Muginn
ES

Privacy and Personal Data Processing Policy

Last updated: October 29, 2026 · Effective since: October 16, 2026

This is an English translation provided for convenience. In case of any discrepancy, the Spanish version prevails, as Muginn is operated under Colombian law.

1. Who we are

Muginn is a conversational AI platform for businesses, operated by:

BLACOFI S.A.S. (hereinafter, “Muginn”, “we”) is the data controller for the personal data described in this policy, under Colombian Law 1581 of 2012, Decree 1377 of 2013 and any rules that complement or amend them.

2. Scope: who this policy applies to and our roles

Muginn provides services to businesses (our customers), which use our platform to deploy artificial intelligence agents that handle conversations with their own customers or users, mainly through WhatsApp. For that reason, we process personal data in two distinct roles:

a) As data controller, regarding data of our business customers and of the individuals who represent them or use the platform on their behalf (account registration, contact, billing, service usage).

b) As data processor, regarding data of end users: the people who chat with our customers’ agents. That data belongs to the business customer, which acts as controller; Muginn processes it on behalf of and under the instructions of that business. If you are an end user and wish to exercise rights over your conversations, you may contact us and/or reach out directly to the business you chatted with.

3. Personal data we process

From business customers and their representatives (as controller):

From end users (as processor, on behalf of the customer):

4. Purposes and authorization of processing

We process personal data to:

  1. Provide the contracted service: operating AI conversational agents that handle, answer and follow up on conversations.
  2. Manage the business context configured by the customer (products, tone, service rules).
  3. Generate metrics, reports and insights derived from conversations for the customer itself.
  4. Manage the business relationship: support, billing, service communications.
  5. Comply with legal, accounting and regulatory obligations.
  6. Improve the quality, security and stability of the platform.

Authorization for processing is obtained when you create an account, contract the service, accept this policy, or provide your data through our contact channels. For end users, obtaining any required authorization is the responsibility of the business customer, as controller of that data.

We do not sell personal data to third parties. We do not use the content of end users’ conversations for our own or third-party advertising purposes.

5. Processing with artificial intelligence

Muginn uses artificial intelligence models from specialized providers (such as Anthropic or OpenAI), acting as sub-processors, to generate the agents’ automated replies. Conversation content is processed with these providers exclusively to provide the service. We do not use end users’ conversations to train our own AI models, and we contract with providers whose enterprise terms of service exclude the use of this data to train their models.

6. WhatsApp and Meta

The service runs on Meta’s WhatsApp Business Platform (Cloud API). This means messages and their metadata are transmitted and processed through the infrastructure of Meta Platforms, Inc. and its affiliates, under their own terms and policies, which we recommend reviewing:

Muginn acts as an authorized technology provider for the management of its customers’ WhatsApp Business accounts, subject to the customer’s express authorization during onboarding (Embedded Signup).

7. Google user data (Google Calendar)

If you connect a Google account to Muginn so that your business’s WhatsApp assistant can book appointments in your calendar, or if you accept a business’s invitation to connect your calendar, Muginn accesses data from that account through Google APIs. We request only the permissions this feature needs, and you approve them on Google’s consent screen.

What data we read:

How we use it: only to show availability, to book, move or cancel the appointments that the business’s customers request through its WhatsApp assistant, and to let the business see those appointments in its dashboard. We do not use this data for any other purpose.

Who we share it with:

How we store it: OAuth tokens are stored encrypted in a secrets vault (Supabase Vault), never in plain text, and are used only by Muginn’ server. They never reach the browser. We also store the account’s email address, the permissions granted, the chosen calendars and a record of the appointments Muginn created (event ID, date and time), protected by the security measures in section 12.

What we never do with your Google data:

Limited Use disclosure: Muginn's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion:

How to revoke access:

8. Processors, sub-processors and third-party providers

To provide the service we rely on providers that process data on our behalf, including: cloud infrastructure providers (such as Amazon Web Services and Supabase), Meta Platforms (WhatsApp messaging), AI model providers (such as Anthropic or OpenAI) and email/productivity tools (Google Workspace). We select all of them under criteria that include contractual guarantees and adequate security standards.

9. International data transfers

Our providers may store and process data on servers located outside Colombia (mainly in the United States). These international transfers and transmissions are made to providers that offer adequate protection standards and contractual guarantees in accordance with applicable Colombian regulations.

10. Data subjects’ rights (habeas data)

Under Law 1581 of 2012 and Decree 1377 of 2013, every data subject has the right to:

How to exercise them: write to soporte@muginn.com stating your name, the right you wish to exercise and contact details for our reply. We will answer inquiries within a maximum of ten (10) business days and complaints within a maximum of fifteen (15) business days, as required by law.

If you believe we have not handled your request adequately, you may contact the Superintendence of Industry and Commerce (SIC), Colombia’s data protection authority: www.sic.gov.co

Note for end users: if your request concerns conversations held with a business customer’s agent, we will handle it in coordination with that business, which is the controller of that data, or we will guide you to submit it directly to them.

11. Data deletion

You may request the deletion of your personal data at any time:

  1. Business customers: request deletion of your account and its data by writing to soporte@muginn.com from your registered email address, with the subject “Data deletion”. We will delete the account data, its configuration and the associated conversations within thirty (30) days of verifying the request, except for data we must retain due to legal obligations (for example, billing information).
  2. End users: you may request deletion of your conversations by writing to soporte@muginn.com or directly to the business you chatted with. We will manage the deletion in coordination with that business within the same timeframe.

This section constitutes the data deletion instructions required by Meta Platforms for applications operating on its technologies.

Frozen flows and users follow the period in section 13.

12. Information security

We apply reasonable technical, administrative and organizational measures to protect personal data, including: encryption of data in transit, role-based access control, hardened authentication on critical systems, per-customer data isolation (multi-tenant architecture) and activity logging. No system is infallible; in the event of a security incident affecting personal data, we will manage and notify it in accordance with applicable regulations.

13. Data retention

We retain personal data for as long as a contractual relationship with the customer exists and for the periods required by Colombian legal, accounting and tax rules. End users’ conversations are retained according to the configuration and instructions of the responsible business customer. Once these periods expire, data is securely deleted or anonymized.

Resources frozen on downgrade. When a customer moves to a plan with fewer flows or users, or removes add-ons, they choose which stay active. The rest are frozen: kept for up to 2 years from the day they freeze, read-only, without processing WhatsApp messages and, for users, without panel access. We notify 30 and 7 days before deletion. After that period they are permanently deleted along with their conversations and records, and we keep only a record with the name of the deleted flow or user, the dates it was frozen and deleted, and how many conversations and records were deleted. The customer may delete them earlier at any time.

Closed accounts, or accounts that requested erasure, follow the account-closure process.

14. Cookies and website analytics

This website may use cookies and analytics tools (such as Google Analytics) to measure site usage in aggregate. You can configure your browser to reject cookies; the site will keep working.

15. Minors

The platform is intended for businesses and adults. We do not knowingly collect data from anyone under 18. If you become aware that a minor has provided us personal data, write to us so we can delete it.

16. Changes to this policy

We may update this policy to reflect regulatory or service changes. We will publish the current version on this page, indicating the date of the last update. Substantial changes will be communicated to customers through their registered contact channels.

17. Contact

For any questions about this policy or the processing of your data: