Privacy Policy
Version 1.1 · Last updated: October 23, 2026
Plain-language summary (the full policy below controls)
- Who we are: SMART (smarthnd.com), an AI and digital agency serving small businesses in Honduras (Catacamas, Olancho) and the United States. SMART is run by Diego Moradel, who is responsible for your data.
- What we collect: what you type into our contact form or website chat; your WhatsApp number, profile name and messages when you write to us; your public comments, profile name and messages when you comment on SMART's Facebook or Instagram posts or message our pages; business and contact details of leads and clients; contracts and invoices. Payments go through Stripe. We never see or store your full card number.
- Cookies are your choice. Our website shows a banner with Accept and Reject. Analytics, session-recording and advertising tools (Google Analytics, Google Tag Manager, Microsoft Clarity and the Meta Pixel) and SMART's visitor ID load only if you click Accept. Without your consent, we only count page views anonymously, with no cookies or identifiers. You can change your choice, or use "Forget this browser", any time with the "Cookie preferences" link at the bottom of the page. See Cookies and website tracking.
- AI answers first. Our WhatsApp assistant, our website chat and our Facebook/Instagram assistant use artificial intelligence, not a person. A person on our team can step in at any time, and you can ask for one. Your messages are processed by our AI provider, Anthropic (Claude), to write the replies.
- Our website chat. It's answered by AI (Anthropic). SMART doesn't save the conversation unless you accepted cookies; then our CRM receives up to 10 of your messages, including any name or phone you wrote. Please don't type sensitive information.
- We never sell your data for money. If you accept cookies, we may use the Meta Pixel to measure our ads, which lets Meta receive information about your visit; some US state laws call that "sharing." You can opt out at any time (see Your choices about ads). We honor the Global Privacy Control signal.
- Stop messages any time: reply STOP or BAJA (or just "no thanks") on WhatsApp, Messenger or Instagram, or email us.
- Delete your data: send "DELETE MY DATA" (or "ELIMINAR MIS DATOS") on WhatsApp to +504 9227-4733 or by Messenger or Instagram message to SMART, or email contact@smarthnd.com with the subject "Delete my data". We confirm within 5 business days and delete within 30 days. Step-by-step: smarthnd.com/data-deletion.
- Where it lives: our providers are mostly in the United States; we work from Honduras and the US.
- Questions: contact@smarthnd.com · WhatsApp +504 9227-4733.
1. Who we are (the controller)
1.1 SMART ("SMART," "we," "us," "our") is an artificial intelligence and digital agency. We build websites and AI bots for WhatsApp, Messenger and Instagram, and provide digital marketing and videos for small businesses in Honduras and the United States.
1.2 Who is responsible for your data. The business responsible for the personal information described in this policy (the "controller") is:
Diego Moradel, doing business as SMART
Oak Lawn, Illinois, United States · Catacamas, Olancho, Honduras
Email: contact@smarthnd.com · Phone / WhatsApp: +504 9227-4733 · Website: https://smarthnd.com
Diego Moradel is forming SMARTHND AGENCY LLC, an Illinois limited liability company, to run SMART; the company is pending approval by the State of Illinois. When it is approved, the company will become the controller, this policy will continue to apply, and we will update this page.
1.3 What this policy covers: our website smarthnd.com (including its chat assistant, contact form, cookie banner and analytics), conversations with SMART on WhatsApp at +504 9227-4733, SMART's Facebook and Instagram pages (comments, Messenger and Instagram direct messages, including our automated assistant there), our dealings with prospective clients ("leads") and clients, and payments made to SMART.
1.4 What it does not cover. When SMART builds a website or runs a bot for a client, the client decides how its customers' data is used and is responsible for it; SMART acts only as the client's service provider (processor) under our client agreements. If you are a customer of one of our clients, the client's own privacy policy applies; you can contact them directly (or us, and we will pass your request on). Third-party sites and apps we link to or use (Facebook, Instagram, WhatsApp, TikTok, Stripe, Google, Microsoft) have their own policies.
2. What we collect
2.1 Website visitors (smarthnd.com)
- Contact form: your name, the email or phone you leave, your company (optional), and your message. Whatever you choose on the cookie banner, we save it in our CRM (a Google Sheet) and receive it by email through Resend, so we can answer you.
