Welcome to Tutti. We are committed to protecting your personal information and being transparent about our services. This document includes our Privacy Policy, which explains how we collect, use, disclose and safeguard your information when you visit our websites soytutti.com and usetutti.io, as well as our Terms of Service governing the use of our platform, including important information about billing, trial periods, automatic payments and refund policies.

By using our services, you accept both our Privacy Policy and the Terms of Service described in this document.

Data Controller

The controller of your personal data is:

• Entity: Orbit Software LLC
• Location: United States
• Trading name: Tutti
• Websites: soytutti.com, usetutti.io
• Privacy contact: hola@soytutti.com

Important: As a company based in the United States providing services to users in the European Union, we comply with the General Data Protection Regulation (GDPR) to guarantee the protection of your personal data.

Roles under data-protection law

Under the GDPR (EU) and equivalent regulations, Orbit Software LLC (operating as Tutti) may act in two different roles depending on the specific data flow:

1. Data controller

Tutti acts as a data controller with respect to:

• The account information of the self-employed professional who owns the account (name, email, phone, payment details, business configuration).
• Conversations that take place through Tutti's shared number (+34 631 02 19 89) when a professional has not yet activated Coexistence.
• Usage data of the Tutti service itself (metrics, operational telemetry).

2. Data processor

When a professional activates the Coexistence feature and connects their own WhatsApp Business number to Tutti, the messages they exchange with their own end customers are handled under a different role: Tutti is the processor and the professional is the controller. In practice:

• The professional decides which end customers are enabled, which messages are sent on their behalf, and when to delete the data associated with a contact.
• Tutti processes those messages solely to provide the service (drafting replies, generating quotes and invoices, reminders) and never for its own purposes beyond the service.
• The professional is responsible for informing their own customers that they use an automated assistant (Tutti) and of the applicable legal basis. Tutti offers this Privacy Notice as support, but the direct relationship with the end customer belongs to the professional.

If a professional asks to exercise an end customer's GDPR rights over data processed under Coexistence, we will redirect the request to the professional where appropriate and cooperate so the customer can exercise their rights in time.

Professionals who need a formal Data Processing Agreement (DPA) can request one at hola@soytutti.com.

Information We Collect

We collect personal information you provide voluntarily, such as your name and email address when you subscribe to our newsletter or contact us.

We also collect information automatically when you browse the site. This may include:

• Log and usage data: IP address, browser type, operating system, pages visited, access dates and times.
• Cookies and tracking technologies: We use cookies and similar technologies to track activity on our site and hold certain information.

How We Use Your Information and Legal Basis

We use the collected information for various purposes. For each purpose, we indicate the legal basis under the GDPR:

Providing the Service

• Purpose: Provide and maintain our service, process payments, manage your account
• Legal basis: Performance of a contract (Art. 6.1.b GDPR)

Service Communications

• Purpose: Notify you about changes to our service, provide customer support
• Legal basis: Performance of a contract (Art. 6.1.b GDPR) and legitimate interest (Art. 6.1.f GDPR)

Service Improvement

• Purpose: Collect analytics to improve our service, monitor usage, detect and prevent technical issues
• Legal basis: Legitimate interest (Art. 6.1.f GDPR) — our legitimate interest in improving and maintaining the quality of the service

Marketing and Promotional Communications

• Purpose: Sending newsletters, promotional offers, marketing content
• Legal basis: Consent (Art. 6.1.a GDPR) — you can withdraw your consent at any time

Legal Compliance

• Purpose: Comply with legal, tax and regulatory obligations
• Legal basis: Legal obligation (Art. 6.1.c GDPR)

Monitoring of Conversations with the Virtual Assistant

As part of our commitment to continuously improving the service, we want to inform you transparently about how conversations with our WhatsApp virtual assistant are handled:

• Restricted access: Conversations with our bot may only be reviewed by Tutti's executive management and authorized staff specifically designated for this function.
• Exclusive purpose: Access to these conversations happens exclusively to improve the user experience, optimize the virtual assistant's responses, and guarantee the quality of the service provided.
• Absolute confidentiality: We commit that these conversations will never be shared with third parties, sold, or used for commercial purposes other than improving our service.
• Review limits: It is important to clarify that we will never access, review or store the specific content of your quotes, invoices, customer data, or any sensitive business information you handle through our platform. We only monitor direct interactions with the bot for service-improvement purposes.
• Security measures: All reviewed conversations are subject to strict confidentiality and data-protection measures, treated with the same level of security we apply to all our users' personal information.
• Right to object: If you prefer that your conversations not be reviewed for these purposes, you can contact us at any time at hola@soytutti.com to exercise this right.

This practice lets us maintain and continuously improve the quality of our virtual assistant, ensuring responses become ever more accurate and useful for all our users, always respecting your privacy and confidentiality.

Third-Party Services and Tracking

We use third-party services to monitor and analyze the use of our website, as well as for advertising purposes.

• Google Analytics: We use Google Analytics to track and report website traffic. Google uses the collected data to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualize and personalize ads on its own advertising network. You can opt out of making your activity on the Service available to Google Analytics by installing the Google Analytics opt-out browser add-on. For more information on Google's privacy practices, visit the Google Privacy & Terms page: https://policies.google.com/privacy

• Meta Pixel: We use Meta Pixel to measure the effectiveness of our advertising by understanding the actions you take on our website. This helps us show ads to people who may be interested in our products/services on Meta's platforms. For more information on how Meta handles your data, visit Meta's Data Policy: https://www.facebook.com/policy.php

• Microsoft Clarity: We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first- and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement: https://privacy.microsoft.com/privacystatement.

