Privacy policy

Last updated: 17 September 2026

Octopus AI builds and operates conversational assistants for businesses. This policy explains what data we handle, why, and how you can exercise your rights. It follows Argentina's Personal Data Protection Act (Law 25.326).

Who is responsible

Octopus AI, based in the City of Buenos Aires, Argentina. You can reach us through our contact form.

When we handle conversations on behalf of a client business, that business is the data controller and Octopus AI acts as a data processor: we handle that data only under their instructions.

What data we handle

• If you write to us: your name, email, phone and whatever you tell us in the message.
• If you write to a business we serve: the name or username shown by the channel (WhatsApp, social media, email, web), the identifier that channel assigns, the content of the messages, and the details you provide for your order: delivery address, contact phone, chosen payment method, and a receipt if you decide to send one.

We never ask for or store passwords, full card numbers or banking credentials. If someone sends them by mistake, they are deleted.

What we use it for

• Answering questions and taking orders on behalf of the business.
• Arranging delivery or pickup and confirming payment.
• Alerting the business about anything that needs a person.
• Detecting failures and keeping the service running.

We do not use messages for advertising, we do not sell them, and we do not share them with third parties outside the service.

Providers we work with

To run the service we use infrastructure providers that may store data outside Argentina: Cloudflare (servers and web hosting), Supabase (database), Telegram and Meta Platforms (WhatsApp and Instagram) as messaging channels, Anthropic or the corresponding AI engine to draft replies, and Resend for email notifications. Each one handles data under its own policies.

How long we keep it

Conversations and orders are kept for as long as the relationship with the business lasts, plus up to one year to resolve claims. After that they are deleted or anonymised. If a business stops working with us, we hand over their data and remove it from our systems.

Artificial intelligence

Replies are drafted by a language model that receives the conversation history and the business rules. It is not trained on that data. The assistant writes under the business name and, if someone asks directly whether they are talking to an automated assistant, it says so and hands the conversation to a person.

Your rights

You can request access, rectification, updating or deletion of your data through our contact form, or by following the steps in delete my data. We respond within the deadlines set by Law 25.326.

Argentina's Agency for Access to Public Information, the authority for Law 25.326, handles complaints from anyone who considers their rights affected.

Minors

The service is intended for people over 18. We do not knowingly collect data from minors.

Security

Connections are encrypted, keys are kept in secret stores, and database access is restricted to the services that need it. No system is infallible: if an incident affects your data, we will report it.

Changes

If we update this policy, we change the date in the header and publish the new version at this same address.