Dobletilde
ES EN
Request a demo

Privacy Policy

Last updated:

This Privacy Policy explains how Code54 S.A. ("Code54", "we", "us"), the operator of the Dobletilde service, collects, uses, shares, and protects information in connection with providing Dobletilde. By using the service, you agree to the practices described in this document.

1. Who we are

Dobletilde is a software-as-a-service (SaaS) product that acts as a unified order inbox: it lets businesses ("Clients") receive and process purchase orders that their own customers or resellers send them over WhatsApp and email, and turn those messages into structured orders that integrate with the Client's systems.

The controller for the data Code54 processes to administer Dobletilde is CODE54 S.A., Argentine tax ID (CUIT) 30-71091460-1, with its registered address at Ortiz de Ocampo 3302, Ciudad Autónoma de Buenos Aires, Argentina. You can contact us at contact@dobletilde.com.

We operate as a Tech Provider on Meta's WhatsApp Business Platform. We provide the service to businesses; we do not offer Dobletilde to individual consumers.

2. Scope and roles

The messages, orders, catalogues and other information that a Client uploads or receives through Dobletilde ("Customer Data") remain the Client's. This does not limit any person's rights in their personal data.

For Customer Data —including message content from people who contact a Client— Code54 acts as a data processor on behalf of and under the documented instructions of that Client, which is the controller in relation to those people. Code54 acts as a data controller for operator-account data, Client business-account data, and data we process to operate and protect Dobletilde.

For data for which we are controller, we process it to enter into and perform our relationship with the Client, comply with legal obligations, and protect the service and its users. Where law requires consent, we obtain it in advance, expressly and on an informed basis. For Customer Data, we do not determine independent purposes and process it only under the contract and the Client's instructions.

3. Information we collect

We collect and process the following categories of information:

  • WhatsApp messages and their content. Messages people send to our Clients' WhatsApp Business numbers: text, images, voice notes, documents (e.g. PDFs), and other attachments.
  • Sender data. The WhatsApp phone number and WhatsApp profile name of the person messaging the Client.
  • Messaging metadata. Message identifiers, timestamps, and delivery statuses (sent, delivered, read, failed).
  • Email data. When a Client receives orders by email, the content and metadata of those emails.
  • Derived orders. The structured information extracted from messages (products, quantities, notes) to build each order.
  • Client business account data. WhatsApp Business Account (WABA) and phone-number identifiers, access tokens (stored encrypted), and business-profile data, obtained during onboarding.
  • Operator account data. The name and email address of the Client's staff who use the dashboard, obtained when they sign in with Google or Microsoft, plus session data.
  • Technical and log data. IP addresses, timestamps, and activity and error logs needed to operate and secure the service.

We obtain business-account and operator data from the Client, Operators, and sign-in providers. We obtain messaging data from Meta, email accounts connected by the Client, and people who contact that Client. Information necessary to create or maintain an account, authenticate Operators, or connect the stated channels is required for those functions; if it is not provided, we may be unable to provide or maintain the applicable service.

4. How we use the information

  • Provide the order inbox and show conversations to the Client's authorized operators.
  • Transcribe voice notes, interpret images, and structure message content into orders.
  • Deliver orders to the systems the Client configures (e.g. a webhook or a spreadsheet).
  • Send replies and notifications over WhatsApp on the Client's behalf.
  • Authenticate operators and control access.
  • Operate, maintain, secure, and improve the service, and comply with legal obligations.

We do not sell personal information, use it for advertising, or share it with third parties for their own advertising.

When we improve the service using Customer Data, we use aggregated or anonymized information that does not reasonably identify a person or Client. We do not use message content, attachments, or orders to create our own commercial profiles or train our own models.

5. Automated processing and artificial intelligence

We may use artificial-intelligence providers, including OpenAI, Anthropic, and Google (Gemini), depending on the service configuration. Message content (text, voice notes, and images) is sent to the applicable AI provider solely to extract order data from text, transcribe voice notes, and interpret images. These results feed the order inbox.

We do not authorize those providers to use Customer Data for advertising or to train their general-purpose models. We select enterprise or API configurations and terms that provide for that restriction. If a feature requires materially different terms of use, we will notify the Client before enabling it.

AI produces assistive results that the Client must review before using them on a final basis. Code54 does not make solely automated decisions that produce legal or similarly significant effects on individuals.

Dobletilde is not designed to receive sensitive data or children's data. A Client must not send it unless it is strictly necessary, has a valid legal basis, and has given us documented instructions and appropriate safeguards.

