Privacy Policy

Privacy Policy Details

At AIDeep Economics (hereinafter «AIDeep», «we» or «the company») we value your privacy. This Privacy Policy explains what personal data we collect through our website, forms, conversational assistant (chat and voice), API and associated products, for what purposes we process it, with whom we share it, and what rights you have as a data subject.

The processing of personal data is governed by Law No. 18,331 on the Protection of Personal Data and Habeas Data Action of the Oriental Republic of Uruguay and its implementing Decree No. 414/009, under the supervision of the Regulatory and Personal Data Control Unit (URCDP). For users located in the European Union, we also observe the principles of the General Data Protection Regulation (Regulation (EU) 2016/679, «GDPR»).

Spanish is the original and prevailing version of this policy. Any translation is provided solely to aid understanding. We recommend that you read this document carefully; by using our services, you accept the practices described herein.

1. Identity of the data controller

The data controller and owner of the database is AIDeep Economics, domiciled in Uruguay. You may contact us through the channels indicated at the end of this policy for any query relating to your personal data.

• Controller: AIDeep Economics.
• Address: Rambla del Peru 1043 Apt 402, Pocitos, Montevideo, Uruguay.
• Privacy contact: support@aideepeconomics.com.
• Supervisory authority: Regulatory and Personal Data Control Unit (URCDP), Uruguay. Users in the European Union may also contact the supervisory authority of their Member State.

2. Scope and definitions

This policy applies to the bilingual public website (Spanish and English), to the forms offered on it, to the conversational assistant (chat and voice), to the v1 API, and to the products and portals we link to or provide. Some products run on domains or portals operated by third parties or by associated services and may have their own privacy policies that complement this one.

• Personal data: any information of any kind concerning identified or identifiable natural or legal persons.
• Data subject: the person to whom the personal data being processed refers.
• Controller: AIDeep Economics, which decides on the purpose, content and use of the processing.
• Processor or subprocessor: the third party that processes personal data on behalf of and under the instructions of the controller (for example, providers of infrastructure, AI, payments or email).
• Sensitive data: personal data revealing racial or ethnic origin, political preferences, religious or moral beliefs, trade-union membership, or information concerning health or sexual life.

The portals of associated products (for example, AgroNews, AgroTrack360 and AgroClimaX) may require credentials that are provided directly to those services; in such cases, the processing is also governed by the terms of each portal.

3. What data we collect, by source

We collect only the data necessary for the purposes described in this policy. Most of it comes from data you voluntarily provide when completing a form, writing to us or using the assistant; the rest is generated automatically when you interact with the site.

3.1. Contact and commercial forms

• First and last name, email address, organization, institution or company, country and city, telephone, professional profile or role, and any free-text message you choose to include.
• This data is used to respond to your query and manage the commercial or pre-contractual relationship.

3.2. Private «My company» twin (AgroIntel)

• Name, email and company, together with a summary of your sales and cost structure entered in a free-text field (up to 1,200 characters).
• This summary constitutes confidential business information and receives restricted access and use, as detailed in section 5.

3.3. Bookings and scheduling

• In addition to your contact details, mobile number, subject or message, and the selected meeting type, person, date and time.
• When a booking is accepted, some of this data (name, institution, email, mobile and message) is added to the event description in Google Calendar to manage scheduling.

3.4. Career applications

• Full name, email, telephone, country and city, links to LinkedIn, GitHub or portfolio, availability, salary expectation, level of English, motivation and answers to specific questions.
• Curriculum vitae (CV) in PDF or DOCX format (up to 10 MB) and the mandatory consent to process your data for recruitment purposes.

3.5. News and alerts subscription

• Email address, first and last name, telephone, institution, institutional email and the channels through which you wish to receive communications.

3.6. Free API key and Pro plan checkout

• Email address, required to issue you an API key or to deliver the Pro plan key after payment approval.

3.7. Technical and attribution data (on all submissions)

• IP address, browser and device type (User-Agent), referring page (referrer), session identifier and page path or title.
• Marketing attribution parameters: source, medium, campaign, content and term (UTM), as well as advertising click identifiers (gclid, fbclid) and the last call to action.
• A structured copy of the submission (raw_payload) that retains the fields sent, for traceability and fraud-prevention purposes.

