Privacy Policy
Last updated: November 8, 2026
AIORA is a platform for managing tourist accommodation, operated by Martinez Cabrera Miranda, located at Av. Italia 6201 (LATU), Montevideo, Uruguay ("AIORA", "we"). This policy explains what personal data AIORA processes, why and for how long, including the data it receives from the WhatsApp Business Platform and from Instagram through Meta.
1. Roles
Accommodation businesses (hotels, complexes, owners) subscribe to AIORA and use it to talk to their guests. For guests' data, the business is the controller and AIORA processes it on the business's behalf and under its instructions. For the data of the people who use AIORA within a business (users), AIORA is the controller.
2. Data we process
| Data | Source | Purpose |
|---|---|---|
| Guest's WhatsApp phone number and profile name | Meta (WhatsApp), when the guest messages the business | Show the conversation and reply; link it to the guest and booking if the business already had them on file |
| Guest's Instagram ID (specific to our app), name and username | Meta (Instagram), when the guest messages the business | Show the conversation and reply |
| Message content (text and the caption of photos or documents), type, date and time, and an error code if sending failed | Meta (incoming messages) and the business (messages sent from AIORA) | Show the conversation history. AIORA does not store photos, audio or documents; it only records that they arrived |
| The business's Meta account data: WhatsApp Business Account, phone number and business IDs; display name; the number's quality rating and messaging limit; Instagram account ID and username | Meta, when the business connects its account | Send and receive messages on the business's behalf and show it the status of the connection |
| Meta access token and the phone number's two-step verification PIN | Meta and AIORA, when the account is connected | Operate the connected account. Stored encrypted and never shown in the application |
| Guest and booking data (name, contact details, ID document, country, dates, amounts) | The business, or the Airbnb and Booking.com calendars it connects | Manage bookings, the calendar, tasks and payments received |
| User data (name, email, phone, role, hashed password) | The user or the business's administrator | Give access to AIORA and send email invitations |
AIORA does not import previous WhatsApp or Instagram chat history: it only stores messages received or sent while the account is connected.
3. Legal basis
We process data to provide the service the business subscribed to (performance of a contract) and, for guests, because they start the conversation with the business on WhatsApp or Instagram. We process it in accordance with Uruguay's Personal Data Protection Law No. 18,331 and its regulatory Decree 414/009.
4. Who can see it
- Within each business, conversations are visible to users with the conversations permission (administrators and supervisors by default; the administrator can change it). Each business only sees its own data.
- AIORA staff, only when needed to provide support or maintain the service.
5. Who we share it with
We do not sell personal data or use it for advertising. We only share it with:
- Meta Platforms (WhatsApp and Instagram): to send and receive the business's messages.
- Amazon Web Services: hosts AIORA's database, application and files, and sends emails (Amazon SES). Pricing suggestions use an AI model on AWS (Amazon Bedrock) that receives booking and occupancy data, without names, phone numbers or messages.
- Authorities, when required by law or court order.
Data may be hosted outside the business's country, on AWS servers in the United States (us-east-2 region, Ohio).
6. How long we keep it
- Conversations and messages: while the business has an AIORA account. If it disconnects WhatsApp or Instagram, the history is kept read-only until the business asks for its deletion or closes its account.
- Access token: deleted when the account is disconnected. Account IDs and the PIN are kept so the account can be reconnected, and because the PIN stays active on the number; they are deleted with a data deletion request.
- Technical logs: they do not include message content or phone numbers. Kept for 30 days.
- Backups: the database has automatic backups that are kept for 7 days.
7. Security
Connections use HTTPS. The database is encrypted at rest, and access tokens and PINs are additionally stored encrypted. Notifications from Meta are only accepted with a valid signature. Access within each business depends on each user's role and permissions.
8. Your rights
You can request access to, correction, update or deletion of your data, and object to its processing, under Uruguay's Personal Data Protection Law No. 18,331. If you are not satisfied with the answer, you can file a complaint with Uruguay's data protection authority (Unidad Reguladora y de Control de Datos Personales, URCDP). If you are a guest of a business, you can also ask the business directly, as it is the controller of your data. How to request deletion: data deletion instructions.
9. Contact
Martinez Cabrera Miranda — Av. Italia 6201 (LATU), Montevideo, Uruguay
Email: contacto@aiora.dev
10. Changes
If we change this policy, we update the date above and notify businesses by email or within AIORA.