Privacy Policy

This Privacy Policy clearly explains what personal data we process, what we use it for, on what legal basis, with whom we share it, for how long we keep it, and what rights you have over it. It applies to the Santos por Chat service (also «Santos x Chat»), accessible at santosporchat.cl and via WhatsApp. The service operates from Chile and processes your data in accordance with Ley N° 21.719 on the Protection of Personal Data and other applicable regulations. It forms part of our Terms and Conditions.

1. Who is responsible for your data

The data controller is Canal C SpA, RUT 76.396.888-K, a company incorporated in Chile, operator of the Santos por Chat service.

• Registered address: Badajoz 100, Las Condes, Región Metropolitana, Chile (CP 7560908).
• Privacy contact / Data Protection Officer (DPO): dpo@santosporchat.cl
• General contact: contact@santosporchat.cl

2. Who and what this applies to

This policy applies to all persons who register for or use Santos por Chat (web and WhatsApp). It does not apply to linked third-party sites or services, which are governed by their own policies.

3. Transparency about artificial intelligence

The responses from the «saints» are generated by artificial intelligence (third-party language models; as of the date of this version, DeepSeek through the OpenRouter router, and Google for audio transcription — the current detail is in section 7). You are not talking to a real person, a priest, or the historical figure of the saint. The service is spiritual, reflective, and entertainment in nature, and does not replace professional medical, psychological, psychiatric, legal, or financial guidance. If you are experiencing a crisis or emergency, contact a professional or call emergency services (Emergencies: 131 · Salud Responde: 600 360 7777 · suicide prevention line: *4141; more detail in the Terms, section 5).

4. What data we process

We process only the data necessary to provide you with the service:

• Account and profile data: name, email address, password (stored hashed and encrypted, never in plain text), preferred language and, when you provide them, basic profile details.
• WhatsApp number in international format (E.164), as the identifier for the conversation channel.
• Content of your conversations with the saints: the text messages you write and the generated responses. These are stored encrypted.
• Voice messages: if you send an audio message, it is transcribed to text so we can respond to you. The original audio file is kept only temporarily and is deleted automatically; we only keep the text transcription.
• Conversation memory: summaries and context data that the system stores to remember what you have talked about and give continuity to your conversations with each saint.
• Subscription and payment data (that we see): subscription status, plan, currency, billing dates, transaction identifiers, and the last 4 digits and brand of the payment method. We do not store your full card number or security code (these are managed by Polar, see section 10).
• Technical and security data: IP address, browser/device identifier, WhatsApp message identifiers, and access and audit logs (without the content of your conversations).

5. Sensitive personal data and consent

The content of your spiritual conversations may reveal your religious or philosophical beliefs, and possibly information about your health or your private life if you choose to share it. These are sensitive personal data under Ley 21.719 and receive a heightened level of protection. We process this content solely on the basis of your express consent, which you give when registering by ticking a box that is not pre-checked and whose text expressly states that you authorise the processing of this sensitive data and its processing by artificial intelligence outside Chile. Before ticking it you can consult the "What you are accepting" summary, these Terms and this Policy. You may withdraw your consent at any time by writing to the DPO; withdrawal does not affect the lawfulness of prior processing and will result in the termination of the service. We recommend that you do not share sensitive data that you do not wish to have processed by an artificial intelligence system.

6. What we use your data for and on what legal basis

We do not use your data for advertising, we do not sell it, and we do not build commercial profiles with it.

7. Processing through artificial intelligence

To transcribe your voice notes, find the relevant passages in the saint's writings and draft the reply, the content of your messages leaves our servers and is processed by third-party artificial intelligence services located outside Chile. Each exchange sends the text of your message, up to the last 20 messages of the ongoing conversation, the memory summary described in section 4 and, if you send a voice note, the complete audio file. In addition, once a day the batch of that day's conversations is sent to the same provider in order to generate that memory summary. We do not send your email address, your phone number or your account identifiers along with the content: they are replaced by a pseudonymous code, which reduces the risk but does not make the transmission anonymous. The content itself may, however, include any personal data you have written into the conversation, for example your first name.
That content does not reach a model directly. It passes through a language-model router — as of the date of this version, OpenRouter, Inc. (United States) — which receives it in the clear and forwards it to the inference provider that runs the model. As of the date of this version that provider is DeepSeek (People's Republic of China) for drafting the replies and generating the memory summary, and Google for transcribing your voice notes, indexing your queries and answering when the main provider is unavailable. The router does not publish the country in which each model is run, so in Google's case we cannot confirm the exact location of the servers.
If the assigned provider is unavailable or is excluded by our filters, our system re-sends that particular request with no provider restriction, and the router delivers it to any of the providers in its network that serve that model; some are in the United States and others in the People's Republic of China. For audio transcription and query indexing we do not apply a provider restriction at any point. That set of possible recipients is listed in section 9.
What we can guarantee: we do not train any model with your conversations, we do not sell them, we do not use them for advertising, and our team does not read them, unless you ask us for help with a problem, it is strictly necessary in order to investigate abuse, or the law requires it.
What we cannot guarantee: we do not control what these providers do with the content once they receive it. The provider that currently drafts the replies states that it processes and stores data in the People's Republic of China and that it uses the content it receives to train and improve its own technology, without stating a retention period. According to the information published by the router, the provider that transcribes your voice notes and indexes your queries may retain the content it receives for up to 55 days. The router states that it does not use the content to train its own models, but warns that it neither controls nor is responsible for the use made of it by the inference providers, and it automatically samples a small number of messages in order to classify them anonymously, which is a purpose of its own. These providers' terms also allow them to retain and review content in order to detect abuse, comply with the law or handle billing: none of them undertakes in writing that there will be no human review on their side.
That is why this processing takes place solely with your express consent (section 5), why you may withdraw it at any time, and why we recommend that you do not share information you would not want leaving Chile under these conditions. We keep the list in sections 8 and 9 up to date: if we change our artificial intelligence provider, add a new one, or the country where your content is processed changes, we will publish a new version of this Policy with its date and number, and we will notify you by a reasonable means before the change affects you.
Finally, we do not make automated decisions with legal effects on you based solely on this processing; decisions about account suspension or payment rejection are communicated with their grounds, and you may request a review by writing to the DPO.

