Verification and privacy

The agent handles your users’ data — and in a school, minors’ data. That is why identity verification for personal data, BAJA and the consent log are core rules of the system: they cannot be turned off.

Caution

Two switches in Settings → Operation change the first contact: public mode lets people talk to the agent without verifying (catalog, prices, orders, menu, files and escalation only; never personal data), and Skip privacy notice removes the first-contact notice — in that case no consent is recorded and your organization assumes the legal responsibility. Validate both with your legal advisor before turning them on.

Identity verification

No verification, no data. Before showing account status, attendance or any personal information, the agent confirms that the WhatsApp number belongs to a real user of your organization:

1. The system looks the number up among your users’ registered mobiles.

2. If it matches a single account, it is verified automatically and the method is recorded. (You can always require step 3 with the Always require OTP switch in Behavior.)

3. If it does not match, or matches several, the agent asks for the account’s email and sends a 6-digit code to that email (valid 10 minutes, 3 attempts max). With the right code, the number is verified.

4. If the email does not exist in your organization, the agent points them to the administration so they can register their details (for example, their mobile on their account) and write again.

Details that matter:

• Two guardians of the same student: each verifies with their own account and sees only their own information.
• Number change: the new number goes through verification; once confirmed, it replaces the previous one (which becomes inactive and stays recorded).
• AI plays no part: verification runs on fixed system rules, before the AI sees the message. Nobody can “talk” the agent into skipping this step.

Data protection (Law 1581)

• Notice on first contact: before processing any data, the agent sends your organization’s privacy notice. The text is editable in Behavior.

Caution

The default notice text is an operational baseline. Validate it with your legal advisor (data controller, purpose, privacy policy) before opening the agent to real users.

• BAJA, no questions asked: if a user writes BAJA, the agent confirms once and stops replying to them. Detection is a fixed rule (it does not go through the AI) and is recorded with a date. The confirmation also tells them they can request full deletion of their data by replying ELIMINAR. If the person writes again, they are offered to opt back in by replying SÍ — only then does processing resume.
• Tamper-proof consent log: notice sent, consent granted, BAJA, reactivation and deletions land in an append-only log — never edited, never deleted. It is your legal evidence.

Retention and deletion

• Message history is kept for the months you configure in Escalation (between 1 and 60; 12 by default).
• Once the period is over, messages and files are removed through an audited process: the deletion itself is recorded in the legal log (unlike a silent purge, it leaves a compliance trail).
• Deletion on request (habeas data): users can request deletion through the chat itself — by writing “borra mis datos” (delete my data), or replying ELIMINAR after opting out (it works even while opted out). Because it is irreversible, the agent requires a double confirmation. The administration can also run the deletion from the console (Deleting a contact’s data). Either way the contact’s data is purged, keeping only the legal record of the fact.

What data the agent sees

• Only data of the verified user who writes: their account status, their beneficiaries, their conversation history.
• Personal data lookups are read-only. What the agent registers (a payment receipt, an order, an appointment) is visible to your team: the receipt is created pending and a person approves it; the order stays awaiting confirmation.
• Your organization is isolated: one school’s agent cannot see another’s data, even by mistake (per-organization isolation is structural in Inspow).