- Website chat assistant ("SMART Assistant"): the chat is answered by AI, and before you start it shows a notice saying so and explaining that your messages are saved if you accepted cookies. To write each reply, the last 12 messages of the conversation (yours and the assistant's) are sent to our AI provider, Anthropic, whatever you chose on the banner. If you didn't click Accept, SMART doesn't save the conversation or send anything about it to our CRM. If you clicked Accept, when the chat ends (after 2 minutes without a new message, or when you leave the page) our CRM receives up to 10 of your own messages (not the assistant's replies), each shortened to 300 characters, plus your name or phone number if you wrote them in a message (for example, "my name is…"), linked to your visitor ID (section 3.3). To prevent abuse, our server keeps your IP address in memory for about 10 minutes to limit how many messages can be sent. Please don't type sensitive information (card or bank numbers, ID numbers, passwords, health information).
- WhatsApp buttons: our "WhatsApp" buttons open a chat with +504 9227-4733 with a pre-filled message. Nothing is sent until you press send.
- Technical data: like any website, our hosting provider (Vercel) receives and logs basic technical data for each visit, such as your IP address, browser, device type, pages requested, and date and time, for security and to run the site. Vercel tells our site your approximate country, based on your IP address, so we can show you the Honduran or US version (prices in lempiras or US dollars); no cookie is used for this.
- Cookies, analytics and session recordings: see section 3. In short: Google Analytics, Google Tag Manager, Microsoft Clarity, the Meta Pixel and SMART's visitor ID load only if you click Accept. Without your consent, we only count page views anonymously.
2.2 WhatsApp conversations with SMART (+504 9227-4733)
When you message SMART on WhatsApp, or we message you (see sections 2.4 and 7), we receive and keep:
- your phone number and your WhatsApp profile name;
- the content of your messages: text, and any voice notes, photos, videos, documents or location you choose to send;
- message dates, times and delivery/read status, and whether you came from one of our ads or links;
- notes our team adds (for example, which service you asked about, or that you asked us to stop writing).
An AI answers first. SMART's WhatsApp is answered by an automated assistant that uses artificial intelligence. It introduces itself as SMART's automated assistant. It can answer questions about our services and prices and send proposals. A person on our team can see the conversation and take over at any time, and the assistant hands you to a person for special pricing, complaints, voice notes, sensitive topics, or whenever you ask for a human. See section 6.
Voice notes. At present, voice notes you send are not transcribed by AI; a person listens and replies. We do not use voice notes, photos or videos to identify you or to create voiceprints, face geometry or any other biometric identifier (see section 14.2).
Please don't send card numbers, bank passwords, ID numbers, health information or other sensitive data on WhatsApp. We will never ask for them.
2.3 Facebook and Instagram (comments, Messenger and Instagram messages)
When you comment on a post by SMART's Facebook page or Instagram account, or send a message to SMART on Messenger or Instagram, Meta shares with us, and we keep in our CRM:
- your public comment (text, the post it was on, date and time);
- your profile name and the ID number Meta gives your account for our page (a page-scoped or Instagram-scoped ID), and your profile picture if Meta provides it;
- the content of messages you exchange with us on Messenger or Instagram (text and any photos, videos, files or voice notes you send), with dates and times;
- notes our team adds, and whether you asked us to stop writing.
How our automated assistant works there:
- Comment-to-message. If you comment on one of our posts (for example, asking for prices or writing a keyword we suggested), our assistant may reply to your comment publicly and send you one private message about what you asked. We only send these messages to people who commented on our posts. We never message people who didn't comment or write to us, and after that one message we only write again if you reply.
- AI disclosure. Messages from our assistant on Messenger and Instagram are written by AI. The assistant introduces itself as SMART's automated assistant, confirms it's AI whenever you ask, and hands you to a person whenever you ask or the topic needs one (see section 6).
- Stop or delete. Write STOP or BAJA to stop messages, or "DELETE MY DATA" / "ELIMINAR MIS DATOS" to ask us to delete your data (see the data deletion page).
Your comments on our posts are public on Facebook or Instagram, and anyone can see them there. You can delete your own comment at any time. Meta processes your use of Facebook, Messenger and Instagram under its own privacy policy (https://www.facebook.com/privacy/policy).
2.4 Leads (prospective clients)
To offer our services to businesses, we keep in our CRM:
- business information that the business itself has made public, such as its name, category, address, phone number, website, Google rating and social media pages (for example from Google Maps, Facebook or business directories);
- the name and role of the contact person, if we have it, and how and when they agreed to hear from us;
- our notes, proposals and sample materials (for example, a sample video or mock-up prepared for that business).
