Privacy notice

Last updated: November 3, 2026 (version 8).

CONSULTORA Y COMERCIALIZADORA VIAL, S.A.S. de C.V. ("Chultún", "we"), with its registered address at Calle 4 368-A Interior x 7 y 9, Mérida, Yucatán, ZIP 97130, Mexico, is the data controller for the personal data described in this notice. Chultún is the brand under which we offer automated customer service on Messenger, Instagram and WhatsApp, a panel where each business manages its assistant, its channels and its appointment book, and automation for Odoo.

This notice applies to www.chultun.com, to the Chultún panel (app.chultun.com), to the "Chultún" application registered with Meta and to the services we provide to the businesses that use them. For any question or request about your data, write to us at hola@chultun.com.

On behalf of the businesses that use Chultún. When a business connects its channels to Chultún, the messages, contacts, appointments and opportunities of its customers are processed on behalf of that business and following its instructions, solely to provide the service. Where they are stored depends on how the business works: if it connected its Odoo, they are recorded in its Odoo; if not, they are stored encrypted in Chultún. In both cases the business is the controller of that data. If you wrote to a business that uses Chultún, your relationship is with that business; you can address your requests to it or to us, and we handle them together with the business.

For our own purposes. We process the data of the people who create an account in Chultún and of the businesses they manage, of those who write to us or join the waiting list, and of the visitors to the site.

• Contact and identification data: name, email address, phone number, company and job title.
• Your Chultún account data: the name and email that the provider you sign in with (Google or Facebook) gives us, or the email you type when you sign in with a code; the identifier that provider assigns to you; the businesses you belong to and your role in each one (owner or salesperson). If the owner of a business invites you, the email the invitation was sent to. We do not store passwords: we do not use them.
• Your account activity log: when you sign in and out, which business you choose, which sections of the panel you open (only the section's name, never its content) and the invitations you send, revoke or accept; with the IP address and browser you did it from.
• Business data: its name, the identifiers of its Pages and accounts on Messenger, Instagram and WhatsApp, the phone number or email it designates so that its customers can talk to a person, the information it uploads so that its assistant can answer and, if it connects its Odoo, the access credentials it gives us for that purpose.
• Your Google Calendar data, if you connect it: the email of the Google account you connect, the permission Google grants us and, from your primary calendar, only which time slots are busy. Never the content of your events (section 11).
• Messages and content: the messages, comments and images people send to a business through the connected channels, and those you send to us.
• Usage and technical data: IP address, browser type, pages visited, date and time, and the technical logs needed to operate the service.

We do not request sensitive personal data (ethnic origin, health, beliefs, sexual orientation, among others). We ask you not to send it through the service's channels.

• Providing the service: receiving the messages that reach a business, answering them with an automated assistant, recording the contact and the conversation — in the business's Odoo if it connected it, or in Chultún — and notifying its team.
• Recognizing you when you sign in and keeping your session: checking that it is you, with your Google or Facebook account or with a six-digit code we email you that lasts 10 minutes, and keeping your panel session open.
• Managing your business and your team: registering your business, connecting and disconnecting its channels, and showing the owners of a business who has access to it, with what role and when they last used it; sending and revoking invitations, and removing a person from a business. Removing someone from a business does not change their other businesses.
• Syncing your appointment book with Google Calendar, if you connect it: not offering your customers the times you already have busy in Google, writing the appointments confirmed in Chultún to your calendar, and proposing to you the changes someone makes in Google to those appointments.
• Managing our relationship with businesses: support, billing and communications about the service.
• Handling requests: replying to whoever writes to us and managing requests about personal data.
• Protecting the service and complying with the law: detecting and stopping abuse (such as someone trying to guess codes or flood another person's inbox with emails), asking you to confirm who you are again before sensitive changes to your account, preventing misuse of the channels and responding to requests from authorities.
• Secondary purpose: telling you about Chultún news if you joined the waiting list or created an account. You can ask us to stop at any time by writing to hola@chultun.com.

On the connected channels, an automated assistant answers, and it says so in its first message. It answers with the information the business uploaded to Chultún and, if the business connected its Odoo, with its catalog. If you want to talk to a person, you can do so through the business's own contact channels; businesses that serve customers on WhatsApp also designate a phone number or an email for that, and in those that work with Odoo their team steps into the same conversation. Each business's assistant answers a number of messages per month according to its plan; when it reaches it, it tells you so and tells you how to contact the business.

To write the replies we use an artificial intelligence service from Anthropic, and to transcribe voice notes one from Google; both are contracted on paid terms, and the terms of both state that they do not use the messages or the replies to train their models.

