This policy explains what personal data Exacto processes, why, how it is protected, who it is shared with and how you can exercise your rights. It applies to the website getexacto.ai and the application app.getexacto.ai (together, “Exacto” or “the Service”). The Spanish version at /privacidad has the same content.
1. Who is responsible
Exacto is developed and operated by typebold, based in Chile (“typebold”, “we”). typebold is the controller of your account data and of the data Exacto obtains from Google when you connect your mailbox.
For the financial and third-party information your company uploads or connects to Exacto (bank movements, invoices, contacts), your company is the controller and typebold acts as a processor, following its instructions and only to provide the Service.
Privacy contact: daniel@typebold.com.
2. What data we process
Account data
- Name, email address and sign-in data of each user.
- Your organization, the companies you manage (legal name and RUT, the Chilean tax ID) and your team members and their roles.
Financial data you upload
- Bank statements: accounts, dates, amounts, descriptions and balances of movements.
- Classifications made by you or your team: categories, contacts (name and RUT of customers and suppliers), payment methods, notes and splits of movements into transactions.
- Files you attach, such as invoices or receipts.
Gmail data
Only if you connect your Gmail account. Described in detail in section 3.
Technical data
- Security and operational logs: IP address, browser type, date and time of access, errors and relevant actions (for example, who deleted or restored a record).
This public website does not use analytics or advertising tools.
3. Google user data (Gmail)
Connecting Gmail is optional. A user turns it on from their organization's settings and can disconnect it at any time.
3.1 What Google data we access
Exacto requests a single Gmail scope: https://www.googleapis.com/auth/gmail.readonly (read-only). With it, Exacto cannot send, delete, move, label or modify your email.
Although the technical scope is read access, Exacto only searches for and processes messages that look like invoices or transfer receipts, namely:
- messages with XML or PDF attachments (for example, the XML of an electronic tax document issued through Chile's SII), and
- messages whose subject or body reads like a transfer receipt, such as “comprobante”, “transferencia”, “te han transferido” or “has recibido una transferencia”.
The first read covers the last 60 days; later reads only cover new messages. From each message that matches those criteria, Exacto extracts:
- document type and folio (invoice number);
- RUT and name of the issuer, recipient or counterparty;
- amounts (net, VAT and total, as applicable);
- issue or transfer dates;
- bank and operation number, when they appear on the receipt;
- minimal message data to locate it and avoid duplicates: message ID, sender, subject and date;
- the attachment (XML or PDF) that backs the document.
Exacto does not store the rest of your inbox. Messages that do not match the criteria are not stored.
3.2 Why we use it
We use Gmail data exclusively for one user-facing feature: finding the supporting document for your bank movements. Exacto compares each invoice or receipt with your movements (amount, date and counterparty RUT), suggests which one matches and proposes its classification (category, contact and payment method). You decide whether to accept the suggestion.
We do not use Gmail data for advertising, profiling, creditworthiness assessment or any purpose other than this feature.
3.3 How we store it
- Access token: the refresh token issued by Google is stored encrypted at rest with AES-256-GCM. The encryption key is managed separately from the database.
- Extracted data: stored in Exacto's database, isolated per organization with row-level security: only members of your organization can see it.
- Attachments: XML and PDF files are stored in a private storage bucket with no public access, and are only served to authorized users of your organization.
3.4 Who we share it with
We do not sell Google data or use it for advertising. We share it only with the providers we need to deliver this feature (see section 5): hosting (Google Cloud), database and storage (Supabase), network edge (Cloudflare) and Anthropic's Claude API, which we use to classify movements. Anthropic does not use data sent through its API to train its models.
3.5 Limited Use
Exacto's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We use Gmail data only to provide or improve the feature that finds and reconciles invoices and receipts, which is visible to you inside Exacto.
- We only transfer that data to third parties when necessary to provide or improve that feature, to comply with applicable law, or as part of a merger, acquisition or sale of assets with prior notice to you.
- We do not use or transfer the data for advertising, including personalized, retargeted or interest-based advertising.
- We do not sell the data, use it to determine creditworthiness or for lending purposes, or transfer it to data brokers.
- No human reads your Gmail data unless: (a) you give us affirmative consent for specific messages (for example, when asking for support); (b) it is necessary for security purposes, such as investigating abuse or an incident; (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymized for internal operations.
- We do not use Gmail data to develop, improve or train generalized artificial intelligence or machine learning models.
