Privacy policy

The data controller is DROMETRA SpA, RUT 78.506.876-9, a company incorporated in Chile, with its registered address at Colo Colo 379, Oficina 706, Edificio Amanecer, Concepción, Región del Biobío, Chile. The contact email is [email protected].

• Privacy inquiries and exercise of rights: [email protected]
• Security reports: [email protected]
• Data protection delegate: being appointed before December 1, 2026; in the meantime, inquiries are handled at the same email address.

Drometra treats personal data in two different legal positions, and the distinction determines who you claim and who decides on such data.

If you are a driver or worker of a client company and want to know what is recorded about you, the starting point is your employer: he defines the purposes. However, we help you channel the application; it is explained in the document on driver data.

Drometra is a set of products that share infrastructure, but they do not process the same data or have the same level of maturity. We publish the status of each one because privacy guarantees depend on what is actually in operation.

Products in beta, development, or pilot are governed by a specific agreement with the participant, and are not activated with data of real people without the prior assessment required by law. The specific notices for Dromivia, Drometra Spaces, and Michiva detail each case.

We do not ask for sensitive data on any form on the site. If you send sensitive data on your own initiative in a support message, we treat them only to answer that query and remove them when it is no longer necessary.

Any treatment operation needs a basis of legality. Act No. 21.719 provides consent as a general rule and admits other grounds when treatment is justified by itself. This is the complete correspondence.

When we invoke legitimate interest we make a prior weighting between that interest and your rights, and we document it. You can ask us for the result of that weighting and oppose treatment.

We do not make solely automated decisions that produce legal effects on a person or significantly affect them. We do not score people to decide whether to sell to them, nor do we profile visitors for advertising purposes.

We use models in two places, with different safeguards depending on where they run.

When Michiva uses a language model, each call is configured so that the provider does not use the data to train its models and, where the provider offers it for that model, does not retain it. If a model does not support zero retention, the provider may keep abuse-monitoring logs for up to 30 days under its own terms; we will tell you before enabling that model for your company.

The model does not calculate figures: figures come from the database, and a deterministic checker verifies that the drafted text does not alter them. Drometra does not store the text of questions or answers; only a usage log —who asked, purpose, model, result, consumption, and cost— which is deleted after 90 days. Details are in the document on Michiva and model providers.

We do not use your contact details, your support inquiries, or your account content to train models, whether our own or third parties'. Fleet data is not used for training either without a written and revocable agreement with the customer.

The platform may display operational and commercial figures: operating costs, billable items, statuses of tax documents, and summaries drafted with the help of a model. That information is descriptive and helps your company understand its operations.

• Drometra does not make financial, credit, investment, or payment decisions for you or your company.
• Drometra does not provide financial, tax, accounting, investment, or legal advice, and nothing the platform displays —including text generated by Michiva— constitutes a professional recommendation in those matters.
• The decisions you make with that information are yours. For financial, tax, or accounting decisions, consult a licensed professional.

We share data only when it is necessary for one of the declared purposes, and always under contract that imposes confidentiality and purpose limitation.

• Providers acting on our own: server hosting (Contabo), network, tunnel, and encrypted backup storage (Cloudflare) and, only when the feature is enabled, language model and transactional email providers. The current list, with location, data received, and status, is in the register of sub-processors.
• Authorities and courts: When there is a valid and well-founded order, how we evaluate it is in the policy of requests from authorities.
• External advisers: lawyers, auditors and accountants, subject to professional secrecy.
• In a corporate operation: If Drometra is involved in a merger or acquisition, the data may be transferred to the acquirer, who is subject to the same policy until he notifies a change.

We don't sell personal data, we don't give them to data brokers and we don't use them for third-party advertising.

We do not yet have encryption of the database volume on the server; it is under evaluation. We say so because a privacy policy should not promise more than the system does.

Drometra is a Chilean company, but the platform is not hosted in Chile: the main server is in France, in the European Union, whose data protection regime (General Data Protection Regulation) is at least equivalent to Chile's. Cloudflare processes traffic on its global network and is a United States company. When Michiva uses a language model, the question and the masked facts are processed in the United States.

Each transfer is covered by the provider's data processing agreement and contractual clauses. The details per provider, the destination country, and the mechanism are in the international transfers document.

We retain each category only as long as the purpose that justifies it remains, and then we delete it or irreversibly anonymize it. These are the periods for the data for which we are the controller.

Some retention periods are applied automatically and others are still applied manually while we finish automating them. The retention policy indicates which is which, and includes the periods for fleet data, which each customer sets by contract.

Chilean law recognizes a set of very personal rights: they cannot be given up or given up in advance, and they are free of charge.

• Access: know if we treat your data and obtain a copy, together with its origin, purpose, recipients and storage time.
• Rectification: correct inaccurate, outdated or incomplete data.
• Abolition: that we remove your data when they are no longer necessary, you revoke consent or treatment is illegal.
• Opposition: stop treatment based on legitimate interest, and in any case direct marketing.
• Portability: receive in structured electronic format the data you gave us, or ask us to send them to another responsible.
• Blocking: temporarily discontinue treatment while a request for rectification, suppression or opposition is resolved.

They are exercised by writing to [email protected]. We verify your identity before responding —it is a safeguard for you, not a formality— and we respond within 30 calendar days, extendable only once for an equal period when the request is complex, notifying you before the first period expires. Today these requests are handled manually by our team.

If we do not respond, or the answer does not satisfy you, you can claim with the Personal Data Protection Agency. That you claim does not exempt us from responding, and we do not admit any form of retaliation for exercising a right.

We apply technical and organizational measures proportionate to the risk: encryption in transit on all connections, including the database; mandatory second factor and lockout after repeated access attempts; isolation between companies in the database itself; role-based access control with least privilege; audit logging of actions; unprivileged containers on internal networks; encrypted backups with verified restoration.

If a gap occurs that represents a risk to your rights, we notify the Agency and, where appropriate, the holders concerned, in clear language and without undue delay. The details are in the security statement.

This policy is governed by Chilean law. When we provide services to customers in other jurisdictions, we also apply the rules that are relevant to this operation.

• Act No. 21.719: it regulates the protection and processing of personal data and sets up the Agency for the Protection of Personal Data. Published on 13 December 2024, it has been in place since 1 December 2026.
• Act No. 19,628: on the protection of privacy, applicable until Act No. 21.719 enters into full force.
• Constitution, article 19 No. 4: it recognizes the protection of personal data as a constitutional guarantee, following the reform of Act No. 21,096.
• Act No. 21.663: framework law on cybersecurity; we are able to operate services to support transport and logistics.
• Act No. 19,496: on the protection of consumer rights, as applicable to procurement.

We publish any new version in this same direction, with its date and version number. When the change substantially alters the purposes, the basis of legality or the addressees, we notify it at least 30 days in advance by mail to the headlines with whom we are related, and - if the law requires it for that change - we ask again for your consent.

Version 4.0 corrects the server location (France, not Chile), removes the site analytics, which were never actually installed, and adds the products, the model providers, and the statement on financial advice.