3.8. Conversational assistant (chat) and voice

• Chat: the content of the messages you write (free text) and trace metadata such as page, language, time zone, viewport and device type. We store the IP address in masked and hashed form when protection options are active; it may be retained in raw form if those options are disabled. A visitor cookie is used to provide conversation continuity.
• Voice: when you use the voice assistant, the audio from your microphone and its transcription are processed through Vapi and its real-time communications infrastructure (Daily.co), outside our backend.

3.9. AIDeep Account (customer accounts)

• If you create an AIDeep Account (self-service for platform and API customers): email address, name and, optionally, organization and country; password stored in encrypted form (scrypt derivation function) and email verification status.
• Technical account data: sessions (identified by a hash of the token, never the token in plain text), email verification and password reset tokens (hashed and time-limited), API keys linked to the account (stored as a SHA-256 hash plus an identifying prefix) and aggregated API usage per key, day and endpoint (without the content of your queries).
• If you purchase the Pro plan from your account: a record of the order and of the payment processed by Mercado Pago (payment identifier, amount, currency and payer email), for billing and audit purposes.
• From your account panel you can self-service exercise access (download of your data in JSON), rectification (profile editing) and erasure (account deletion), as described in section 11.

3.10. Internal staff accounts (Ops)

• Email, name and password stored in encrypted form (scrypt derivation function). These accounts are for internal and administrative use.

When a field is mandatory it is indicated on the form itself; if you do not provide the mandatory data, we may be unable to handle your request (for example, respond to a query or process an application). The remaining fields are optional.

4. Purposes and legal basis

We process your personal data for the purposes set out below. Under Uruguayan law, the general basis for processing is the data subject’s prior, informed and free consent; in certain cases, processing is also supported by the performance of a contract, pre-contractual measures, compliance with legal obligations, or legitimate interest, to the extent permitted by law.

• Handling queries and managing leads and bookings: based on your consent and the adoption of pre-contractual measures.
• Providing the products and the API: based on the performance of the contract or service relationship.
• Managing your AIDeep Account: (registration, authentication, provisioning and administration of API keys, usage metering and billing of the contracted plan) based on the performance of the contract you accept when creating the account.
• Sending subscribed communications and news: based on your consent, with the option to unsubscribe at any time.
• Processing job applications: based on your consent and the employer’s legitimate interest in managing recruitment.
• Security and prevention of abuse or fraud: (bot detection, rate limiting and security monitoring) based on the legitimate interest in protecting the service and its users.
• Analytics and site improvement: based on your consent, managed through the cookie banner.
• Billing and payment: based on the performance of the contract and compliance with legal and accounting obligations.

5. Sensitive and business data

We do not request special categories of data (health, racial or ethnic origin, ideology, religious beliefs, trade-union membership, sexual life or other sensitive data). However, you may voluntarily include information of this nature in free-text fields, such as the contact message, the chat or the content of your CV.

We recommend that you do not include sensitive data in free-text fields. In the case of the CV, its content is at your discretion; if you choose to include sensitive data, we understand that you consent to its processing for recruitment purposes.

The summary of sales and cost structure you enter in the private «My company» twin (AgroIntel) constitutes confidential business information. Its access and use are restricted and it is used solely to generate the analysis you request.

6. Artificial intelligence and language models

Some site features rely on artificial-intelligence models. Our sole language-model provider is Google, through its Gemini models (Generative Language API). We do not use models from Anthropic, OpenAI or other providers for these features.

6.1. What information is sent to Google (Gemini)

• The content of chat messages and queries to the assistant.
• Semantic search queries and questions to publications or to the observatory.
• The full text of the CV, when you apply for a position, in order to generate a summary and an indicative assessment.
• The content of releases and public texts that the system processes (for example, to generate summaries of sector news).

6.2. What information is not sent

• The structured economic-analysis module (AI Council) sends only structured scenario parameters, with no personal data.

6.3. Voice

• The audio and transcription of the voice assistant are processed through Vapi and Daily.co; their retention is governed by the terms of those providers.

6.4. Automated decisions

• Artificial intelligence is used as support. We do not make automated decisions with legal effects on individuals. In particular, in recruitment processes the AI-generated assessment is indicative and there is always human review.
• AI-generated results may contain inaccuracies. We recommend that you do not share sensitive personal data or confidential third-party information in the chat, since the content is transmitted to the model provider as you write it.

7. Cookies and local storage

We use cookies and browser local storage for the operation of the site, to remember your preferences and, subject to consent, for analytics purposes. You can manage your preferences through the cookie banner and your browser settings. The main categories are summarized below.

7.1. Essential (no consent required)

• AIDeep Account session (account_session): authentication of your customer account; duration of approximately 30 days.
• Administration session (ops_session): authentication of internal staff; duration of approximately 30 days.
• AgroNews portal session and CSRF (agronews_session, agronews_csrf): operation and security of the portal.
• Consent record (aideep_cookie_consent_v1, aideep_cookie_session_v1): retain your choice regarding cookies.
• Verification token (captcha): a stateless signed (HMAC) token to prevent automated submissions.

7.2. Functional and preference

• Theme and visual identity (aideep-theme, aideep-accent): remember light/dark mode and accent color.
• Widget state (aideep_chat_widget_state_v1): remembers whether the assistant is expanded.
• Chat visitor (aideep_chat_visitor): provides conversation continuity; its duration is approximately 365 days.
• Product states (for example, agronews_saved_v2, aideep-mytwin-profile) and Ops views: remember your selections within each tool.

7.3. Analytics (consent required)

• Analytics session and attribution (aideep_analytics_session_v1, aideep_analytics_attribution_v1, aideep_analytics_last_cta_v1): measure site usage and retain attribution parameters (UTM, gclid, fbclid).
• Google Analytics 4 (_ga, _ga_<id>): only when configured and active. It may currently not be active in production.

Consent management is handled by default through our own banner; optionally, the Cookiebot platform (CookieConsent cookie) may be used. The voice and chat assistant is conditioned on the corresponding consent category. When Google Analytics is active, Consent Mode v2 applies, with a default denied state and IP anonymization.

8. Third parties, processors and subprocessors

To provide the service we share certain data with providers acting as processors or subprocessors, only to the extent necessary and under confidentiality and security obligations. The main ones are:

• Google (Gemini): artificial-intelligence processing (chat messages, queries and CV).
• Vapi and Daily.co: audio processing and transcription of the voice assistant.
• Google Analytics and Google Tag Manager: site analytics (subject to consent).
• Google Fonts, jsDelivr, cdnjs (Cloudflare) and unpkg: content delivery networks (CDN) that receive the IP and browser when loading resources.
• Cookiebot (Cybot): consent-management platform (optional).
• Resend and SMTP (Gmail): transactional email and notification delivery.
• MercadoPago: processing of the Pro plan payment (receives the buyer’s email; we never see your card details).
• x402, Coinbase (CDP) and the Base blockchain network: pay-per-use API payments via cryptocurrency (wallet address and transaction hash, public on-chain).
• Supabase: authentication for the AgroTrack360 portal.
• AWS S3-compatible storage: site assets and encrypted backups.
• Railway: hosting, PostgreSQL database and associated services.
• Google Calendar: scheduling management for accepted bookings.
• ip-api.com: approximate geolocation from the IP address.
• IndexNow and the Google Measurement Protocol: indexing of public URLs and logging of aggregate events, with no identifiable personal data.

The AgroTrack360, AgroClimaX and AgroNews portals may receive credentials that you enter directly into them; this site does not store them. We do not sell your personal data to third parties.

9. International transfers

Some of the providers mentioned are located outside Uruguay (mainly in the United States and other jurisdictions). Consequently, to provide the service your data may be transferred and processed outside the country, by providers such as Google, MercadoPago, Vapi, Daily.co, Supabase, ip-api.com, the storage and hosting services and the code-control platforms.

