Privacy Policy
Published: October 1, 2026
Effective from: October 1, 2026
1. Effective date and legal framework
This version was published and takes effect on September 24, 2026. The comprehensive amendment to Law No. 19,628 introduced by Law No. 21,719 applies from December 1, 2026, alongside other applicable Chilean rules.
Cebric adopts the enhanced practices described here from the publication date. References to the Personal Data Protection Agency and the new statutory provisions become operational on December 1, 2026.
2. Controller, scope and roles
Controller: Cebric Ingeniería SpA ("Cebric"), Chilean RUT 78.490.233-1, domiciled at Av. Los Jardines 932, Huechuraba, Metropolitan Region, Chile. Legal representative: Sebastián Richards Carmona. Covered sites and services: cebric.cl, www.cebric.cl, app.cebric.cl, api.cebric.cl and their operational subdomains.
Privacy channel: privacidad@cebric.cl. Address for correspondence: Av. Los Jardines 932, Huechuraba, Metropolitan Region, Chile. This channel receives communications addressed to Cebric and its legal representative.
- Cebric as controller: Cebric determines purposes and means for data about visitors, prospects, customer administrators, account users, billing, security, support and commercial relationships.
- Cebric as processor: Cebric processes, under the customer's instructions, data uploaded or generated by that customer about workers, signers, suppliers, contacts and third parties. The customer determines lawfulness, purpose and content. The Data Processing Addendum in the Terms governs this processing.
- Customer as controller: the customer must inform its data subjects, have a legal basis, issue lawful instructions, restrict access and avoid unnecessary data.
3. Data subjects, data and sources
3.1 Data subjects
We may process data about visitors, prospects, customers, authorized users, customer workers and contractors, signers, suppliers, emergency contacts and other persons lawfully included by a customer.
3.2 Categories of data
- Identity and contact: first and last name, email, telephone, address, country, Chilean RUT or other identification document, nationality, role, company and representative details.
- Account and authentication: user identifier, verified email, organization, roles, permissions, sessions, authentication factors and related records. Credentials are managed by the authentication service; Cebric does not display passwords in plain text.
- Commercial and billing: plan, usage, legal name, tax ID, billing address, receipts, payment status and transaction references. Cebric does not store the full card number or security code.
- Use, support and security: IP address, date and time, browser, operating system, route, relevant actions, errors, audit events, support messages and anti-fraud signals.
- Contact form: name, business email, company, category, message and Turnstile verification result.
- Customer Data: files, contracts, amendments, templates, employment records, worker data, projects, expense reports, receipts, invoices, suppliers, approvals and custom fields.
- Simple electronic signature: document, identity stated and verified for the relevant flow, consent, status, date and time, IP address, user agent, authentication evidence, hash and audit trail.
- AI-assisted processing: images and text from documents selected by the user, instructions, extracted data, classifications and human corrections.
- Optional integrations: data strictly necessary for an integration enabled by the customer, such as occupational health and safety records sent to or received from ACHS.
3.3 Sources
We obtain data directly from the data subject; from their employer, principal, administrator or customer; from uploaded documents and files; from devices and technical logs; from authentication, payment, security and communications providers; from enabled integrations; and from publicly accessible sources where an authorized feature requires it. When data does not come from the data subject, Cebric or the customer will disclose the source according to its applicable role.
4. Purposes and legal bases
Consent is governed by Article 12 of Law No. 19,628 as amended. Other lawful bases are governed by Article 13. We will not use data for an incompatible purpose without an applicable legal basis and notice.
