Mekovault

Privacy Policy

Translation for reference. The Spanish version is the binding one.

Effective: 2026

1. Controller

Mekovault SpA, domiciled in Santiago, Chile, is responsible for the processing of personal data of website users and platform customers.

2. Data we process

  • Contact data: first name, last name, corporate email.
  • Organization data: name, slug, time zone, country.
  • Usage data: actions performed on the portal (for the immutable audit log), IP addresses, user-agent.
  • Connected directory data: the information the Customer manages through Mekovault (users, groups, roles), where we act as data processors.

3. Purposes

  • Providing the contracted service.
  • Complying with legal and billing obligations.
  • Internal and external auditing.
  • Transactional and service communications.

4. Legal basis

The main legal basis is the performance of the agreement with the Customer and compliance with applicable legal obligations.

5. Disclosure to third parties

We share data only with the sub-processors required to operate the service. See Sub-processors.

6. International transfers

Mekovault鈥檚 infrastructure is hosted in data centers located in the Americas. Customer data is not transferred to third countries without equivalent contractual clauses.

7. Retention

  • Tenant audit log: 18 months.
  • Platform audit log: 5 years.
  • Suspended accounts: 90 days before complete purge.

8. Data subject rights

In compliance with Ley 21.719 (Chile) (Personal Data Protection) and the General Data Protection Regulation (GDPR), data subjects may exercise the following rights:

  • Access: request a copy of the personal data we process.
  • Rectification: correct inaccurate or incomplete data.
  • Cancellation / Erasure (right to erasure): request the deletion of your personal data from our systems and from our sub-processors.
  • Objection: object to the processing on legitimate grounds.
  • Portability: receive your data in a structured, commonly used format.

How to exercise them: write to privacidad@mekovault.com or use your organization鈥檚 portal at app.mekovault.com/<tenant>/privacy. If you are an external person (you do not have a Mekovault account) you may also write to the email address above.

Response time: in accordance with Ley 21.719, we handle every request within 25 business days of receipt. In cases of exceptional complexity we may extend the period by another 25 days, notifying the data subject.

Documented exceptions: some data must be preserved due to legal obligations (tax invoicing, audit logs of administrative actions, backups with object lock for ransomware protection). In those cases we anonymize identifying data within 90 days of the request and delete it completely once the minimum legal retention period expires.

9. Security

We implement encryption in transit (TLS 1.3), multi-tenant isolation with Row-Level Security in PostgreSQL, and a dedicated vault per tenant (Infisical). Secrets never leave the vault in plain text.

10. Contact

Data Protection Officer: privacidad@mekovault.com.