We use public business information to research and prepare proposals. If you run a business, we may send you one personal, one-to-one first message, written or sent by hand by a member of our team (by WhatsApp from a team member's phone or from our WhatsApp Business number, +504 9227-4733), using the contact details your business publishes, to offer our services or a free sample such as an ad video. We never use bulk or automated messages for this, our Messenger/Instagram assistant never starts these conversations, and we stop immediately if you ask (reply STOP or BAJA, or just say "no thanks" / "no gracias"). If you don't answer, we won't keep writing. All other marketing, and any automated or bot messages, go only to people who opted in or wrote to us first (on Facebook and Instagram, that includes people who commented on our posts, as explained in section 2.3).
2.5 Clients
- business details (legal or trade name, RTN/EIN or tax ID if needed for invoices, address), and the names, emails, phone numbers and roles of the people we work with;
- quotes, signed agreements, approvals, invoices, payment records and our correspondence;
- the content you give us to build your services (logo, photos, prices, hours, FAQs), and the manager access you grant us to your Google Business Profile, Facebook/Instagram pages, WhatsApp Business account or ad accounts (we ask you to add us as a manager; we never ask for your personal passwords).
Your customers' data that passes through a bot or website we run for you is covered by our client agreement (Service Agreement §12 / Contrato §12), not by this policy (see 1.4).
2.6 Payments (Stripe)
US clients pay by card through Stripe (Stripe Checkout and Stripe invoices). Stripe collects your card details directly. SMART never sees or stores your full card number or security code. From Stripe we receive your name, email, billing address (if given), the card brand, the last four digits and expiry date, and the payment history and status, so we can bill you, apply the card-on-file authorization you gave us, issue receipts and handle refunds or disputes. Stripe processes payment data under its own privacy policy (https://stripe.com/privacy) and may use it for fraud prevention. Clients in Honduras pay by bank transfer or cash; we keep the transfer receipt and invoice.
2.7 Other social media
If you interact with SMART on TikTok or other platforms, those platforms share with us what their settings allow (for example, your public profile name and your comments or messages).
3. Cookies and website tracking
Cookies are small files a website saves in your browser. Similar tools (browser storage, pixels, tags and scripts) save information in your browser or send information about your visit to the company that runs them. This section replaces our earlier statement that the website used no cookies or analytics.
3.1 Your choice
The first time you visit smarthnd.com, a banner explains that, if you accept, we use tools from Google, Microsoft and Meta to measure visits and our ads, and we save your chat messages and contact-form details. It asks whether you Accept or Reject. Both buttons are equally easy to use, and nothing is pre-selected.
- If you click Accept, we load the tools in section 3.3.
- If you click Reject, or close the banner (× or Esc), we treat it as Reject: those tools don't load, set no cookies and receive no data about your visit. Until you choose, they don't load either.
- We save your choice in your browser only after you make it, and keep it for 12 months; after that, or if we change the banner, we ask again.
3.2 What happens without your consent
Whether or not you accept, and before you choose:
- Hosting logs: Vercel logs the technical data needed to run and secure the site (section 2.1).
- Vercel Web Analytics and Speed Insights: our host measures how many visits each page gets and how fast pages load. According to Vercel, these tools don't use cookies and report visits in aggregate, without identifying you.
- SMART's anonymous page-view counts: for each page you view, our own analytics sends our CRM only: the page address (without its query string, except campaign tags such as utm_source), the website that sent you (its domain only), the date (no time), whether you're on a phone or a computer, and the site version (Honduras or US). It sets no cookies, saves nothing in your browser, and sends no identifier. Our CRM doesn't store your IP address (not even in coded form) or your browser details, and deletes these records automatically after 13 months.
- Nothing else. Before you accept, we don't record clicks, scrolling, time on page or website chats in our CRM.
- Your choice: once you choose, we save it in your browser and send our CRM a record of it (section 3.6).
- Website chat and contact form: if you use them, what you send is handled as described in section 2.1.
