Privacy Policy

1. Who we are

Attos is an organizational administration platform operated by BDB Agencia de Marketing Digital (Cancún, Quintana Roo, Mexico). For any privacy matter you can write to info@bdbagency.com.

2. Data we collect

We collect the data your organization enters to operate the platform: name, email, phone, profile photo, job title, tasks, comments, work statistics, documents and attachments. Also minimal technical security data: IP address and browser on each login.

3. What we use it for

Only to provide the service: account authentication, work organization, notifications (in-app, email and browser push if you enable them) and account security. We do not sell or share your data with third parties for advertising.

4. Where it is stored

Data is stored with first-tier infrastructure providers: Supabase (database and files) and Vercel (application), over encrypted connections. Transactional emails are sent with Resend. Passwords are stored encrypted with modern standards; no one on the team can read them.

5. Data transfers

To provide the service, your data is processed by providers outside Mexico: the database and files are stored with Supabase in Canada; the application runs on Vercel and emails are sent with Resend, both in the United States. If your organization connects optional integrations (Zoho Books, Google Drive, HighLevel), the data used by that integration is shared with that provider under its own policies. All transfers happen only to provide the service, over encrypted connections.

6. Data from Meta platforms (Facebook, Messenger, Instagram, WhatsApp)

When a business using Attos connects a Facebook Page, an Instagram account or a WhatsApp Business number, Attos receives from Meta: the messages and attachments that people sending messages to that Page or account share; the platform-scoped identifier (PSID on Messenger, IGSID on Instagram); the public name and profile photo of the person writing; metadata of the connected Page or account; and, if the business also connects an ad account, that account's own ad metrics.

This data is used ONLY to display and respond to those conversations inside Attos, on behalf of the business that connected the Page or account — never for Attos's own advertising, and never sold to third parties.

The business using Attos is the data controller for the people who message it (it is the business that has the relationship with those people); Attos, through BDB, acts as a data processor: it processes that data only to provide the service to that business.

Messages and data from these conversations are kept until the business using Attos deletes them or cancels its account. Disconnecting a Page or account is a different thing: Attos stops receiving new messages from that connection and immediately deletes the stored credentials (access tokens) for it, but conversations already stored are NOT deleted just by disconnecting — the business decides when to delete them, or does so by canceling its account. Anyone can request deletion of their data at /en/data-deletion.

This processing complies with Meta's Platform Terms and Developer Policies.

7. Cookies

We only use essential cookies: your signed-in session and your active organization. We do not use advertising or third-party tracking cookies.

8. Your rights

You can request access, correction or deletion of your personal data at any time by writing to our contact email or through /en/data-deletion; we respond within a maximum of 20 business days, under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties. Your organization's administrator can revoke your access to its workspace from the platform; deletion of your personal data is handled through the contact email or by following the instructions on that page.

9. Changes to this policy

If this policy changes in a significant way, we will notify you inside the platform before the change takes effect.