We do not sell personal data. We share it only with:

• The business you are talking to, which sees your messages in its Chultún panel and, if it connected it, in its Odoo.
• Providers that supply us with messaging, hosting, computing, database, email and artificial intelligence services: Meta Platforms, Odoo S.A., Anthropic, Google, Vercel and Supabase. They process the data on our behalf, under their contracts, and some operate from the United States. Google and Meta are also the providers you can sign in to the panel with: they know you signed in to Chultún, but they do not receive your messages or those of any business's customers. The panel's emails (codes, invitations and notices) are sent from avisos@chultun.com.
• Google, if you connect your Google Calendar, receives the confirmed appointments we write to your calendar, with the text you chose when connecting (section 11). What we read from Google is not shared with anyone.
• The owners of a business, who see the name, email, role and last time each person on their team used the business, and the emails of pending invitations.
• Authorities, when required by law.

For as long as the business uses the service and your account is active. Data stored in a business's Odoo is kept by the business, which decides about it. Conversations that a business stores in Chultún are kept for 30 days from the last message of each conversation; after that they are closed and deleted. When a business cancels, we delete its registration, its conversations and the information it uploaded within the following 30 days. Billing data, for as long as tax law requires.

You can access your data, rectify it, cancel it or object to its processing (ARCO rights), as well as revoke your consent or limit the use of your data, by writing to hola@chultun.com with your name, the email of your account or the business you talked to, and what you are requesting. We acknowledge receipt within 2 business days and reply within a maximum of 10 business days. If your data is in a business's Odoo, we handle the request together with the business. The procedure for deletion, including that of your account and your sign-in methods, is in Data deletion. If you're not satisfied with our response, you can turn to the competent personal data protection authority.

On the site we use the technical cookies needed for it to work (language and session); Google Analytics, from Google, to measure how many people visit each page and where they come from; the Meta Pixel, from Meta, to measure the results of our advertising on Facebook and Instagram and build audiences to show it to, which, unlike the previous ones, is an advertising cookie; and Microsoft Clarity, from Microsoft, to understand how the site is used and improve it. Each provider sets its own cookies and processes that data according to its policy. You can block them from your browser or with the opt-out add-ons for Google Analytics and Meta ads, without the site ceasing to work.

In the panel we use three technical cookies, from Chultún only: your session cookie, the one that recognizes your browser and one that lasts a few minutes while you return from signing in with Google or Facebook. They are not third-party cookies and are not used for advertising or to measure your visit.

We apply administrative, technical and physical measures to protect personal data against loss, alteration and unauthorized access or use, including encryption of credentials, of the conversations stored in Chultún and of the contact details each business designates, and access control per business. No system is infallible: if a security breach occurred that significantly affected your rights, we would inform you without delay.

We use the data we receive from Meta solely to provide the service described in this notice and in accordance with the Meta Platform Terms. If you sign in to Chultún with Facebook, we receive the identifier that Facebook assigns to your account for our application, your name and your email, and we use them only to recognize you. If you remove the application from your Facebook account, you can request the deletion of your data as described in Data deletion.

If a business uses Chultún's appointment book, each person on its team can connect their own Google Calendar from the panel ("Connect your calendar"). They do so with their Google account, on Google's permission screen, where the application presents itself as "Chultún Agenda" and asks to see the account's email and to view, create, edit and delete events on the calendars that person owns (the calendar.events.owned scope). We request no other permission.

• What we read: from their primary calendar, only whether each time slot is busy or free, within the days the business uses to give appointments. We do not read or store the title, description, attendees or location of any event: we do not even request them from Google.
• What we write: to that same calendar, the appointments confirmed in Chultún, with the text the business owner chose when connecting: the service and the customer's first name, or just the word "Appointment". Never the appointment's note or the customer's contact details, and we never send Google invitations or emails to anyone.
• What happens with changes made in Google: if someone moves or deletes in Google an appointment written by Chultún, the change is not applied on its own: the team sees it as a proposal and decides whether to accept it or to put the appointment back as it was.
• What we store: the permission Google grants us and the email of the connected account, both encrypted, and the busy time slots, which are refreshed every 15 minutes. Nobody at Chultún reads them: the system uses them so as not to offer those times, and the business's team only sees that the slot is busy.
• What for, and for nothing else: so that the assistant and the team do not offer times that are already busy in Google, and so that confirmed appointments appear in the person's calendar. We do not use that data for advertising, we do not sell it or share it with anyone else, and we do not use it to train artificial intelligence models.
• How to disconnect and delete: from the panel, with "Disconnect", or by removing "Chultún Agenda" on the connections page of your Google account (myaccount.google.com/connections). When you disconnect, we delete the busy time slots we had copied, remove from your calendar the appointments Chultún wrote and ask Google to revoke the permission. If you remove access from Google, we stop reading and writing immediately and delete what we copied. The email of the connected account is deleted with the person or with the business, or earlier if you ask as described in Data deletion.

Chultún's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The service is aimed at businesses and at people over 18. We do not knowingly collect data from minors.

We will publish any change on this page with its update date. If the change is significant, we will notify registered people and businesses by email.

hola@chultun.com · Full identity and address in the Legal notice.