3.3 Tools that load only if you click Accept
| Tool | Provider | What it does for us |
|---|---|---|
| Google Tag Manager | A container for managing tags we may add in the future. It loads only after you accept; the other tools in this table are loaded by our site directly. | |
| Google Analytics 4 | Statistics on how visitors use the site: pages viewed (without query strings), time spent, how far you scroll, taps on our WhatsApp and phone buttons, contact forms sent, views of our prices, chats started, approximate location, device and the site that sent you. It never receives what you type. | |
| Microsoft Clarity | Microsoft | Session recordings and heatmaps: Clarity records how you move, scroll and click on our pages so we can see where the site is confusing. The website chat and the contact form are masked, so Clarity doesn't capture what you type or the chat messages. |
| Meta Pixel | Meta | We may use it to measure whether our Facebook and Instagram ads work (page views, views of our prices, taps on WhatsApp or phone, contact forms sent, chats started). See section 9. |
| SMART visitor ID | SMART (sent to our CRM, hosted on Vercel) | A random ID saved in your browser that lets our CRM recognize your return visits and link to the same visitor the pages you view (with title, language, campaign tags, time on page and scrolling), your taps on WhatsApp and phone buttons, contact forms sent, views of our prices, and website chats. After a chat ends, our CRM also receives your chat messages as described in section 2.1, so if you wrote your name or number, the CRM can link it to the pages you visited. |
We set up the Meta Pixel without advanced matching (we don't send your name, email or phone to Meta through it) and without automatic event detection, and it never receives chat or form content. Google, Microsoft and Meta also use the data they receive under their own policies: Google (https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites), Microsoft (https://privacy.microsoft.com/privacystatement) and Meta (https://www.facebook.com/privacy/policy).
3.4 What we save in your browser
| Name | Provider | Purpose | Type | How long |
|---|---|---|---|---|
smart_cookie_consent | SMART | Remembers whether you chose Accept or Reject (saved only after you choose) | Browser storage (local) | 12 months, then we ask again |
smart_vid (only if you accept) | SMART | Your random visitor ID for our CRM | Browser storage (local) | 13 months from when it's created; deleted earlier if you choose Reject or "Forget this browser" |
smart_sid (only if you accept) | SMART | Random session ID that groups the pages of one visit | Browser storage (this tab only) | Until you close the tab; deleted if you choose Reject |
smart_utm (only if you accept) | SMART | Campaign tags from the link you arrived with | Browser storage (this tab only) | Until you close the tab; deleted if you choose Reject |
| Google Analytics cookies (only if you accept) | Distinguish visitors and sessions | Cookies | Set by Google; see Google's documentation | |
| Microsoft Clarity cookies and Microsoft's own cookies (only if you accept) | Microsoft | Keep the same Clarity ID across your visits and join the pages of one visit into a recording | Cookies | Set by Microsoft; see Microsoft's documentation |
| Meta Pixel cookies (only if you accept and your browser doesn't send Global Privacy Control) | Meta | Identify your browser for ad measurement, and record that you arrived from a Meta ad | Cookies | Set by Meta; see Meta's cookie policy |
| Meta's own cookies on facebook.com / instagram.com | Meta | Set by Meta if you are signed in to Meta, under Meta's cookie policy | Cookies | Set by Meta |
3.5 Session recordings (Microsoft Clarity)
If you accept, Clarity records your visit as a replay of mouse movements, scrolling, clicks and the pages you see. The chat window and the contact form are masked in the recording, so what you type and the chat messages aren't captured. We use recordings only to improve the site; we don't use them to identify you, and we don't connect Clarity to Microsoft's advertising. Microsoft keeps recordings and heatmaps for a limited time under its own retention rules.
3.6 Changing your mind
- Withdraw or change your consent at any time: click "Cookie preferences" at the bottom of the page to reopen the banner and choose again.
- If you switch from Accept to Reject, we first ask our CRM to delete the website visit and chat records linked to your visitor ID, then delete
smart_vid,smart_sidandsmart_utm, delete the Google Analytics, Clarity and Meta Pixel cookies saved on smarthnd.com, and reload the page so the tools stop right away. Cookies that Microsoft or Meta keep on their own websites can't be deleted from our site; you can delete them in your browser. - "Forget this browser": the preferences panel also has a "Forget this browser" button. It asks our CRM to delete all the website visit and chat records linked to your visitor ID, deletes everything listed in section 3.4 that our site saved in your browser and the tools' cookies on smarthnd.com, and reloads the page; the banner then asks you again. You can also ask us to delete your data, including chat records linked to a phone number you wrote in the chat (see Data deletion).
- Record of your choice: when you choose, our CRM receives a record of it (Accept or Reject, date and time, banner and policy version, site version, whether your browser sent Global Privacy Control, and a random record number). It has no name, IP address or visitor ID.
