Legal

Privacy policy

Last updated: October 7, 2026

1. Who is responsible

chaggu (formerly TieComs) is operated by CERTILABOR S.A.S., a Colombian company with tax ID (NIT) 900849607, domiciled in Bogotá D.C., Colombia ("chaggu", "we"), which acts as the controller of account data. When a company uses chaggu to communicate with its team and with other companies, that company is responsible for the content its people share, and chaggu processes it as a processor on its instructions.

Privacy contact: [email protected].

2. Data we process

We don't use advertising cookies or third-party trackers. We only use the cookies and local storage strictly needed to keep you signed in.

We only upload photos and files you select for your profile or to share in chaggu, including audio files you choose. The apps do not request access to your device's entire address book: WhatsApp contacts, if you enable that feature, come from the linked account. Synced chats are private to their owner, except for messages you choose to forward or link to a shared conversation. You can disconnect WhatsApp in the app; the server deletes that connection and its synced private contacts and chats, while messages already shared in chaggu remain subject to the conversation's retention rules.

When you search WhatsApp chats, the search terms are sent to the server. HTTP requests, including those queries, are stored in technical logs for diagnostics and security and may remain there after the results are displayed.

If you link a WhatsApp chat to a chaggu conversation, new messages and reactions from that chat arrive in the conversation with the display name the person uses on WhatsApp, visible to everyone with access to that conversation. Unlinking stops it.

If you allow notifications, the app registers a token for each session, together with the platform and language. When remote notifications are enabled, Apple Push Notification service (APNs) or Google Firebase Cloud Messaging (FCM) process the token and the content needed to deliver the alert: for example, the chat name, sender, a message preview and conversation identifiers. You can turn off notifications in your device settings. We delete the token when you sign out, the session is revoked, or the provider reports that the token is invalid.

Voice and AI features are optional. Before transferring data to Inworld or DeepSeek, the app explains what will be sent and asks for permission for that note or summary. Declining still lets you send and play the note and write the summary manually, without AI. To transcribe a voice note, Inworld receives the audio and language. To summarize it or suggest an issue, DeepSeek receives the transcript, the names of the author and participants, and the conversation name. If you request a sidechat summary to bring back to the thread, DeepSeek receives the messages used for the summary, their authors’ names, the original message, the group name and the name of the person posting the result. Transcripts and summaries are stored in chaggu and shown to people with access to the conversation; the sidechat summary is posted in the original thread when you confirm sending it. These features require the corresponding services to be enabled.

Shared links. When someone shares a link in a conversation, the chaggu server visits that address to build the preview; the linked site sees the server's IP address, not yours. We store the title, description, author or channel and a thumbnail (the thumbnail in Amazon S3), and show them in the conversation and in the link library to those who have access to it. Marking a link as seen or "Watch later" is visible only to you.

The AI summary of a link is optional and requested manually: DeepSeek receives the link's address, title and description and, for a public page with text, up to 14,000 characters of that text; it does not receive messages, names or conversation data. The summary is stored and reused for anyone who asks for the same link. The weekly link digest by email is also optional: you turn it on in your profile, it is sent through Brevo, and you can turn it off there at any time.

The gg assistant is optional and asks for permission each time you open it, before sending data to DeepSeek. DeepSeek receives your conversation with gg, your name, language and time zone, and names and identifiers of people, job titles, companies, groups and spaces in your directory. To answer your requests, it may consult messages and their authors, subjects and meetings you can access. On the web, if you choose to speak, we also ask permission to send the audio and its language to Inworld for transcription; the resulting text is sent to DeepSeek. In native apps, dictation uses the operating system speech recognition service and its permissions; it is not guaranteed to run entirely on the device. Your gg history is saved on your device; the server processes it to respond without retaining a memory of the gg conversation. You can cancel permission and keep using chaggu without the assistant. Messages drafted by gg are sent to other people only when you confirm them.