  By using our site, you agree that we and Microsoft may collect and use this data.

Sub-processors that handle your data

To provide the service, Orbit Software LLC relies on professional providers acting as data sub-processors. We only share with each of them the data strictly necessary for the function they perform. None of them sell or rent your data for advertising purposes.

Sub-processor	Purpose	Data processed	Region	Policy
Meta Platforms Ireland Ltd. (WhatsApp Business Platform)	Sending and receiving WhatsApp messages between Tutti, Tutti's professional customers and their contacts.	Phone number, message content, delivery metadata.	Ireland / EEA	WhatsApp Business Solution Terms
OpenAI, L.L.C.	Language-model processing to generate the assistant's responses. Data sent to OpenAI is not used to train models (Tutti uses the API tier with retention disabled).	The user's message content and the minimal business context needed to produce the response.	United States	openai.com/privacy
Hetzner Online GmbH	Hosting of the servers where Tutti's services run (database, API, Redis cache).	All data stored at rest on Tutti's infrastructure.	Germany / Finland (EU)	hetzner.com/privacy
Stripe Payments Europe, Ltd.	Payment and subscription management. Does not receive conversation content or the professional's end-customer data.	Name, email, payment details of the professional who owns the Tutti account.	Ireland / EEA	stripe.com/privacy
Cloudflare, Inc.	CDN proxy and DNS resolution for Tutti's domains (including each professional's subdomains).	IP addresses of web visitors (not of the WhatsApp flow).	Global (with EEA presence)	cloudflare.com/privacy

We keep this list up to date. If we add or replace a relevant sub-processor, we will reflect it here with reasonable notice. If you would like the full list of Data Processing Agreements (DPAs) we have signed with each one, contact us at hola@soytutti.com.

Use of WhatsApp as a communication channel

Tutti operates on the WhatsApp Business Platform provided by Meta Platforms Ireland Ltd. By using Tutti as a communication channel with your business, both the professionals who own Tutti accounts and their end contacts implicitly accept Meta's WhatsApp Business Solution Terms, which govern the use of the platform.

When a professional activates the Coexistence feature (Tutti operates on their own WhatsApp number), that relationship is additionally governed by the following Meta terms, applicable to the business customer using the platform:

• WhatsApp Business Messaging Policy
• WhatsApp Commerce Policy (if your business sells products)

Tutti commits to fulfilling its part of the Business Solution Terms and, in particular, to not using the platform to send unsolicited messages, content prohibited by Meta, or communications outside the 24-hour window without an approved template.

Security of Your Data

The security of your data is important to us, but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.

Your Rights under the GDPR

If you are a resident of the European Union, you have the following rights regarding your personal data:

• Right of access: You can request information about which personal data we process about you and obtain a copy of it.
• Right to rectification: You can request the correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): You can request the deletion of your personal data in certain circumstances.
• Right to restriction of processing: You can request that we limit the processing of your personal data in certain situations.
• Right to data portability: You can request to receive your personal data in a structured, commonly used format, or that we transfer it to another controller.
• Right to object: You can object to the processing of your personal data in certain circumstances, including direct marketing.
• Rights related to automated decision-making: You have the right not to be subject to decisions based solely on automated processing.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.

How to exercise your rights:

• Send your request by email to hola@soytutti.com
• Include enough information to verify your identity
• Clearly specify which right you wish to exercise
• We will respond to your request within a maximum of 1 month

Right to lodge a complaint: If you consider that the processing of your personal data does not comply with data-protection regulations, you can lodge a complaint with the supervisory authority of your country of residence (for example, the Data Protection Commission in Ireland, dataprotection.ie, or the ICO in the United Kingdom, ico.org.uk).

International Data Transfers

Since Orbit Software LLC is based in the United States, your personal data may be transferred to and processed in the United States, a country that does not have an adequacy decision from the European Commission.

Safeguards in place:

• Technical and organizational measures: We implement appropriate security measures to protect your data during transfer and processing.
• Access limitation: Only authorized personnel have access to personal data, and only when necessary to provide the service.
• Compliance commitment: We commit to complying with GDPR principles regardless of where processing takes place.
• Service providers: The third-party services we use (Google, Meta, Microsoft) have their own safeguards for international transfers.

If you have any specific questions about data transfers or the safeguards in place, you can contact us at hola@soytutti.com.

Data Retention

We retain your personal data for the time necessary to fulfil the purposes for which it was collected, according to the following criteria:

• Account and service data: While you maintain an active account with us, and up to 3 years after account closure to resolve potential disputes or claims.
• Billing and payment data: We retain this data for the time required by applicable tax and accounting obligations (generally 6-10 years depending on the legislation).
• Conversations with the virtual assistant: Conversations are kept for a maximum of 2 years for service-improvement purposes, unless you request their deletion earlier.
• Marketing data: Until you withdraw your consent or for a maximum of 3 years from the last interaction, whichever comes first.
• Web analytics data: Aggregated and anonymized data is kept for a maximum of 26 months (standard Google Analytics).
• Technical log data: Kept for a maximum of 12 months for security and technical troubleshooting purposes.

Once these periods have elapsed, we will securely delete your personal data, unless there is a legal obligation requiring its retention for a longer period.

You can request the deletion of your data at any time by exercising your right to erasure, subject to applicable legal exceptions.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

Contact Us

If you have any questions about this Privacy Policy, contact us:

• By email: hola@soytutti.com