Makatea stores data in the United States with encryption in transit and at rest. Each organization sees only its own data. Every action goes to a log that cannot be edited. Makatea removes from sends anyone who opts out. In an incident it notifies the customer within 24 hours.
Makatea at a glance
| Company | SOLUCIONES ORIENTADAS AL BIENESTAR DE LAS PERSONAS SOLU S.A.P.I. de C.V., Mexico |
|---|---|
| Data hosting | United States |
| Encryption in transit | TLS on every connection |
| Encryption at rest | AES-256 |
| Isolation | By organization, in the database |
| Access | By roles within each organization |
| Audit log | Append-only, cannot be edited or deleted |
| Card data | Never passes through Makatea |
| Incident notice | To the customer within 24 hours |
| Message retention | Active account plus 12 months |
| Sub-processors | 5 categories with 30 days' notice |
| Privacy | rodrigo@makatea.ai |
How does Makatea protect the platform?
With encryption, isolation by organization and a record of every action.
- Encrypts every connection with TLS and stores data with AES-256.
- Isolates each organization in the database.
- Gives access by role within each organization.
- Keeps integration keys out of users' reach.
- Records user, action, IP, browser and time of every change.
- Records payments only as new entries, never as edits.
How does Makatea handle personal data?
Makatea is Controller of your account data and Processor of your portfolio data.
- Processes your portfolio data only on your instructions.
- Does not sell personal data or share it for advertising.
- Analytics providers receive only aggregated information, without your customers' data.
- Deletes or anonymizes data at the end, unless the law requires keeping it.
- Handles data subject rights free of charge in every country.
What does Makatea do for responsible collections?
It brings features so each customer can follow its country's rules.
- Removes from sends anyone who opted out.
- Puts the name of the business collecting in every message.
- Stops reminders once the payment is recorded.
- Lets you set the start and end time of sends.
- Publishes the prohibited uses and the WhatsApp rules.
- Publishes collection rules by country with their official source.
Which data protection laws does it cover?
The Privacy Policy has a section for each country.
- Mexico, LFPDPPP.
- Colombia, Law 1581 of 2012.
- Brazil, LGPD.
- Ecuador, LOPDP.
- Peru, Law 29733.
- European Union and Spain, GDPR.
- United Kingdom, UK GDPR.
- India, DPDP Act 2023.
- United States, state privacy laws.
What happens if there is a security incident?
Makatea notifies the customer within 24 hours of detecting it. That lets the customer meet its country's deadlines, such as Peru's 48 hours or the GDPR's 72 hours.
Which providers process the data?
Five categories of providers, with their country and transfer mechanism on the sub-processors page. Makatea announces any change 30 days in advance.
Who do I write to?
To the privacy officer, José Rodrigo Barrios Villa, at rodrigo@makatea.ai. It is Makatea's only privacy mailbox for every country.
Which documents can I review?
- Terms of Service
Terms of Service of Makatea, the software businesses in any country use to collect from their customers over WhatsApp and email. Prices in USD.
- Privacy Policy
How Makatea handles personal data in each country: roles, purposes, transfers, rights and privacy contact. Covers GDPR, LGPD and Mexico's LFPDPPP.
- Data Processing Agreement (DPA)
Makatea's Data Processing Agreement with its EU and UK annex. Standard contractual clauses, sub-processors and incident notice within 24 hours.
- Cookie Policy
Which cookies makatea.ai uses, what they do and how to change your choice. In the EU and the UK measurement is turned on only if you accept it.
- Prohibited uses
What you cannot do with Makatea: businesses WhatsApp prohibits, who not to message and what a collection message cannot say.
- Sub-processors
The providers that process data for Makatea, by function and country. Data hosted in the United States and 30 days' notice of changes.
- Responsible collections by country
The rules for collecting over WhatsApp and email in each country, with their official source. Hours, frequency, channels and what a message cannot say.