- Global Privacy Control (GPC): if your browser sends a GPC signal, the banner tells you we detected it. We treat it as an opt-out of sale or sharing: we never load the Meta Pixel, even if you click Accept, and we keep Google's advertising features off.
- Google offers a browser add-on to opt out of Google Analytics: https://tools.google.com/dlpage/gaoptout
4. Our CRM
We keep our leads, clients and conversations in our own CRM app (hosted on Vercel and backed by a Google Sheet). It can hold:
- contact-form messages and website chat conversations;
- WhatsApp, Messenger and Instagram conversations, and public comments on our posts, with profile names and IDs;
- anonymous page-view counts (section 3.2), records of cookie choices, and, only if you accepted, your visitor ID with the website activity and chat messages described in sections 2.1 and 3.3;
- lead and client records, our notes, and opt-out ("do not contact") flags.
Only authorized members of our team can access it. How long we keep each kind of record is in section 10.
5. How we use your information and why (legal bases)
| What we do | Data used | Why we're allowed to |
|---|---|---|
| Reply to your questions on the website, WhatsApp, Messenger, Instagram or email | Form, chat, comment and message data | You asked us to (your request / steps before a contract); our legitimate interest in answering |
| Reply once by private message to a comment you left on our posts | Your comment, profile name and ID | Our legitimate interest in answering a comment you chose to leave; we stop as soon as you ask |
| Prepare and send proposals and quotes, and follow up | Lead and contact data | Your request; our legitimate interest in offering services to businesses |
| Provide the services you hire, and support you | Client data | Our contract with you |
| Bill you, take payments through Stripe, refunds, disputes | Payment data | Our contract; legal obligations (tax, accounting) |
| Send a business one personal, hand-sent first message to offer services or a free sample (section 2.4) | Business contact details the business publishes | Our legitimate interest in offering services to businesses; we stop as soon as you ask |
| Send all other marketing messages (offers, demos, workshops) and any automated or bot messages | Phone, email, name, social media ID | Your consent (opt-in) or because you wrote to us or commented first; you can withdraw it at any time (section 7) |
| Website statistics, session recordings and heatmaps; recognizing return visits and saving chat messages in our CRM | Data from the tools in section 3.3; chat messages (section 2.1) | Your consent (Accept); you can withdraw it at any time |
| Measure our ads (Meta Pixel) | Browsing data collected by the Meta Pixel | Your consent (Accept); you can withdraw it at any time |
| Count page views anonymously, and measure site speed | Anonymous counts (section 3.2) | Our legitimate interest in knowing how the site is used |
| Keep a "do not contact" list and a record of cookie choices | Phone number or ID and date of opt-out; consent choice | Legal obligation and legitimate interest in respecting your choice |
| Run, secure and improve our website, bots and services (including reviewing conversations to fix wrong AI answers) | Technical data, conversations | Our legitimate interest in a safe, working service |
| Comply with the law, enforce our agreements, and protect our rights | Any relevant data | Legal obligation; legitimate interest |
We do not sell your data for money, do not rent it, and do not make decisions that have legal or similarly significant effects on you based only on automated processing.
6. Artificial intelligence (AI) disclosure
6.1 You are talking to AI. The SMART Assistant on our website, the first replies on SMART's WhatsApp, and the automated replies to comments and messages on SMART's Facebook and Instagram are generated by artificial intelligence, not by a person. The assistant tells you it is an automated assistant when the conversation starts, and confirms it is AI whenever you ask.
6.2 A person is always available. Our team can read the conversation and take over at any time. Ask to talk to a person, in your own words, and a person will reply. The assistant also hands off on its own for special pricing, complaints, voice notes and sensitive topics.
6.3 Your messages are processed by an AI provider. To write each reply, the text of the conversation or comment (and our instructions and service information) is sent to our AI model provider, Anthropic (Claude), in the United States. Anthropic powers our WhatsApp assistant, our website chat and our Facebook/Instagram assistant. Under its commercial API terms, Anthropic processes this data to provide the service to us and does not use it to train its models; it keeps inputs and outputs only for a limited period for safety and abuse monitoring. If we turn on voice-note transcription, we'll update this policy first.
6.4 AI can be wrong. The assistant may make mistakes. Prices, terms and offers are only binding when confirmed in a written quote, pro forma or agreement from SMART. See our Terms of Use.
