Privacy Policy

In short

• Your data is yours. We do not sell it and we do not use it to train artificial intelligence models.
• To run Get we use providers (servers, email, payments, AI). The full list, and what each one receives, is below.
• Your data is stored on servers in the United States.
• Your receipts and documents are kept in private storage and only open through temporary links.
• Analytics and marketing cookies are only turned on if you accept them.
• You can access, correct, take with you or delete your data, and object to certain uses, by writing to benja@getshitdone.cl.

1. Who is responsible for your data

Ourules SpA, Chilean tax ID (RUT) 77.991.624-3, domiciled in the commune of San José de Maipo, Santiago Metropolitan Region, Chile, the operator of Get (“we”, “us”), is the controller of your account data and of your use of the Service. For anything privacy related, write to us at benja@getshitdone.cl.

This policy applies to the getshitdone.cl website, the web app and the Get mobile apps, and follows Chilean personal data protection law (Law 19.628, as amended by Law 21.719).

2. Your data and your workspace's data

It helps to tell two kinds of data apart:

• Data about your account and your use of Get: your name, email, photo and how you use the Service. We are the controller of this data.
• Data about other people that is loaded into a workspace: clients, vendors, team members, signers and document recipients. The workspace owner is the controller of this data; we only process it on their behalf to provide the Service.

If you are one of those other people and want to exercise your rights, contact whoever added you to Get. If you cannot, write to us and we will help you reach them.

3. What data we collect

Data you give us:

• Account: name, email, password (stored encrypted, never in plain text), profile photo, language and time zone. If you sign in with Google or Apple, we receive your name and email from that account.
• Professional profile: roles, website, social links and portfolio, if you fill them in.
• Work content: budgets, folders, contacts (with tax ID, line of business, address, phone and bank details, if you enter them), transactions, purchase orders, expense reports, receipts and invoices, files, boards and comments.
• Signatures: the image of your signature, drawn or typed, when you sign or save a signature in Get Sign.
• Conversations with the AI assistant, including the images, files and voice notes you send it.
• Support: the messages you send us through the help chat or by email.

Data we get from third parties when you authorize it:

• SII: tax documents issued and received (invoices, fee receipts, purchase and sales ledger), through Emisso.
• Banks: balances and transactions of the accounts you connect through Emisso, or of the statements you import.
• Payments: your subscription status, from Polar or Apple. We never receive or store your card details.

Data generated when you use Get:

• Usage: pages you visit, features you use and errors that happen.
• Device and connection: browser, operating system, IP address and the country inferred from it. We do not use your precise location.
• Mobile app permissions: camera, photos and microphone, only for the features that need them (photographing a receipt, attaching images, dictating).
• Sessions: device, IP and date of each signed-in session, which you can see and end from settings.
• Shared links: when a budget or file you shared is opened, with a hashed version of the IP and browser of whoever opens it.

4. What we use your data for, and on what legal basis

• Providing the Service (creating your account, storing and syncing your information, sending the emails you trigger, billing your plan). Legal basis: performance of the contract.
• Features you turn on (SII and bank connection, AI, signatures, document issuing). Legal basis: performance of the contract and your consent when you turn them on.
• Security, fraud prevention and audit logs. Legal basis: our legitimate interest.
• Product analytics, to understand how Get is used and improve it. Legal basis: on the web, your consent; in the mobile app, our legitimate interest, which you can object to.
• Measuring our marketing campaigns on Meta and Google Ads. Legal basis: your consent only.
• Emails about your account (welcome, free trial reminders, changes to the Service). Legal basis: performance of the contract and our legitimate interest. We do not send you newsletters without your consent.
• Meeting legal and tax obligations, and responding to authorities. Legal basis: legal obligation.

We do not make decisions with legal effects on you based solely on automated processing.

5. Artificial intelligence

When you use an AI feature (the assistant, scanning a receipt, dictating a note, importing a spreadsheet or generating an image), we send the AI provider what it needs to answer: your message, the files you attach and the workspace information the assistant looks up to handle your request.

• The models come from OpenAI and Anthropic, reached directly or through Vercel AI Gateway. TypeSafe processes rows from imported spreadsheets and expenses to suggest how to classify them.
• Under their API terms, OpenAI and Anthropic do not train their models on the data we send them. They may keep it for a limited time (usually up to 30 days) to prevent abuse.
• We keep a log of every AI call (what was sent and what came back) in Braintrust, to evaluate and improve the assistant's quality. That log is not used to train models.
• Your conversations are saved in your account so you can pick them up again. You can delete them at any time, and when you do we also delete their attachments.
• You can use Get without using any AI feature.