6. How we share information — sub-processors

We share information only with the providers needed to deliver the service, who process it on our behalf and under confidentiality and data-protection obligations:

  • Meta Platforms, Inc. — the WhatsApp Business Platform, through which messages are sent and received.
  • AI providers, including OpenAI, Anthropic, and Google (Gemini), when configured — order extraction from text, voice-note transcription, and image interpretation.
  • DigitalOcean — hosting infrastructure and media file storage.
  • Google — operator sign-in and, when the Client enables it, delivery of orders to Google Drive.
  • Microsoft — operator sign-in, when the Client uses that option.

We may also disclose information where required by law or to protect the rights, safety, or integrity of the service.

A Client may also instruct us to deliver orders to destinations it configures, such as its ERP, webhook, spreadsheet, or Google Drive. Those destinations are selected and controlled by the Client; the Client is responsible for giving notice to individuals and ensuring that downstream receipt complies with applicable law.

The current list of subprocessors, their function, and the mechanism for receiving change notices are set out in the Data Processing Addendum. We will give Clients at least 30 days' prior notice before adding a subprocessor that represents a material change, unless an urgent security need or legal requirement requires a shorter period.

7. Data retention

We retain Customer Data for the duration of the service and according to the Client's instructions or configured retention settings. After the service ends, the Client has 30 days to request an export. Once that period ends, we delete or anonymize Customer Data from active systems within the following 30 days, unless a legal obligation, Client instruction, or documented dispute requires longer retention.

Backups are deleted or overwritten in the ordinary backup cycle, which does not exceed 90 days after deletion from active systems. We revoke WhatsApp access tokens when they are disconnected or the account is closed. We retain billing data for the period required by applicable law and security logs for up to 12 months, unless longer retention is needed to investigate an incident or meet a legal obligation.

8. Security

We apply technical and organizational measures to protect information: encryption in transit (HTTPS), encryption at rest for sensitive credentials (such as WhatsApp access tokens), strict data isolation between Clients (multi-tenancy with row-level security), and per-operator access control. No system is completely secure, but we work to protect your information in a reasonable manner.

9. International transfers

Some providers may process data outside Argentina, including in the United States or the European Union. Before an international transfer, we apply the contractual, organizational, and technical safeguards appropriate to applicable law and the parties' roles. Where the GDPR or an equivalent law applies, the Data Processing Addendum governs the transfers and, where appropriate, the parties will execute the applicable standard contractual clauses.

10. Your rights

If you are an Operator, Client representative, or person whose data we process as controller, you may request access to, correction, updating, or deletion of your personal data, and object to certain processing, by writing to contact@dobletilde.com. State your name, the right you want to exercise, and a way to identify the relevant Dobletilde account or relationship. We may request reasonable information to verify your identity and log the request.

If you are a person who contacted a business using Dobletilde, that business is normally the controller of your data and should receive your request. Code54 will assist it as processor under the Data Processing Addendum. If you send us the request in error, we will forward it to the Client where possible and tell you how to proceed.

We process personal data in accordance with Argentina's Personal Data Protection Law No. 25,326 and its implementing regulations. We respond to access requests within 10 calendar days, and to requests for correction, updating or deletion within 5 business days of receiving them. Data subjects have the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown, as provided in Article 14(3) of Law No. 25,326. The Agencia de Acceso a la Información Pública (Argentina's Agency for Access to Public Information), as the supervisory authority under Law No. 25,326, is empowered to handle complaints and claims from anyone whose rights are affected by a breach of the applicable personal data protection rules.

11. Children's privacy

Dobletilde is a service for businesses and is not directed to minors. We do not knowingly collect data from children.

12. Compliance with Meta / WhatsApp policies

We use the WhatsApp Business Platform in accordance with the WhatsApp Business Terms and Meta's platform policies. Information obtained through the WhatsApp Business Platform is used solely to provide the Dobletilde service to our Clients; it is not sold or used for advertising.

13. Changes to this policy

We may update this Privacy Policy. We will post the current version on this page with its update date. If a change is material, we will notify Clients by email at least 30 days in advance, unless a legal or security requirement requires a more immediate change. Continued use of the service after the effective date means acceptance of the new version.

14. Contact

CODE54 S.A., Argentine tax ID (CUIT) 30-71091460-1, Ortiz de Ocampo 3302, Ciudad Autónoma de Buenos Aires, Argentina — website: code54.com. Privacy and data inquiries: contact@dobletilde.com.