These transfers are made under Law No. 18,331 (article 23), on the basis of the existence of adequate levels of protection, your consent, or appropriate contractual safeguards with each provider. For users in the European Union, where applicable, transfers rely on the mechanisms provided by the GDPR, such as standard contractual clauses.

In particular, AIDeep Account data is hosted on Railway infrastructure (United States / European Union, hosting and database) and transactional emails are sent through Resend (United States); both act as data processors, for as long as the service is provided, for storage, processing and communication-sending operations. With respect to the United States, we rely on those providers’ participation in the Data Privacy Framework (DPF) recognized by the URCDP (Resolution No. 63/023) or, failing that, on appropriate contractual safeguards. Payments are processed by Mercado Pago (with regional processing in Argentina, a country with an adequate level of protection).

10. Data retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected and, thereafter, for the periods required by applicable legal, accounting and security obligations, or for the possible defense of claims.

Some items have defined technical periods: sessions (for customer accounts and internal staff) expire after approximately 30 days, invitations after 7 days, the geolocation cache after 30 days, and backups are retained according to the applicable backup policy. Once the data is no longer necessary, we securely delete or anonymize it.

Your AIDeep Account data is retained while the account remains active. When you delete it from the panel, we revoke your API keys, close your sessions and immediately delete or anonymize your personal data; billing records are retained for the periods required by legal and accounting obligations.

11. Data subject rights

In accordance with Law No. 18,331, as a data subject you may exercise the following rights:

• Access: find out whether we process your data and obtain information about it (article 14).
• Rectification, update, inclusion and deletion: correct inaccurate data, complete it or request its deletion where applicable (article 15).
• Objection: object to the processing on legitimate grounds.
• Withdrawal of consent: revoke the consent granted at any time, without retroactive effect.
• Unsubscribe from communications: stop receiving news or commercial communications.

If you have an AIDeep Account, you can exercise several of these rights on a self-service basis from the «Profile and data» panel: download a copy of your data in JSON format (access), edit your profile (rectification and updating) and delete your account (erasure), which revokes your API keys, closes your sessions and immediately deletes or anonymizes your personal data.

To exercise these rights, write to support@aideepeconomics.com. We will respond within the periods established by Law No. 18,331 and its regulations. If you believe your rights have not been duly addressed, you may file a complaint with the Regulatory and Personal Data Control Unit (URCDP) of Uruguay.

For users in the European Union, the GDPR additionally recognizes the rights to portability, restriction of processing and objection, as well as the right to lodge a complaint with the supervisory authority of your Member State. The exercise of these rights may be subject to limits arising from legal obligations, the retention of backups and the security of the service.

12. Information security

We apply reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, alteration or improper disclosure. These include:

• Passwords stored with derivation functions (scrypt) and tokens and API keys stored with a hash function (SHA-256).
• Cookies with the HttpOnly attribute, a content security policy (CSP) and signed challenges (HMAC).
• Bot-detection mechanisms (honeypots), rate limiting and a security module aimed at mitigating abuse and prompt injection in the AI.
• Encrypted backups (AES-256) and masking or hashing of the IP address in the chat and in the consent record.

No security measure is infallible; therefore we cannot guarantee the absolute security of the information, although we work continuously to protect it.

13. Minors

Our services are aimed at professionals and companies in the agricultural sector and are not intended for minors. We do not knowingly collect personal data from minors.

For users in the European Union, we do not direct processing to minors under 16 years of age (or the lower age set by the relevant Member State). If we become aware that we have collected data from a minor without due authorization, we will take steps to delete it. If you are a parent or guardian and believe a minor has provided us with data, please contact us.

14. Analytics and advertising

We use first-party analytics sent to our own servers, subject to your consent. When you give your consent, we may retain advertising click identifiers (gclid, fbclid) to measure the effectiveness of our campaigns.

Google Analytics 4 is optional and may not currently be active. We do not use Meta pixels, Hotjar, Segment or similar advertising-profiling tools.

15. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, in the services or in applicable regulations. We will publish the current version on this page, with its update date. We recommend that you review it periodically. When changes are significant, we will endeavor to communicate them by reasonable means.

16. Contact