Privacy Policy

1. Data controller

The controller of your personal data is Dinnger, a software studio that develops the applications Root, Boty and Tester. You can contact us at any time by writing to [email protected].

This privacy policy applies to the website dinnger.com and to all Dinnger applications that reference it, including Root (onroot.dev), Boty (boty.dinnger.com) and Tester (tester.dinnger.com).

2. Data we collect

We only collect the data necessary to provide our services and respond to your requests. Specifically, we process the following categories of data:

• Contact data you provide voluntarily (name, email address, company) when you write to us or request a consultation.
• Account data when you sign up for our applications: name, email address, profile picture and unique user identifier.
• Application usage data when you use the platform: companies, connected runtimes and agents, governance policies, settings, assigned roles and permissions, and activity and access logs.
• In Boty, the messages that your business's customers send through the channels you connect, together with the products, orders and contacts generated while serving them.
• Content you enter into the application, such as instructions, messages and files you send to AI agents for processing.
• Technical browsing data collected in aggregate: IP address, device type, operating system, browser, date and time of access, and pages visited.

3. Sign in with Google and use of your Google account data

Our applications let you sign in with your Google account. If you choose this option, access is performed using Google's OAuth 2.0 protocol: we never see or store your Google password.

When you authorize access, Google shares with us only the basic profile information shown on the consent screen: your name, email address, profile picture and the unique identifier of your Google account.

We use this data exclusively to create and identify your account in our application, to authenticate you at each sign-in, to display your name and picture in the interface, and to communicate with you about the service.

We do not request sensitive or restricted permissions over your Google data: we do not access your Gmail, your Google Drive, your contacts, your calendar or any other private data in your account.

Dinnger's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. In particular: we do not sell this data, we do not use it for advertising, we do not transfer it to third parties except when necessary to provide the service or when required by law, and we do not allow humans to read it except with your express consent, for security purposes, to comply with the law, or when the data is aggregated and anonymized.

The data we receive from Google APIs is not used to develop, improve or train non-personalized artificial intelligence or machine learning models, either generally or for other users.

We keep the data from your Google account only while your Dinnger account remains active. You can ask us to delete it at any time by writing to [email protected], and it is also deleted when you revoke access from your Google account permissions page. Upon receiving your request, we delete that data from our production systems and, within a reasonable period, from our backups.

You can revoke Dinnger's access to your Google account at any time from the permissions page of your account, at https://myaccount.google.com/permissions.

4. Purpose and legal basis

We process your data for the following purposes: responding to your inquiries, creating and managing your account, providing and improving the service, ensuring the security of the platform and preventing fraud or abuse, and complying with our legal obligations.

The legal bases are the performance of the contract between us when you use the service, your consent when you provide data voluntarily or accept analytics cookies, our legitimate interest in operating and protecting the platform, and compliance with legal obligations.

We do not use your personal data for advertising, we do not sell it, and we do not share it with third parties for commercial purposes.

5. Artificial intelligence and content processing

Root does not forward your prompts to any model: it governs the agent CLIs (such as Claude Code, Codex or OpenCode) that run on your own computer. Your conversations with those agents are governed by the terms of each CLI's provider. Root stores session, OAuth and invitation tokens only as SHA-256 hashes, passwords with Argon2id, and allows you to sign in with Google.

Boty serves the chat channels that the business connects (WhatsApp, Instagram, Facebook, Telegram and TikTok). It processes the messages it receives from the business's customers in order to reply to them, show them the catalog and record their orders. The business that uses Boty is responsible for the data of its contacts and for having a legitimate basis to process it; Dinnger processes it on the business's behalf and only to provide the service.

We do not use the content of your conversations or your files to train our own or third-party artificial intelligence models. In particular, data obtained from Google APIs is not used to train non-personalized AI/ML models.

When you connect external MCP servers, the data you decide to send to them is additionally governed by the privacy policies of those services, over which Dinnger has no control.

6. Retention

We keep your data for as long as a contractual or commercial relationship with you exists and, afterwards, for the periods required by law to address possible liabilities.

Technical and access logs are kept for a maximum of twelve months for security and diagnostic purposes. When data is no longer needed, we delete or anonymize it securely.

7. Who we share data with

We do not sell your data or share it with third parties for advertising purposes. We only share it in the following cases:

• Infrastructure and service providers that help us operate the platform (hosting, databases, content delivery network, transactional email and AI model providers), always subject to confidentiality and data processing agreements.
• Public authorities, when there is a legal obligation or a valid court order.
• In the context of a corporate transaction, such as a merger or acquisition, with prior notice to you.

8. International transfers

Some of our providers may be located outside your country of residence. In those cases we ensure the transfer is covered by appropriate safeguards, such as standard contractual clauses or other mechanisms recognized by applicable regulations.

9. Your rights and data deletion

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to [email protected]. We will respond to your request within thirty days at most.

If you want to delete your account and all associated data, including information obtained when signing in with Google, write to us at [email protected] indicating the email address you registered with. We will delete your data from our production systems and, within a reasonable period, from our backups.

You also have the right to lodge a complaint with the competent data protection authority if you believe we have not properly handled your request.

10. Security

We apply technical and organizational measures to protect your data: encryption in transit using TLS, encryption of credentials at rest, role and permission-based access control, action auditing, periodic backups and continuous review of security best practices across the platform.

No system is completely infallible; if we detected a security breach affecting your personal data, we would notify you and report it to the competent authority as required by regulation.

11. Minors

Our services are intended for adults, and we do not knowingly collect data from children under sixteen. If we discover that we have received data from a minor without the corresponding authorization, we will delete it immediately.

12. Cookies

We use strictly necessary cookies for the operation of the site and for maintaining your session and, with your consent, analytics cookies to understand in aggregate how the site is used. We do not use advertising or profiling cookies.

You can manage or delete cookies at any time from your browser settings.

13. Changes to this policy

We may update this privacy policy to reflect legal changes or changes to our services. We will always publish the current version on this page with its update date and, if the changes are substantial, we will notify you by email.