behalf of a customer company. If a person requests access to, modification or deletion of, or objects to the processing of information controlled by one of our customers, we may:

• inform the corresponding customer;
• forward the request to the customer;
• work with the customer to respond to it.

This is because, in those cases, the customer company may be the one determining the purposes of the processing and the one who must resolve the data subject’s request.

16. Sensitive data

FinisAI is not designed to indiscriminately request sensitive personal data. Customers must not use the platform to process sensitive data in a manner contrary to applicable law.

Where functionality legitimately requires processing data of this nature, the corresponding conditions, authorizations and additional measures must be applied.

17. Children’s and minors’ data

FinisAI is a platform primarily intended for companies and professional users. It is not specifically directed at children or adolescents.

If we detect improper processing of minors’ information, we may take measures to limit, block or delete such processing in accordance with applicable law.

18. Cookies and similar technologies

FinisAI sites and applications may use cookies, local storage or other technologies necessary to:

• maintain sessions;
• authenticate users;
• protect accounts;
• remember certain preferences;
• measure performance;
• improve the experience;
• obtain usage statistics.

Where applicable law requires consent for certain technologies, FinisAI may implement mechanisms to request it.

19. Commercial communications

We may use contact details to send communications related to:

• FinisAI;
• requests made by the interested party;
• demos;
• proposals;
• services;
• relevant updates.

Where applicable, individuals may ask to stop receiving commercial communications. Operational communications, or those necessary to provide a service, may continue while a contractual relationship or a legitimate reason to send them exists.

20. Audit and traceability

FinisAI may keep records relating to actions performed within the platform for the purposes of:

• security;
• support;
• compliance;
• error resolution;
• business control;
• incident investigation;
• traceability of artificial intelligence agents.

These records may include information about:

• the user or service that initiated an action;
• date and time;
• the agent used;
• the tool called;
• the result;
• approval status;
• the action ultimately performed.

The information recorded must be limited to what is reasonably necessary for these purposes.

21. Account deletion and service termination

When a company stops using FinisAI, the processing of its data will follow:

• the corresponding contract;
• the customer’s valid instructions;
• retention policies;
• applicable legal obligations.

There may be reasonable periods for exporting, deleting, backing up or recovering information. Certain records may be kept where a legal obligation, security need, audit or defense of rights exists.

22. Changes to this policy

This Privacy Policy may be updated where necessary to reflect:

• legal changes;
• new functionality;
• new providers;
• changes in how FinisAI operates;
• changes in our privacy practices.

The current version will be available at https://finisai.tech/en/privacy. Where a change is material and it is appropriate to do so, we may inform users through the platform or other reasonable means.

23. Governing law

The processing of personal data by Grupo Hurtado SpA is governed by applicable Chilean law. As of the date of this Policy, this includes Law No. 19,628 on the protection of private life and other rules currently in force.

FinisAI is also preparing its processes and practices for the framework established by Law No. 21,719, which amends the Chilean personal data protection regime and whose application will take place in accordance with its legal entry into force.

24. Privacy contact

For questions, requests or complaints regarding the processing of personal data:

• Grupo Hurtado SpA
• RUT: 78.193.568-9
• Santiago, Chile
• Brand and platform: FinisAI
• Email: privacidad@finisai.tech

Where the request concerns information processed on behalf of a customer company, FinisAI may coordinate its response with that organization.

25. FinisAI’s commitment

FinisAI aims for business artificial intelligence to be used in a way that is useful, controllable and traceable.

Our goal is for data to be used to carry out the business functions authorized by our customers and users, limiting processing to what is necessary to provide the service and maintaining reasonable controls over access to and use of the information.