3.6 How to disconnect Gmail
You can disconnect your mailbox at any time from Settings → Integrations in Exacto. When you do, Exacto revokes the token with Google, deletes it and immediately stops reading your email. You can also remove access from your Google Account at myaccount.google.com/permissions.
Invoices and receipts already found remain part of your company's records, because they may be linked to reconciled movements. If you want us to delete them too, email daniel@typebold.com and we will do so within 30 days.
4. How we use data
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage your account, organization and team | Account data | Performance of contract |
| Show, reconcile and classify your movements | Financial and Gmail data | Performance of contract and your consent when connecting Gmail |
| Suggest classifications with AI assistance | Descriptions, amounts, dates, counterparties and data extracted from documents | Performance of contract |
| Security, fraud prevention and auditing | Technical data | Legitimate interest |
| Support and Service communications | Account data | Performance of contract |
| Comply with legal obligations | As required in each case | Legal obligation |
We do not make decisions with legal effects on you based solely on automated processing. Exacto's suggestions always require review by a user.
5. Who we share it with
We do not sell or rent personal data and do not use it for advertising. We share it only with service providers (processors), under contracts that prevent them from using it for their own purposes:
| Provider | Service | Data |
|---|---|---|
| Google Cloud (Google LLC) | Hosting of the application and of the processes that read email | All Service data, in transit and during processing |
| Supabase, Inc. | Database and file storage | All Service data, at rest |
| Cloudflare, Inc. | Edge network, protection and delivery of the website and app | Web traffic and technical data |
| Anthropic, PBC | Claude API, to classify movements | Descriptions, amounts, dates, counterparties and document data needed for each suggestion. Anthropic does not use this data to train its models. |
We may also disclose data when required by law or a competent authority, or to protect the rights and safety of our users. If typebold is involved in a merger, acquisition or sale of assets, we will notify you before your data becomes subject to a different policy.
6. International transfers
Our providers may process data outside Chile, mainly in the United States. We choose providers with recognized security standards and data processing agreements that require an adequate level of protection, in line with Chilean Law 19,628 and Law 21,719.
7. Retention and deletion
- While your account is active, we keep the data needed to provide the Service.
- Gmail token: revoked and deleted when you disconnect the mailbox or close your account.
- Data extracted from Gmail and attachments: kept while the organization exists, unless you ask us to delete them sooner; in that case we delete them within 30 days.
- Records deleted in the app: some items go to a trash view so you can restore them; they are permanently deleted when the account is closed or on request.
- Account closure: we delete the organization's data within 30 days of your request. Backups are overwritten within up to 30 additional days.
- Technical and security logs: kept for up to 12 months.
We may keep data longer only where a law requires it, and only for that purpose. To request deletion of your data, email daniel@typebold.com from the address associated with your account.
8. Security
- Encryption in transit with HTTPS/TLS on every connection.
- Integration tokens and credentials encrypted at rest with AES-256-GCM; the key is kept in the server's protected configuration, apart from the database and never in the code.
- Per-organization data isolation with row-level security in the database.
- Files in private storage, served only to authorized users.
- Least privilege: read-only Gmail access and internal access restricted to the people who need it to operate the Service.
- Audit logging of relevant actions.
No system is infallible. If a security incident affects your data, we will notify you, and the authorities where required, according to applicable law.
9. Your rights
Under Chilean Law 19,628 on the protection of private life and, once in force, Law 21,719, you may exercise the following rights over your personal data:
- Access: know what data of yours we process and how.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete your data.
- Objection: object to certain processing.
- Portability: receive your data in a structured, commonly used format.
- Blocking: ask for processing to be temporarily suspended.
- Not to be subject to decisions based solely on automated processing.
- Withdraw your consent, for example by disconnecting Gmail, without affecting prior processing.
To exercise them, email daniel@typebold.com. We will respond within 30 calendar days. If the data belongs to a customer company, we may forward your request to that company as the controller. If you are not satisfied with our response, you may contact the competent data protection authority.
10. Cookies
This public website does not use cookies. The application only uses strictly necessary cookies to keep you signed in and to protect the Google connection flow. We do not use advertising or tracking cookies.
11. Children
Exacto is a business service and is not directed to anyone under 18. We do not knowingly collect data from minors.
12. Changes to this policy
If we change this policy, we will publish the new version here with its effective date. If the change is material, especially regarding the use of Google data, we will notify you by email or in the app before it takes effect and, where appropriate, ask for your consent again.
13. Contact
typebold · Chile
Email: daniel@typebold.com