| Purpose | Main data | Legal basis |
|---|---|---|
| Answer inquiries and prepare an offer | Contact, company, category and message | Pre-contractual steps requested by the data subject; consent where applicable |
| Create, authenticate and manage accounts and organizations | Identity, contact, authentication, roles and sessions | Contract performance or pre-contractual steps |
| Provide document, expense, signature and other contracted modules | Account data and Customer Data | Contract performance; for processed data, the customer's documented instructions |
| Process subscriptions, payments, invoices and collections | Billing, plan and payment references | Contract performance and tax and accounting obligations |
| Provide support and transactional communications | Contact, account, messages and diagnostics | Contract performance and legitimate interest in resolving faults and maintaining the Service |
| Prevent abuse, fraud and incidents; protect accounts and evidence | Sessions, IP, activity, audit records and security signals | Cebric's, customers' and users' legitimate security interests; legal obligations |
| Operate, measure and improve reliability and performance | Cookieless pageviews, minimized telemetry, errors and aggregate metrics; analytics interactions only after acceptance | Legitimate interest in operating, protecting and measuring the site's general reach through minimized cookieless statistics; consent for persistent and interaction analytics |
| Send marketing not required to perform the contract | Name, email and preferences | Revocable consent and commercial communication rules |
| Handle rights, claims, audits and disputes | Request, identity, evidence and records | Legal obligation and legitimate interest in exercising or defending rights |
| Comply with a valid authority order | Data validly and proportionately requested | Legal obligation |
The specific legitimate interests are information security, fraud prevention, continuity, diagnostics, legal defense and proportionate technical improvement. Before relying on them we assess necessity, proportionality and impact. The data subject may object as provided by law.
5. Sensitive data and minors
Some features may host sensitive data, such as health or union information contained in employment documents, only where the customer includes it under a valid legal basis. Cebric does not require this data to create an account and, as processor, does not decide to upload it. We apply restricted access, minimization and risk-appropriate safeguards.
The Service is not directed to minors. Data about children under 14 requires action or consent from their parents or legal representatives where required by law. Processing sensitive data about a person under 16 requires authorization from a parent or legal representative unless another legal authorization applies. A customer uploading data about adolescent workers must verify its legal basis and limit processing to the lawful employment relationship, under Article 16 quater.
6. Recipients, processors and third parties
We share only what is necessary for the disclosed purpose. Providers are subject to contracts, confidentiality, safeguards and instructions under Article 15 bis when acting as processors.
| Provider or recipient | Function and data | Location or scope |
|---|---|---|
| Cloudflare, Inc. | DNS, CDN, WAF, Workers, Turnstile and R2 storage; web requests, IP addresses, security signals and stored files | Global network; processing may occur outside Chile |
| Neon, Inc. | PostgreSQL database and Neon Auth; account, authentication and structured Service data | United States, AWS us-east-1 infrastructure |
| Google LLC — Gemini API | User-requested AI processing; selected document or image, instructions and output | United States and the provider's global network |
| PostHog, Inc. | Cookieless public-site pageview measurement and, after acceptance, persistent interaction analytics; enabled product telemetry, diagnostics, support and minimized events | United States |
| Zoho / ZeptoMail | Transactional and support email; name, email address, necessary content and attachments | Provider's international infrastructure |
| Transbank S.A. | Payment and recurring charge authorization; merchant identifiers, amount, token and transaction status | Chile; it also acts under its own legal duties |
| Asociación Chilena de Seguridad (ACHS) | Optional occupational health and safety integration enabled by the customer; data defined by that integration | Chile; it may act as an independent controller |
| Advisers and authorities | Legal, accounting, audit or compliance work; only data necessary for a valid engagement or request | Case-dependent and subject to confidentiality |
The application server hosting provider and any material change to this list will be disclosed before processing Customer Data. Cebric will maintain an updated record and notify subprocessor changes under the Data Processing Addendum. We do not sell personal data.
7. International transfers
The listed providers may process data in the United States or other countries. From December 1, 2026, transfers will comply with Articles 27 and 28 of Law No. 19,628 as amended: an Agency adequacy decision, sufficient contractual safeguards — including model clauses when available — binding corporate rules or another applicable statutory exception.
Acceptance of this Policy is not treated as blanket authorization for every transfer. If a transfer requires consent, we will request it specifically and with adequate information. You may request the destination, provider and applicable safeguard at privacidad@cebric.cl.
