Privacy policy

1. Who the controller is

The data controller is SendFlow SpA, domiciled in Santiago, Chile. For any personal data matter, the channel is cumplimiento@sendflow.cl.

2. The legal framework we follow

• Law N°19.628 on the protection of private life — the law currently in force.
• Law N°21.719, which regulates the protection and processing of personal data and creates Chile's Personal Data Protection Agency. It was published on 13 December 2024 and comes into force on 1 December 2026. This policy is already written to its standard, and wherever the new law is stricter than the one in force, we adopt the stricter requirement from now.
• Law N°19.913, which requires entities in the financial system to retain their clients' records for at least five years.
• Law N°21.521 (the Fintech Act), the framework under which SendFlow develops its activity.

3. What this site does not do

Before saying what we process, here's what doesn't exist on this site:

• It uses no cookies, neither first-party nor third-party.
• It has no analytics, tracking pixels or advertising. No third party receives data about your browsing.
• It does not record your IP address: it's used only in server memory to limit requests per minute, and it isn't written to any log or database.
• It does not sell or transfer personal data for commercial purposes. To anyone, ever.

4. The data processed today

The quote tool works with amounts and currencies, without any data that identifies you.

If you enter a company RUT (Chilean tax ID) during verification, that RUT is sent from our server to the public tax-standing lookup service of the Servicio de Impuestos Internos (SII, Chile's tax authority), to fill in the legal name and line of business. It isn't recorded in our logs and isn't shared with any other third party.

The verification process at /registro runs in your browser: the data you type lives in the page's memory and the file is generated and downloaded locally. On confirmation, the application is sent to our servers, and the documents you attach are uploaded to a private store — both only when the persistence service is enabled; if it isn't, nothing is stored and the files don't leave your device. If you reload the page, what you typed is lost — we don't use localStorage or cookies to retain it.

5. The data we process to provide the service

To intermediate payment orders, we process:

• Identification and contact data: name or legal name, RUT, email, phone, address and line of business. The email enables account access; if you list team members for additional logins, their name and email too.
• Corporate structure data: legal representative and beneficial owners (people holding 10% or more of the capital), as required by regulation from the Unidad de Análisis Financiero (UAF, Chile's financial intelligence unit).
• Supporting documents: e-RUT, incorporation deed, certificate of good standing, ID cards and powers of attorney.
• The client risk assessment, the result of the background checks and the confirmed declarations with their cryptographic fingerprint.
• Data about the transactions instructed: amounts, currencies and destination.

There are three lawful bases: your consent — a checkbox you accept expressly, never pre-ticked —, performance of the service you instruct us to carry out, and compliance with legal obligations, in particular Law N°19.913 and UAF regulation.

Retention: client and transaction records are kept for the legal period of five years. It's an obligation under Law N°19.913, so during that period a deletion request cannot reach those records; data protection law yields to the legal retention obligation, and we tell you here rather than letting you find out later.

6. Who it's shared with

• Servicio de Impuestos Internos: the tax-standing lookup described in section 4, against its public service.
• Supabase, Inc., as data processor: it hosts the database and the documents, encrypted at rest (AES-256), with access closed by default. The project's hosting region will be declared in this policy when the service is activated.
• Competent authorities — UAF, CMF, SII and the courts — when a legal obligation requires it, including the reporting of suspicious transactions.

There are no other third parties. With no analytics, no advertising and no data brokers, the list above is complete.

7. Your rights and how to exercise them

Today, under Law N°19.628, you have the right to access your data, rectify it, cancel it and object to its processing. From 1 December 2026, Law N°21.719 expressly adds erasure, objection, portability and blocking, plus the right to complain to the Personal Data Protection Agency.

To exercise any of them: write to cumplimiento@sendflow.cl stating your name, your RUT and the right you're invoking. We respond within a maximum of 30 calendar days — the new law's standard, adopted from now.

Exercising these rights is free. If you're not satisfied with the response, you can go to the courts, and once Law N°21.719 is in force, to the Personal Data Protection Agency.

8. Security

• All traffic is encrypted (HTTPS, with HSTS).
• The database is encrypted at rest and its access is closed by default: no public credential can read or write a row.
• The IP addresses and browser identifiers required by the audit log are stored only as salted hashes: they cannot be reversed to the original address.
• Files are validated by their actual content, not by their extension, and live in a private store accessible only through short-lived signed URLs.

9. Minors

SendFlow is a service for companies and people over 18. We do not deliberately process minors' data.

10. Changes to this policy

If the processing changes — new purposes, new processors, new categories of data —, this policy is updated before the change takes effect, with its date and version visible at the top. The version in force is always the one published on this page.