Privacy.

Who is responsible

Batuta is a service of Matías Giménez, an individual, Chilean tax ID (RUT) 16.141.847-1, domiciled at Luis Thayer Ojeda 1455, apt. 202, Providencia, Santiago Metropolitan Region, Chile. For anything about data or these terms: hola@usebatuta.com.

Two different roles

On usebatuta.com and for the accounts of people who use the app, Batuta decides why and how data is processed: it is the controller.

The team data a customer loads into the app (its workers, contracts, shifts and attendance) belongs to the customer. There the customer, as employer, is the controller and Batuta is the processor: it processes that data only on the customer's behalf, on its instructions and to provide the service, as the Terms of service set out. If you work at a restaurant that uses Batuta, your employer answers for your data, and we help it handle whatever you ask.

What data we process

Depending on how you relate to Batuta:

• Site visits: pages viewed and approximate country, anonymously and without cookies.
• Contact form: name, business, email, phone if you include it, and your message.
• App accounts: name, email, role, which restaurants you can access, the technical records of your session, and usage events (which screens and actions are used), tied to an internal account identifier rather than to your name or email.
• Data a customer loads: for each worker, name, RUT, email, contract type, salary or hourly rate, availability, absences with their reason (for example vacation or sick leave, never diagnoses), requests, planned and published shifts and, if the customer connects its attendance system, clock-in and clock-out records. For the restaurant, its configuration and, if it connects its sales system, sales by day and service.

What we use it for

• Providing the service: building, checking and publishing the schedule, and sending each person their shifts.
• Keeping it secure, giving support and fixing errors.
• Understanding how the product is used, with those usage events, to improve it.
• Answering whoever writes to us through the form.

The basis is the contract with the customer to provide the service, our legitimate interest in security and in improving the product, and your consent when you write to us. We do not sell data or use it for advertising, and we make no automated decisions about people with it: Batuta proposes schedules, and a person at the customer decides and publishes them.

Who we share it with

We use providers that process data on our behalf, only for what we ask of them:

• Supabase: database and authentication, with servers in São Paulo, Brazil.
• Vercel: hosts the web app, which runs in São Paulo, Brazil.
• Modal: computes schedules, in the United States.
• Resend: sends the app's emails, from the United States.
• PostHog: cookieless analytics, hosted in the European Union.

When a customer connects an integration (for example GeoVictoria, Talana, Buk or Toteat), the data it needs goes to that system by the customer's decision and only for that integration. If we add or change a provider, we update this list.

Transfers outside Chile

Data is stored in Brazil, and some providers process it in the United States or the European Union. We choose providers with contractual security and confidentiality commitments and give them only what their part of the service needs.

How long we keep it

A customer's data is kept while its account is active. If it leaves Batuta, it can download all its data for 30 days, and we then delete it within the following 90 days, except what the law requires us to keep. Automatic backups are replaced in short cycles. Contact-form data is kept while it is useful to answer you, and we delete it when you ask.

Cookies

This site uses no cookies or persistent identifiers in your browser. The app uses only the cookies it needs to work: your session, the restaurant you have selected and how you prefer to view the schedule. None is used for advertising or to follow you across other sites.

Security

Connections are encrypted, each person sees only the restaurants they have access to (the database enforces it, not just the screen), passwords are stored hashed by our authentication provider, and internal access is limited to whoever needs it to provide the service. If an incident affects your data, we notify those affected and the authority without delay, as required.

Your rights

You can ask to access your data, have it corrected or deleted, object to a use of it, have it blocked while a request is resolved, and receive it in a format you can take to another service. Write to hola@usebatuta.com; we answer within 30 calendar days at most. If your employer loaded your data, the request goes to them, and we help them answer it. If you are not satisfied, you can complain to the competent data protection authority. We process data under Chile's Law 19,628 on the protection of private life, as amended by Law 21,719.

Minors

Batuta is a work tool for businesses and is not aimed at minors.

Changes

If this policy changes, we update this page and its date. If the change is significant, we email customers before it takes effect.