Privacy Policy

PlenoAgent is controlled by Mateo Alejandro Zambrano Delgado, taxpayer ID 1316093838001, located at 120th Street, avenues 109–110, Manta, Ecuador.

PlenoAgent is a SaaS platform for ISPs and WISPs. Privacy inquiries may be sent to [email protected].

This policy applies to the PlenoAgent website, accounts, dashboard, and cloud modules.

PlenoAgent controls the data needed to administer accounts and provide the platform. When an ISP uploads subscriber, employee, or contact data, the ISP generally determines the purposes of processing and PlenoAgent acts as its processor to operate the service.

Depending on the modules used, we may process these categories:

• Account and company data: name, email, phone, hashed password, company, country, taxpayer ID, and contact details.
• ISP-managed data: subscribers, identifiers, addresses, contracts, plans, subscriptions, equipment, and technical staff.
• Communications: conversations, phone numbers, messages, voice notes, images, and files handled through WhatsApp or support.
• Network and operations data: routers, OLTs, ONUs, topology, IP addresses, encrypted credentials, metrics, alarms, and action logs.
• Financial and tax data: payments, balances, invoices, receipts, cash boxes, suppliers, and bank notifications. Full card details are processed by Payphone and are not stored by PlenoAgent.
• Technical data: session, IP address, browser, activity, diagnostics, AI usage, and advertising measurement through Google Ads.

With the user's express authorization, PlenoAgent requests the read-only scope https://www.googleapis.com/auth/gmail.readonly. The integration searches recent messages from configured bank domains and uses them solely to detect transfers and reconcile ISP payments.

We may store the message identifier and date, up to 500 characters of relevant content, the DKIM domain, and extracted fields such as amount, sender, document, and reference. The Google refresh token is encrypted with AES-256-GCM and isolated by company.

PlenoAgent does not send, delete, or modify email; does not use Gmail data for advertising, profiling, creditworthiness, or general model training; does not sell it; and does not permit human access except with consent for support, security investigation, or legal requirements.

PlenoAgent's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Permission can be revoked from the Google Account or by deleting the connected bank account in PlenoAgent.

We use information only for purposes related to the platform:

• Create and administer accounts, authenticate users, and provide enabled modules.
• Protect accounts, prevent fraud, verify email signatures, and maintain security and auditability.
• Manage prepaid usage, payments, billing, bank reconciliation, and tax obligations.
• Answer requests, diagnose incidents, and communicate operational notices.
• Meet contractual, tax, regulatory, and lawful authority requirements.
• Measure performance and improve the service using technical and usage information.

We process data to perform a contract or pre-contractual steps, comply with legal duties, and protect the security and continuity of the service.

Optional integrations, including Gmail, are enabled through consent and OAuth authorization. Users may withdraw access without affecting prior lawful processing.

We may use providers that process data under their own terms and safeguards: Interserv for infrastructure; Google for Gmail, Gemini, and Google Ads measurement; Meta/WhatsApp for communications; Payphone for payments; Resend for transactional email; and Ollama or OpenRouter for AI features.

Some providers may process information outside Ecuador. We limit sharing to what each function needs and do not sell personal data. Each ISP must inform its own data subjects about the providers it enables.

We retain operational data while an account is active. Following cancellation, it will be deleted or anonymized within 30 days, unless the data subject requests earlier deletion and it is technically and legally possible.

Invoices, payments, security evidence, and other records may be kept longer when required for legal or tax duties, dispute resolution, or fraud prevention. Their use will be limited to those purposes.

When a Gmail connection is deleted, we stop accessing the mailbox and delete its stored credential. Reconciliation data already incorporated follows the retention period applicable to the account and financial records.

We apply logical tenant isolation, access controls, activity records, encrypted connections, and encryption for sensitive secrets. Passwords are hashed and Gmail tokens use authenticated encryption.

No system is completely invulnerable. We manage incidents reasonably and provide notice when applicable law requires it.

Subject to applicable law, individuals may request information, access, updating, correction, deletion, objection, portability, or suspension of processing, and may withdraw consent where relevant.

Requests may be sent to [email protected]. We may verify identity before responding. Individuals may also complain to Ecuador's Personal Data Protection Superintendency.

We use cookies required for language, company, and session state, and local storage for interface preferences. In production, Google Ads may use cookies or identifiers to measure campaigns. Users can control these technologies through their browser and Google settings.

PlenoAgent is a business service and is not directed to children. We do not knowingly collect children's data as direct platform users.

We may update this policy when the service, providers, or legal duties change. We will publish the effective date and provide reasonable notice of material changes.

Controller: Mateo Alejandro Zambrano Delgado, taxpayer ID 1316093838001. Address: 120th Street, avenues 109–110, Manta, Ecuador. Email: [email protected].