7. Marketing messages: opting in and out
7.1 Apart from the single personal, hand-sent first message to a business described in section 2.4, we send WhatsApp, Messenger, Instagram or email marketing, and any automated or bot messages, only if you opted in, wrote to us first, or commented on our posts (for the single private reply described in section 2.3), and only about what you agreed to or asked about.
7.2 To stop: reply STOP or BAJA on WhatsApp, Messenger or Instagram (or write "no thanks", "no gracias" or "no me escriban más"), use the unsubscribe link in any marketing email, or email contact@smarthnd.com. We stop right away, confirm once, and add your number or account to a do-not-contact list so we don't write to you again.
7.3 Opting out of marketing doesn't stop messages you need as a client (for example, invoices, payment reminders or service notices).
7.4 WhatsApp, Messenger and Instagram also let you block us or mute messages from a business inside the app.
8. Who we share it with (service providers)
We share personal information only with the providers below, which process it for us to run SMART, under their own terms and security commitments, and as described in section 9 for the Meta Pixel:
| Provider | What it does for us | Data involved | Where |
|---|---|---|---|
| Meta Platforms (WhatsApp Business Platform / Cloud API; Facebook, Messenger and Instagram platforms; Meta Pixel) | Sends and receives our WhatsApp, Messenger and Instagram messages and comments; our social pages and ads; ad measurement if you accept cookies | Phone number, profile names and IDs, comments, messages and files; browsing data from the Pixel | USA and other Meta locations |
| Google (Google Analytics 4, Google Tag Manager; Google Workspace: Sheets/Drive; Google Business Profile) | Website statistics if you accept cookies; our CRM spreadsheet ("SMART CRM") and files; our Business Profile and reviews | Browsing data; lead, client and conversation records; files | USA and other Google locations |
| Microsoft (Clarity) | Session recordings and heatmaps if you accept cookies | Browsing and interaction data (typed text masked) | USA and other Microsoft locations |
| Vercel | Hosts smarthnd.com, our website chat, our own analytics, our bots and our CRM; Web Analytics and Speed Insights (cookieless); tells our site your approximate country | Technical logs; data passing through the site, bots and CRM | USA |
| Anthropic (Claude) | AI model that writes the replies of our WhatsApp assistant, website chat and Facebook/Instagram assistant | Conversation and comment text | USA |
| Resend | Delivers the website contact-form messages to our inbox | Form contents | USA |
| Zoho (Zoho Mail) | Our email (contact@smarthnd.com) | Emails and attachments | — |
| Stripe | Card payments, saved cards, receipts, refunds, fraud prevention | Payment and billing data | USA |
| Our CRM (section 4) | Our own app (hosted on Vercel) backed by a Google Sheet | As above | USA |
We may also disclose information: (a) to authorities when the law, a court order or a valid legal request requires it; (b) to protect the rights, safety or property of SMART, our clients or others, including to prevent fraud; (c) to our professional advisers (lawyers, accountants) under confidentiality; and (d) to a successor if SMART's business is transferred (for example, to SMARTHND AGENCY LLC, the company Diego Moradel is forming to run SMART), which will remain bound by this policy.
9. Your choices about ads ("Do Not Sell or Share")
9.1 We never sell your personal information for money. But if you click Accept, we may use the Meta Pixel to measure our ads. The Pixel lets Meta collect information about your visit to smarthnd.com (such as the pages you view and taps on our WhatsApp button), and Meta may also use it under its own policies. Some US state privacy laws (for example, California's) treat this as "selling" or "sharing" personal information for targeted advertising.
9.2 How to opt out:
- click "Cookie preferences" at the bottom of any page and choose Reject (this also works if you clicked Accept before);
- turn on Global Privacy Control in your browser (we honor it as described in section 3.6); or
- email contact@smarthnd.com with the subject "Do not sell or share".
9.3 We don't send your name, email or phone number to Meta through the Pixel. Ads on Facebook and Instagram are also controlled by your Meta ad settings: https://www.facebook.com/adpreferences
9.4 We don't knowingly sell or share the personal information of anyone under 16.
10. How long we keep it
We keep personal information only as long as we need it for the purposes above.
| Data | How long |
|---|---|
| Website contact-form messages | While we have a business relationship with you and up to 24 months after our last contact, unless you become a client; we review these records periodically and delete them sooner if you ask |
| Website chat messages saved in our CRM (only if you accepted) | 13 months, then deleted automatically (sooner if you switch to Reject, use "Forget this browser" or ask us) |
| Website chat conversations without consent | Not saved by SMART (sent to Anthropic only to write the replies) |
| WhatsApp, Messenger and Instagram conversations, comments in our CRM, and lead records (not clients) | While we have a business relationship with you and up to 24 months after the last message or comment; we review these records periodically, delete or anonymize them after that, and delete them sooner if you ask |
| Website activity in our CRM linked to your visitor ID (only if you accepted) | 13 months, then deleted automatically (sooner if you switch to Reject, use "Forget this browser" or ask us) |
| Anonymous page-view counts | 13 months, then deleted automatically |
| Records of cookie choices (no name, IP or visitor ID) | 13 months, then deleted automatically |
| Your choice and visitor ID saved in your browser | 12 months (choice) and 13 months (visitor ID); see section 3.4 |
| Google Analytics data | For the period set in our Google Analytics account, no more than 14 months |
| Microsoft Clarity recordings and heatmaps | Per Microsoft's retention |
| Meta Pixel data | Per Meta's own retention |
| Do-not-contact list (opt-outs) | Only the number or account ID, date and channel, for as long as we send marketing, so we can respect your choice |
| Client records, agreements and correspondence | For the duration of the relationship and 7 years after it ends |
| Invoices and payment records | 7 years |
| Client's customers' data in bots/sites we run | Returned or deleted within 30 days after the client agreement ends (Service Agreement §12.4 / Contrato §12.4) |
| Server and security logs (Vercel) | Per Vercel's retention, typically days to weeks |
| Files you send on WhatsApp | Meta keeps media on its servers only for a limited time (about 30 days on the Cloud API); copies we save go with the conversation record |
| Your public comments on our posts | On Facebook or Instagram until you or we delete them |
| Data held by Stripe | Per Stripe's own legal retention duties |
We may keep information longer if the law requires it or to resolve a dispute, and then only for that purpose.
11. How we protect it
We use reasonable administrative, technical and physical safeguards for a business of our size, including: HTTPS encryption on our website; access limited to authorized team members, with unique passwords and two-factor authentication where available; a password-protected CRM; Meta's signature check on incoming WhatsApp, Messenger and Instagram webhooks; secret keys kept out of our code; masking of the chat and contact form in session recordings; card data handled only by Stripe (PCI DSS certified); and providers that encrypt data in transit. No system is 100% secure. If a breach affects your personal information, we will notify you and the authorities as the law requires (see section 14.3).
12. International transfers (United States, Honduras and other countries)
SMART works from both Honduras and the United States, and most of our providers (Meta, Google, Microsoft, Vercel, Anthropic, Stripe) store and process data in the United States and possibly other countries. If you are in Honduras or another country, your information will be transferred to and stored in the US; if you are in the US, our team may access it from Honduras. Data-protection laws in these countries may differ from those where you live. We take the steps described in this policy to protect your information wherever it is processed, and our providers apply their own safeguards, including the legal transfer mechanisms they offer (such as standard contractual clauses) where the law requires them.
13. Your rights and how to use them
Wherever you are, you can ask us to:
- access the personal information we hold about you and get a copy;
- correct information that is wrong or incomplete;
- delete your information (see Data deletion);
- object to or withdraw consent for marketing, cookies and tracking, or other uses (for cookies, use "Cookie preferences" at the bottom of any page);
- opt out of the "sale" or "sharing" of your information for targeted ads (section 9); and
- know who we shared it with.
How: email contact@smarthnd.com (subject "Privacy request") or send a message to SMART on WhatsApp (+504 9227-4733), Messenger or Instagram. We may ask you to confirm your identity (for example, by replying from the same number, account or email we have on file). We'll confirm receipt within 5 business days and respond within 30 days. There's no charge. If we can't do what you ask (for example, because the law requires us to keep invoices), we'll tell you why. We won't treat you differently for using these rights. Withdrawing consent doesn't affect what we did before you withdrew it.
If you are a customer of one of our clients, we'll forward your request to that client and help them respond.
Data deletion
Full step-by-step instructions are on our data deletion page: smarthnd.com/data-deletion (Spanish: smarthnd.com/eliminar-datos). In short:
- On WhatsApp: send the exact phrase "DELETE MY DATA" (or "ELIMINAR MIS DATOS") to +504 9227-4733 from the number you used with us.
- On Messenger or Instagram: send the same phrase in a message to SMART's Facebook page or Instagram account, from the account you used with us.
- Website, chat, email or anything else: email contact@smarthnd.com with the subject "Delete my data", and include the number, account name or email you used with us. If you wrote your phone number in our website chat, we can delete the chat records linked to that number.
- On this browser: click "Cookie preferences" at the bottom of the page and then "Forget this browser". Our CRM deletes all the website visit and chat records linked to your visitor ID, and the site clears what it saved in your browser.
- For requests by message or email, we confirm within 5 business days (and may ask you to confirm it's you), delete within 30 days the conversations, comments in our CRM, contact details, notes, website activity and files linked to you, ask our providers to delete what they hold for us, and send you a confirmation.
- What we may keep: (a) your number or account ID with a "do not contact" note, so we never message you again; (b) invoices, contracts and payment records the law requires us to keep (section 10); and (c) data needed to resolve an open dispute. We keep nothing else.
Switching from Accept to Reject in "Cookie preferences" also deletes the website visit and chat records linked to your visitor ID in our CRM, and the visitor ID and the tools' cookies on smarthnd.com in your browser (section 3.6).
14. Specific laws
14.1 Children
Our website, bots and services are for businesses and adults. They are not directed to children under 13, and we don't knowingly collect personal information from children under 13 (or from anyone under 18 in Honduras). If we learn that a child is messaging our assistant or has sent us information, we stop and delete it. If you believe a child has sent us information, contact us and we'll delete it.
14.2 Illinois Biometric Information Privacy Act (BIPA)
SMART does not collect, capture, store or use biometric identifiers or biometric information (such as voiceprints, fingerprints, or scans of face or hand geometry). Voice notes, photos and videos sent to us on WhatsApp, Messenger or Instagram, and profile pictures, are used only to read or listen to your message and reply, and are never used to identify you biometrically or to create a voiceprint. Session recordings capture page interactions, not your face or voice.
14.3 Data breaches (Illinois Personal Information Protection Act)
If a security breach exposes personal information covered by the Illinois Personal Information Protection Act (815 ILCS 530), such as a name together with a Social Security number, driver's license or ID number, financial account or card number with its access code, or username/email with password, we will notify affected Illinois residents in the most expedient time possible and without unreasonable delay, and notify the Illinois Attorney General when the law requires it (for example, when more than 500 Illinois residents are affected). We'll also follow the breach laws of other states where affected people live, and notify Stripe as our agreement with Stripe requires.
14.4 California and other US state privacy laws
US comprehensive state privacy laws (such as the California Consumer Privacy Act, as amended by the CPRA, and similar laws in other states) apply only to businesses above certain size thresholds, such as annual revenue over about US$26.6 million or processing data of 100,000 or more state residents (thresholds vary by state). SMART is a small business and does not believe these laws currently apply to it. Even so, we offer everyone the opt-out in section 9, honor Global Privacy Control, and honor the access, correction and deletion requests in section 13.
14.5 Honduras
As of the date of this policy, Honduras has no comprehensive personal-data-protection law in force; bills are pending in the National Congress. The Constitution of Honduras (Article 182) recognizes the right of hábeas data: every person may access information about themselves held in public or private databases and ask that it be updated, corrected or deleted. We honor that right through section 13 and the data deletion page, and will update this policy if a new law is enacted.
14.6 Visitors from the European Union, the UK and similar countries
Our services are aimed at Honduras and the United States. If you visit from a country with laws like the EU or UK General Data Protection Regulation, the legal bases in section 5 apply, optional cookies are used only with your consent, and you have the rights in section 13, plus the right to data portability and to complain to your local data protection authority.
15. Changes to this policy
We may update this policy when our services, providers or the law change. The version and "Last updated" date at the top show the current version, and we'll keep previous versions available on request. If we make an important change (for example, a new kind of data, a new AI provider, or new analytics or advertising tools), we'll post a notice on the website and, for clients and opted-in contacts, tell you by email or message before it takes effect. If a change affects cookies, we'll ask for your choice again.
16. Contact us
SMART · Diego Moradel, doing business as SMART Oak Lawn, Illinois, United States · Catacamas, Olancho, Honduras Email: contact@smarthnd.com (subject "Privacy request") · Phone / WhatsApp: +504 9227-4733 · https://smarthnd.com
Terms of Use · Data deletion · Política de privacidad (español)