6. Who we share your data with

We do not sell or rent your data. We only share it with the providers we need to run Get, who act as processors and only access what their function requires:

• Supabase: database, sign-in and file storage.
• Vercel: app hosting, aggregated cookieless web analytics and access to AI models (AI Gateway).
• Cloudflare (R2): storage for board files, assistant attachments and Transfer.
• OpenAI, Anthropic and TypeSafe: AI features.
• Braintrust: quality logs for AI features.
• Emisso: SII and bank connection, and tax document issuing.
• Polar and Apple: subscription billing. RevenueCat: mobile app subscription management.
• Resend: sending emails (notifications, shared budgets, purchase orders, signature requests, access codes).
• PostHog: product analytics and error tracking.
• Featurebase: support chat and feedback portal. It receives your name, email and photo to identify you.
• Expo: push notifications to the mobile app.
• Brandfetch: identifies the merchant behind a bank transaction to show its logo. It receives the transaction description, not your personal data.
• Google and Apple: sign-in, if you choose to sign in with them.
• Meta and Google Ads: measuring our campaigns, only if you accept analytics and marketing cookies. When you sign up, Meta receives your email in hashed form.

We also share data when an authority lawfully requires it, to protect rights or people's safety, or in a merger or sale of the company, which we would tell you about first.

And, of course, when you decide to: by sharing a link, sending a budget, a purchase order or a signature request, or connecting an external assistant through MCP.

7. Where your data is stored

Our database is in the United States (AWS region us-east-1, through Supabase), and most of our providers also operate there. So when you use Get, your data is transferred outside Chile. We work with providers that commit, in their data processing terms, to appropriate security and confidentiality measures.

8. Security

• Encryption in transit (TLS) and at rest.
• Isolation between workspaces with row-level security: each query only sees data from the workspaces you belong to.
• Configurable role-based permissions inside each workspace.
• Automatic database backups.
• Your SII and bank passwords never pass through our servers: they are entered directly on Emisso's page.

Your receipts, invoices, other documents and the images you send the assistant are kept in private storage. They only open through temporary links that Get generates for people with access, which expire within one or two days. If you share one of those links, whoever receives it can open the file until it expires.

Board images are served through unique, hard-to-guess links: anyone who gets one can open that image, so only share them with the people who should see it.

No measure is foolproof. If a breach affects your data, we will notify you and Chile's Personal Data Protection Agency, as the law requires.

9. Cookies

We use cookies and your browser's local storage. Essential ones make Get work. Analytics and marketing ones are only turned on if you accept them in the cookie notice, and you can change your mind at any time. No ads inside Get.

Vercel Analytics also measures visits in aggregate and without cookies, and your browser keeps a copy of your workspace data so it loads faster, along with the accounts you have signed in on it.

The mobile app does not use cookies, but it sends usage analytics to PostHog. You can object by writing to us.

10. How long we keep your data

• While your account exists, we keep your data to provide the Service.
• What you move to the trash can be restored for 30 days. After that it is permanently deleted.
• When you delete your account, we immediately delete your profile and the workspaces you own, with all their content. Their files, your profile photo and the attachments of your conversations with the assistant are deleted from our storage within the following 24 hours. What you created in other people's workspaces, including the files you uploaded, stays there, but is no longer linked to your name.
• Copies in backups are deleted in regular rotation cycles, within 90 days at most.
• Polar and Apple keep records of your payments according to their own legal obligations.
• We may keep aggregated, anonymous data that no longer identifies you, for statistics.

11. Your rights

Under Chilean law, you have the right to:

• Access: know what data we hold about you and get a copy.
• Rectification: correct inaccurate or incomplete data. You can edit almost everything yourself in Get.
• Erasure: ask us to delete your data. You can also delete your account yourself from settings.
• Objection: object to uses based on our legitimate interest, such as analytics in the mobile app.
• Portability: receive your data in a structured, commonly used format. You can already export budgets (PDF and Excel) and transactions; for everything else, write to us.
• Blocking: ask us to temporarily suspend processing while a request is resolved.
• Withdraw your consent at any time (for example, by turning off analytics and marketing cookies), without affecting what was done before.

To exercise them, write to benja@getshitdone.cl from your account email. We reply within 30 calendar days. If you are not satisfied with our answer, you can file a complaint with Chile's Personal Data Protection Agency.

12. Minors

Get is for people aged 18 and over. We do not knowingly collect data from minors. If we detect an account belonging to a minor, we will delete it.

13. Changes to this policy

If we change this policy in a significant way, we will notify you by email or inside Get before the change applies. The date of the latest version appears at the top of this page.

14. Contact

Ourules SpA · RUT 77.991.624-3 · benja@getshitdone.cl