Privacy Policy

Sherom is a service operated by Rommel Alexander Valdiviezo Quimbiamba, RUC (tax ID) 1752416907001, based in Quito, Ecuador.

• For each workshop's account data (owner and team), Sherom is the data controller.
• For the data each workshop records about its customers and their vehicles, the workshop is the controller and Sherom acts as data processor, under Ecuador's Organic Law on Personal Data Protection.

• Workshop account: workshop name, city, name, email and phone of the owner and the mechanics they invite, and the password stored hashed (never in plain text).
• Workshop customers: name, phone and, if the workshop records them, email, ID or RUC and address for invoicing.
• Vehicles and jobs: plate, make, model, year and mileage; work orders, tasks, parts, quotes, vehicle photos, signed intake checklist, warranties and recorded payments.
• Electronic invoicing: the workshop's RUC and tax details, and its electronic signature (.p12) and password, stored encrypted and used only to sign that workshop's own invoices.
• Messages: a log of the WhatsApp notices sent to customers (which number, which kind of notice and whether it was delivered).
• Technical data: server logs needed to run and secure the system. We use no advertising cookies or tracking tools; the browser only keeps the signed-in session.

• Providing the service: managing work orders, quotes, inventory, payments and each vehicle's history.
• Sending the workshop's customers the notices the workshop has turned on (order received, quote, vehicle ready, warranty, maintenance reminders).
• Issuing the workshop's electronic invoices and sending them to the SRI (Ecuador's tax authority).
• AI suggestions the workshop asks for (quick diagnosis, reading photos or voice notes, filling in the profile).
• Security, support and account notices such as password recovery.

We don't sell data or use it for advertising. We only share it with providers that process data on our behalf, and only what each feature needs:

• Vercel (hosting and photo storage) and Neon (database).
• Kapso and Meta (WhatsApp messaging).
• OpenAI (the AI features the workshop uses).
• Resend (emails such as password recovery).
• Google (finding the workshop on Google Maps during signup).
• Payphone (payment links, on each workshop's own account).
• The SRI, which receives electronic invoices as required by law.

Some of these providers have servers outside Ecuador, mainly in the United States.

When a customer sends a transfer receipt to the business's WhatsApp, we read it with AI to record the payment: amount, date, payer name, banks, destination account and receipt number. We keep the receipt so the business can review it.

If the business turns on automatic confirmation with its bank, it forwards its bank's "transfer received" alerts to Sherom. This is optional and requires its express authorization. From each alert we keep only the amount, date, payer, reference and bank; the email itself is not stored, and any email that is not an incoming-transfer alert is discarded on arrival. We never ask for bank passwords. The business can turn it off at any time and the stored alerts are deleted.

While the workshop's account is active. If a workshop closes its account, we delete its data within 30 days, except what the law requires us to keep, such as electronic invoices. More on the data deletion page.

All traffic is encrypted (HTTPS). Passwords are hashed, and the electronic signature and payment tokens carry additional encryption. Each workshop can only see its own data, and the links customers receive (quote, tracking, warranty) are unique and kept out of search engines.

You can request access to, correction, deletion, objection to or portability of your data.

• If you are a workshop, write to sherom.ai.contact@gmail.com.
• If you are a workshop's customer, ask the workshop first, since it controls your data. You can also write to us and we will pass the request on.

We reply within 15 days.

Sherom is a service for businesses and is not aimed at anyone under 18.

If we change this policy in a significant way we will announce it inside the system. For any question write to sherom.ai.contact@gmail.com. The Spanish version of this policy prevails.