8. Who we share your data with (data processors)

We work with providers that process data on our behalf and under our instructions (data processors), and with others that, for their own purposes, act as independent controllers. Each one receives only the data necessary for its function. As of the date of this version they are the following:

Some of these providers in turn rely on <b>sub-processors</b>: this is the case of the language-model router, which delivers the content to the provider that runs the model. We identify them individually in the table above and in section 7, because where sensitive data is involved describing them by category is not enough. We may also disclose data where the law requires it (request from a competent authority) or to protect rights, security and compliance with our terms. If you want to know which providers your content has been communicated to, write to the DPO and we will give you the list of recipients and the detail recorded in our technical logs.

9. International transfers

All of the service providers process data outside Chile. As of today the Chilean authority has not declared any country to offer an adequate level of protection, nor has it approved standard contractual clauses, so these transfers are made on the basis of your express consent (section 5) and of the service agreements we accept with each provider, which on their own do not constitute an adequate safeguard within the meaning of the law. We state this precisely so that you can decide on an informed basis. Below is where your data is processed:

You can request more information about these transfers, or withdraw your consent, by writing to the DPO. Please note that the service cannot operate without these transfers, so withdrawing consent means the service ends.

10. Payments

Payments are processed by Polar (Polar Software, Inc., a company incorporated in the State of Delaware, United States, with its address at 3500 South DuPont Highway, Dover, DE 19901, United States), which acts as the Merchant of Record for subscriptions and is registered in various jurisdictions for the management and remittance of taxes. Polar manages billing, invoicing, taxes, and your card data under payment security standards (PCI-DSS); to process your card data, Polar uses Stripe, Inc. as a sub-processor. Canal C SpA does not store or have access to your full credit card details. With respect to your payment method data, Polar acts as an independent controller and processes it in accordance with its own privacy policy (polar.sh/legal/privacy); Canal C SpA is responsible for your other data (account, conversations, and subscription). You may manage or cancel your subscription from Polar's customer portal.

11. Cookies and similar technologies

We use strictly necessary cookies so that the site works and to keep you securely logged in (authentication). Polar's payment process may use its own cookies necessary to process the transaction and prevent fraud (more information at polar.sh/legal/privacy). We do not use advertising cookies and do not sell your browsing information. You can block cookies from your browser, but in that case you may not be able to log in or use the service.

12. How long we keep your data

13. How we protect your data

The content of your conversations and other sensitive data is stored encrypted (AES-256-GCM). We apply encryption in transit (TLS), access control, strengthened authentication (two-factor) for administrators, data segregation between users, and security logs without personal data. No system is 100% infallible, but we adopt technical and organizational measures that are reasonable and proportionate to the risk in order to protect your information.

14. Your rights

Under Ley 21.719, you have the right to:

• Access: know what data we hold about you and obtain a copy.
• Rectification: correct inaccurate or outdated data.
• Cancellation / erasure: have us delete your data (right to be forgotten), except for data we must retain by law.
• Objection: object to certain processing and withdraw your consent at any time.
• Portability: receive your data in a structured, commonly used format, or have it transferred to another controller when technically possible.
• Blocking: temporarily suspend the processing of your data.

To exercise any of these rights, write to dpo@santosporchat.cl. We will verify your identity and respond within the legal deadlines. Exercising these rights is free of charge. These rights are non-waivable under Ley N° 21.719: no clause in this Policy limits or excludes them. If you are not satisfied with our response, you may file a complaint with the Agencia de Protección de Datos Personales de Chile.

15. Minors

Santos por Chat is intended exclusively for persons over 18 years of age. We do not knowingly collect data from minors. If we detect that an account belongs to a minor, we will delete it.

16. Security breach notification

If a security breach occurs that affects your personal data and poses a risk to your rights, we will notify the competent authority without undue delay and, when required by law (particularly in the case of sensitive data), we will also notify you.

17. Changes to this policy

We may update this Policy. When there are material changes, we will publish the new version here (with its version number and date) and, where applicable, ask for your consent again.

18. Contact and supervisory authority

Privacy / DPO: dpo@santosporchat.cl
General contact: contact@santosporchat.cl
Supervisory authority: Agencia de Protección de Datos Personales de Chile.