Privacy Policy

1. Data controller

The data controller is Matías Ezequiel Martínez Burroso (CUIT 20-38940219-3, Argentine Republic), who operates under the trade name Muste. For any privacy question, to exercise your rights, or to request the deletion of your data, write to us at tinezmatias@gmail.com.

On WhatsApp you do not see the name Muste but the trade name of the account you are chatting with (currently "Mi Mundo Imprimible"). Every account we operate with Muste processes data under this same policy and the same controller.

Muste accesses only the business's own assets: our WhatsApp Business accounts, our phone numbers, and our Meta ad account. We do not access other businesses' accounts, messages, or data.

2. Who this policy covers

Internal users: the people who run the business and have access to Muste.

People who write to us on WhatsApp, often after tapping one of our ads on Facebook or Instagram. Your conversation is copied into our inbox so that we can reply to you.

People who buy a digital product from us.

3. Data we process

From internal users: name, email address, encrypted password, second authentication factor (MFA), role and permissions, and a log of the actions they take on the platform.

From WhatsApp, when you write to us: your phone number and WhatsApp identifier (wa_id); the profile name Meta provides; the content of the messages, including text, images, audio, video, documents, stickers, and reactions; your location, if you share it; and the sent, delivered, and read timestamps.

Ad origin: if you arrive from an ad, Meta tells us along with the message which ad or post you tapped (its identifier, title, and text) and a click identifier. We use it to know which product you are interested in and to measure our ads.

Purchases and payments: the product, price, currency, country (inferred from your number's country code), payment method, and payment status. If you pay by bank transfer, the image of the receipt you send, which may include your name, your bank, your account details, the amount, and the date; and the matching movement in our Mercado Pago account, which we verify it against.

Delivery: the download link generated for your purchase, its expiry, and when it was used.

We also keep a copy of the technical notice (webhook) Meta sends us for each event, so we can reprocess it if something fails, and we host attachments in our own storage because Meta's links expire within a few hours. We also keep the tags and internal notes the team adds about a contact.

Minimal technical data: activity logs, errors, and usage metrics, for security, auditing, and diagnostics.

4. Purpose and legal basis

Replying to your messages, showing you the product, taking your payment, and delivering it. Basis: the pre-contractual steps you request by writing to us, and the performance of the purchase contract.

Meeting accounting and tax obligations on sales. Basis: legal obligation.

Measuring and improving our ads: we link your conversation and purchase to the ad you came from, and we may tell Meta, through its Conversions API, that a checkout or a purchase happened, along with the click identifier and your phone number protected with an irreversible hash. Basis: our legitimate interest in measuring advertising; you can object by writing to us.

Sending you commercial messages on WhatsApp. Basis: your consent. You can opt out at any time, as explained in section 9.

Security, internal auditing, and fraud prevention, including detecting fake or reused payment receipts. Basis: legitimate interest.

We do not use the data we receive from Meta for any other purpose: we do not sell it, we do not transfer it to third parties for their own purposes, we do not combine it with data bought from other companies, and we do not use it to train artificial intelligence models.

5. Automation and artificial intelligence

Some replies are written and sent by an automated assistant. To do so, your messages and the earlier ones in the same conversation, together with the product information, are sent to Anthropic's API (the Claude model), which also reads receipt images to extract their details. If you send a voice message, it is transcribed to text with OpenAI's API. Neither provider uses that content to train its models.

The assistant is automated and you can ask to speak with a person at any time. The team can take over the conversation whenever it considers it necessary.

A payment is never rejected without a person reviewing it, and you can ask for a person to review any of the assistant's replies or decisions.

We do not make automated decisions that produce legal effects on you or similarly significantly affect you.

6. Providers and international transfers

Muste relies on the following providers, which process data on our behalf and under our instructions: Meta Platforms (WhatsApp Business, and the Marketing and Conversions APIs); Mercado Pago (payment links and reading our account's movements); Railway (infrastructure, database, and job queues); Cloudinary and Cloudflare (storage of attachments and of the products); Vercel (hosting of the interface); Anthropic (the automated assistant and receipt reading); OpenAI (voice-message transcription and search over our reference material); Resend (email delivery); and Sentry (error logging).

Muste is operated from Argentina, a country the European Commission recognizes as providing an adequate level of data protection, and several of these providers process data in the United States or other countries. For those transfers we rely on the safeguards the providers offer, such as the EU-U.S. Data Privacy Framework or the standard contractual clauses approved by the European Commission.

We do not sell personal data or transfer it to third parties for purposes unrelated to the business.

7. Retention

We keep each piece of data only for as long as the purpose that justifies it requires.

The technical copies of the notices Meta sends us (webhooks) are automatically deleted after 90 days.

Download links stop working a few hours after they are generated.

Conversations, their attachments, and internal notes are kept for as long as they remain necessary to serve you and to support your purchases; if you ask us to delete them sooner, we proceed as described in section 8.

Purchase records and payment receipts are kept for the period required by Argentine accounting and tax obligations.

Internal users' data is kept for as long as their access to the platform lasts.

8. How to request the deletion of your data

Anyone whose data Muste processes can ask us to delete it, without needing an account on the platform.

To request it, write to us at tinezmatias@gmail.com with the subject "Data deletion", stating the WhatsApp number you wrote to us from. You can also request it by replying "ELIMINAR MIS DATOS" — Spanish for "delete my data" — in the same WhatsApp conversation.

The full procedure is at app.muste.app/data-deletion.

We verify your identity before deleting anything, so that we do not erase another person's data at a third party's request.

What we delete: your contact record, your conversations and their full content (text, images, audio, video, documents, locations, and reactions), the files we host in our storage, the ad origin of your messages, tags and internal notes, and the corresponding technical copies of Meta's notices.

What we cannot delete: purchase records and payment receipts that accounting and tax rules require us to keep. In that case we explain it to you and limit the use of that data to that sole purpose.

Timeframe: we acknowledge the request within 5 business days and complete it within 30 calendar days. We let you know in writing when it is done.

Deleting your data from Muste does not erase the conversation history on your own device, nor the data Meta keeps on its own account. For that, see WhatsApp's privacy tools.

9. Commercial communications and opting out

We only send you commercial messages on WhatsApp if you agreed to receive them, and always using templates previously approved by Meta.

You can opt out at any time by replying "BAJA" — Spanish for "unsubscribe" — in the same WhatsApp conversation, or by writing to tinezmatias@gmail.com. The opt-out applies to all of our campaigns and is permanent until you ask us otherwise.

Opting out does not affect messages that answer a question of yours or relate to a purchase in progress, such as the delivery of your product.

10. Security

We apply role-based access control, strong authentication (MFA), secure cookie sessions, encryption in transit, and audit logs of sensitive actions. Download links are personal and expire within a few hours.

If a security incident affecting your personal data were to occur, we will notify you and inform the supervisory authority where applicable.

11. Your rights

You can request access to, rectification, erasure, and portability of your data, object to its processing or ask us to restrict it, and withdraw at any time any consent you gave us, by writing to tinezmatias@gmail.com. In Mexico these are your ARCO rights.

If you live in the European Union or the European Economic Area, you can also lodge a complaint with the data protection authority of your country.

In Argentina, the Agency for Access to Public Information, as the supervisory body of Law 25.326 on the Protection of Personal Data, handles complaints from anyone whose rights are affected.

If you live in another country, such as the United States, you can exercise through the same channels the rights granted to you by the law of your place of residence. We respond within the timeframes that law sets.

12. Minors

Muste is not directed at people under 18 and we do not intentionally collect minors' data. If we detect that a conversation belongs to a minor without the authorization of whoever holds parental responsibility, we delete that data.

13. Changes to this policy

We may update this policy when our integrations or the way we process data change. The version in force is always the one published on this page, with its last-updated date at the top.

14. Contact

For any question about this policy, write to us at tinezmatias@gmail.com.