3. Sign in with Google, Microsoft and Apple

If you choose "Continue with Google" or "Continue with Microsoft", we only request basic identity scopes: openid, email and profile. That sign-in does not request access to Gmail, Google Drive, calendars, Outlook, OneDrive or Teams. Connecting email or a meeting provider is a separate, optional action.

chaggu's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use this data to sign you in, show your profile and, if you choose the relevant connection, provide the email and meeting actions described below; we don't transfer it to third parties except as needed to provide the service or comply with the law; we don't use it for advertising; and no human reads it except with your consent, for security, or as required by law. We don't use Google or Microsoft data to train artificial intelligence models.

You can revoke access at any time from your Google Account or Microsoft My Apps.

Sign in with Apple

In the iOS app, you can choose Sign in with Apple. We only request your name and email address. If you choose Hide My Email, we receive the private relay address Apple provides, not your personal email address. We do not require you to disclose that personal address to create an account with Apple. Your name may only be supplied on the first sign-in; we keep it for your profile and you can update it.

Apple also supplies a stable identifier and technical credentials to verify sign-in. Our server validates those credentials and stores the credential needed to manage and revoke authorization in encrypted form. Your Apple password is not shared with chaggu. We do not use this sign-in or your interactions with the app for advertising.

Apple's private address is not used to claim a company domain or access an invitation restricted to another email address. Linking Apple to an existing account requires you to sign in to that account and confirm the link; we do not automatically merge accounts because their emails match.

You can stop using Apple for chaggu in your Apple Account settings. This revokes the permission you granted, but does not replace deleting your chaggu account. When you delete your account through chaggu, we close its sessions and request revocation of that authorization from Apple. If Apple does not respond immediately, we retry revocation without blocking deletion of your chaggu data.

Optional email connections

When the feature and provider are available, you can choose to connect Gmail or Outlook. This requires a separate authorization with that provider; signing in to chaggu does not connect your mailbox. Availability may depend on provider approval and your account or organization's settings.

• Gmail: we request permission to read mail, send messages and manage drafts (gmail.readonly, gmail.send and gmail.compose), together with basic account identity.
• Outlook: we request permission to read and write mail and send messages (Mail.ReadWrite and Mail.Send), together with basic identity and permission to renew the connection (offline_access).

These permissions let chaggu display and search mail, open messages and attachments, and prepare or send the emails you request. We store the account address, granted permissions and encrypted access and refresh tokens. Mailbox views are fetched from the provider and may be cached briefly to display them; connecting does not automatically publish mail to a chat. If you share an email, we save its selected content and related sender, recipient and attachment information in the chosen conversation, visible to people who can access it. Messages you schedule for sending are stored until processed.

If optional AI reply drafting is available and you request it, DeepSeek receives the shared email's sender, subject and text, your name, and the relevant conversation comments and their authors' names to prepare a draft. Requesting a draft does not send it; you review it before choosing to send.

You can disconnect the mailbox in chaggu to remove its stored connection credentials and cancel pending scheduled replies from that connection. You can also revoke the provider's permission from your Google or Microsoft account settings. Disconnecting does not delete mail already sent or content you have shared in chaggu; shared content follows the conversation's retention rules.

Optional meeting connections

When this feature is available, you can connect Google, Microsoft or Zoom from Meetings. The app explains the access before connecting and the provider asks for your consent. The connected account is linked to your chaggu user; ordinary sign-in does not activate this connection.

• Google Meet: we request calendar.events.owned, plus openid and email. This permission allows reading and writing events on calendars you own. chaggu uses it to create the event you request in your primary calendar and read that same event to recover its Meet link or resolve an interrupted response. It does not list your other events or modify or delete existing events.
• Microsoft Teams: we request Calendars.ReadWrite, openid, email and offline_access. This permission allows reading and writing calendars of the connected account; chaggu uses it to create the Outlook event with a Teams link you request. Token renewal keeps the connection available for later requests. A work or school account with Teams capability enabled is required.
• Zoom: we request permission to create meetings in your own account (meeting:write:meeting). We do not request administrative access or access to other people's meetings.