8. Retention, return and deletion
| Information | Ordinary criterion or maximum period |
|---|---|
| Prospect inquiry without a contract | 12 months after the last interaction, unless valid consent or legal defense requires otherwise |
| Account and contractual relationship | For the relationship and afterward for applicable limitation, collection, audit and defense periods |
| Tax and accounting records | For the statutory retention period and while the authority may lawfully review them |
| Customer Data | For the contract; upon termination, an ordinary 30-day export window and deletion from active systems within 90 days, unless a valid instruction, obligation or dispute applies |
| Backups | Overwritten or isolated from ordinary use under the backup cycle, normally within an additional 90 days |
| Signature and legal acceptance evidence | For the validity of the act and as needed to prove integrity and consent or exercise and defend rights |
| Security and audit records | Normally 24 months; longer only for an incident, investigation or applicable duty |
| Marketing | Until consent is withdrawn or after 24 months without interaction, whichever occurs first |
| Cookie preference | Acceptance: 12 months; rejection: for the browsing session. We then request a new choice. |
| Cookieless pageviews | Up to 24 months with a non-persistent daily hash; it cannot deduplicate a person across days |
| Consented analytics events | Up to 24 months with minimized identifiers, or earlier when consent is withdrawn and deletion applies |
At the end of the period, we delete or irreversibly anonymize data using reasonable and verifiable measures. A legal obligation, valid order, requested restriction or dispute may suspend deletion only for the necessary data.
9. Security and protection by design
Under Articles 14 quinquies and following, we apply safeguards proportionate to the volume, nature, context and risk of processing. They include:
- encrypted communications, protected secret management and storage controls;
- authentication, roles, permissions, least privilege and logical separation between organizations;
- relevant event logging, monitoring, backups and recovery procedures;
- vulnerability, dependency, change and administrative access management;
- personnel and provider confidentiality, incident response and periodic risk review;
- impact assessments where processing may create a high risk.
No system is infallible. These safeguards are not a guarantee of absolute security or a certification that Cebric has not expressly obtained.
10. Data subject rights and procedure
From December 1, 2026, you may exercise free rights of access, rectification, erasure, objection, portability and restriction, and withdraw consent. Access includes source, purposes, categories, recipients, transfers, retention and, where relevant, meaningful information about automated decisions.
- Email privacidad@cebric.cl, identifying the right and the information involved.
- We may request proportionate information to verify identity or authority. We will not request more data than necessary.
- We will respond within 30 calendar days. For complex or numerous requests, we may extend once by up to 30 days and state the reason before the original period expires.
- A supported restriction request will be addressed within two business days while a prior rectification, erasure or objection request is decided, where the law provides.
- If Cebric is a processor, it will forward the request to the customer-controller and assist its response.
If the response is denied, incomplete or late, you may complain to the Personal Data Protection Agency under the statutory procedure, without prejudice to other remedies.
11. Artificial intelligence and automated decisions
Cebric uses AI to extract text and fields from documents, suggest classifications and assist content generation. Outputs may contain errors and must be reviewed by an authorized person before they are used for payments, employment decisions, signatures or any material effect.
By default, Cebric does not make decisions based solely on automated processing that produce legal effects or significantly affect a person. If a future feature does so, the data subject will have the Article 8 bis rights to object where applicable, request an explanation, express their view, obtain human intervention and request review.
Cebric does not use Customer Data to train its own general-purpose models and does not authorize its providers to use it for that secondary purpose. Content sent to an AI API is limited to the requested operation and governed by the processing agreement and applicable business terms.
13. Security incidents
Cebric records and assesses incidents. Where a breach creates a reasonable risk to individuals' rights, it will notify the Agency without undue delay under Article 14 sexies. It will directly notify data subjects when sensitive data, data about children under 14, or economic, financial, banking or commercial information is affected, and in any other legally required case.
Where possible, the communication will describe the nature, categories and approximate number of affected persons, consequences, measures taken and contact channel. As processor, Cebric will notify the customer-controller without undue delay and provide available information to support its duties.
14. Changes, contact and complaints
Versions are identified by number, publication date, effective date and hash in the legal manifest. A material change will be published and communicated through a reasonable channel before it takes effect. If it introduces a purpose requiring consent, consent will be requested again.
Cebric Ingeniería SpA
Chilean RUT: 78.490.233-1
Av. Los Jardines 932, Huechuraba, Metropolitan Region, Chile
Legal representative: Sebastián Richards Carmona
Privacy and rights: privacidad@cebric.cl
General support: contacto@cebric.cl
From December 1, 2026, you may also file a complaint with the Personal Data Protection Agency through its official channel once available.