We send the chosen provider the title, date, time, duration and time zone you enter, together with technical data needed to authorize and identify the operation. We receive the event or meeting identifier, link and creation result. These meeting connections do not request reading or sending email or importing contacts; optional email connections are described separately above. We store the provider, account email when supplied, granted permissions and encrypted access and refresh tokens on the server, plus the operation record, title, dates, time zone, identifiers and link so the result can be recovered without duplication.

If you choose to share, the title, time and link are posted as a chaggu message and event in the selected conversation, visible to those who can access it. Shared data follows its usual retention rules and the optional gg features described above; provider tokens are not shared with participants or gg. Copying a link does not itself post it in a chat.

You can disconnect a provider in Settings: we delete the connection, its tokens and pending authorizations from chaggu's active database. To also revoke the permission granted at the provider, use connected-app management in Google, Microsoft or Zoom. Disconnecting does not delete meetings already created at the provider or messages and events already shared. Their records follow the account and conversation retention rules in this policy.

4. Company verification

To protect people who talk across companies, we verify that an organization controls the email domain it claims: through a DNS TXT record added by its administrator (with the prefix chaggu-verification=; records created with tiecoms-verification= are still accepted), or through the information Google Workspace or Microsoft Entra ID provide at sign-in. We store the domain, the method and the verification date, and we show other companies the name, domain and verification badge. Public email domains (such as gmail.com or outlook.com) can't be claimed as a company.

5. Who we share data with

• The people and companies you talk with: they see your name, title, company and what you post in the spaces you take part in.
• Your company's administrator: they can manage your membership, require corporate sign-in and remove your access.
• Providers that help us operate: Amazon Web Services (servers, database and file storage), Cloudflare (network and protection), Google and Microsoft (sign-in and optional email and meeting connections), Zoom (optional meetings), and Brevo (transactional email); Apple APNs and Google FCM (remote notifications); Inworld (voice note transcription) and DeepSeek (summaries, suggestions and optional email drafts), using the data described above for each feature. If you link a WhatsApp account, a connection to WhatsApp synchronizes the data described above. These services support the features you choose to use.
• When required by law: in response to a valid order from a competent authority.

Apple also acts as an authentication provider when you choose Sign in with Apple and supplies email relay service if you use a private address. We do not send the content of your conversations to Apple as part of that sign-in.

We don't sell or rent personal data.

6. International transfers

Our servers are in the United States (AWS, us-east-1). By using chaggu, your data is transferred to and stored there, with security measures equivalent to those required by Colombian law.

7. How long we keep data

• Account data: for as long as the account exists.
• Messages and files: according to the company's or shared space's settings, or until deleted.
• Security and audit logs: up to 24 months.
• When you close your account we delete or anonymize your data within 30 days, except what the law requires us to keep or what is part of a company's conversations, which remains under that company's control.

8. Security

We encrypt traffic with TLS, store passwords with a strong algorithm (scrypt), rotate session tokens, detect their reuse and log sensitive events. No system is perfect; if an incident affects your data, we will notify you and the authorities where required.

9. Your rights

Under Colombian Law 1581 of 2012 and Decree 1377 of 2013 (and, where applicable, other laws such as the EU GDPR), you can access, update, correct and delete your data, request proof of consent, withdraw it, and file complaints with the Superintendencia de Industria y Comercio. Email [email protected]. We answer requests within 10 business days and complaints within 15 business days.

You can use Delete account in the app settings or email us from your account address. Read the deletion instructions, including which data is deleted or anonymized and the retention exceptions.

10. Children

chaggu is a work tool. It is not intended for anyone under 18 and we don't knowingly collect their data.

11. Changes

If we make material changes to this policy, we will notify you in the app or by email before they take effect.