Urpi Terms and Conditions

Last updated: November 6, 2026

This is a translation for convenience. The Spanish version at urpi.app/terms is the legally binding one.

These terms are the contract between Urpi and the business that uses it. They include Annex 1 (data processing agreement) and Annex 2 (model notice for clients).

1. Who provides the service

Urpi is a service of Fernando Ismael Beltrán Martínez, domiciled in Ambato, Ecuador. His RUC (tax ID), full legal address and phone number are provided on signing up, and to any data subject who requests them at [email protected]. Email: [email protected].

In these terms, "the Business" is the company or person contracting Urpi. "Clients" are the people who write to the Business on WhatsApp. "Members" are the people of the Business who use the app.

2. What Urpi is

Urpi is an electronic messaging and customer service platform. It lets the Business connect its own WhatsApp number through Meta's Embedded Signup, receive and store its Clients' messages, reply from the app, and use AI agents to serve them.

Urpi is not a general-purpose AI assistant and does not resell the WhatsApp platform. It is an independent product: Meta and WhatsApp do not sponsor or endorse it. The service does not give access to emergency services.

3. Acceptance

To contract, the Business must read these terms, tick the acceptance box, which appears unticked, and confirm with the corresponding button. Browsing the site, opening a message or continuing to use the app is not acceptance.

Urpi keeps as evidence the accepted version, the date and time, the account, and the IP or device data. The Business can download and print these terms. The contract is deemed concluded in Ambato, Ecuador.

Whoever accepts declares they can bind the Business.

The Business agrees to receive the contract's documents and notices electronically. It can ask for a paper copy at [email protected], free of charge, and can withdraw this acceptance through the same email. If it does, notices will be sent on paper to its address, as far as the service allows.

4. Business use

By accepting, the Business declares that it contracts Urpi for its economic activity and to serve its own clients, not as a final consumer. It must give its RUC or, if it has none, explain its activity.

If this declaration does not reflect its situation, section 22 applies.

5. Technical requirements

Using Urpi requires an internet connection, an up-to-date web browser, an active email address, a phone number suitable for WhatsApp Business, and a Meta account with permissions over the Business's business portfolio. If a technical change endangers access to its records, Urpi will notify it and the Business can leave at no cost.

6. Accounts and credentials

The Business is responsible for what happens in its accounts, must protect its credentials, and must notify Urpi immediately if it suspects improper access. It may only give access to authorized Members.

7. Subscription and price

Urpi is contracted by subscription, under the plan the Business chooses when contracting, with the price and limits shown at that time. The plan gives the right to use Urpi with the functions and limits shown when contracting. The price is stated in United States dollars and shows the final amount with taxes before contracting. It is paid for the period the plan states.

Urpi has no payment gateway, does not process payments in the app and does not store card data. The Business pays the subscription through the means shown when contracting.

Nor does Urpi charge, invoice or process payments to the Business's Clients. What the Business sells, charges or invoices to its Clients is the Business's sole responsibility.

For each subscription payment, Urpi issues the electronic receipt the SRI (Ecuador's tax authority) requires, with the data the Business provides. The Business is responsible for the accuracy of that data. If a refund is due and the receipt can no longer be cancelled, it will be made with a credit note.

8. Payments to Meta

Urpi only charges for its own services. Use of the WhatsApp API is billed by Meta directly to the Business.

The Business must add its own payment method in WhatsApp Manager, Meta's tool. Without that step, the Business is not fully enabled. Urpi gives no credit, does not advance payments to Meta, and is not responsible for Meta's charges.

9. The Business's obligations on WhatsApp

In addition to these terms, the Business accepts and must comply with Meta's terms for the WhatsApp Business Platform, the WhatsApp Business Messaging Policy, the Messaging Guidelines, WhatsApp's Brand Guidelines and Intellectual Property Policy, and the Meta Platform Terms as they apply to it. The Business alone is responsible for determining its own legal obligations.

9.1 Permission to contact (opt-in)

The Business may only contact a person on WhatsApp if that person gave it their number and it has their permission to receive messages. The permission must state clearly that the person agrees to receive communications, and the Business's name.

For commercial or advertising messages, the Business must have prior, express and specific authorization, not a generic one, and keep proof for at least one year. Whoever sends is responsible, even if using a third party such as Urpi.

The Business decides how to obtain that permission and is responsible for it.

9.2 Opt-out

The Business must immediately honor any request from a person, on or off WhatsApp, to block it, stop receiving messages or unsubscribe, and must remove them from its contacts. Opting out must be as easy as opting in. Urpi does not currently apply opt-outs automatically: the Business must handle them.

9.3 Templates and the 24-hour window

The Business may only start conversations with an approved template. Outside templates, it may only reply within the 24-hour customer service window.

9.4 Automation and handing over to a person

The Business may use AI agents within the 24-hour window, but must always have available a quick, clear and direct way to talk to a person. This can be a handover to a human agent in the chat, a phone number, an email, web support, in-store service or a form. The Business must attend to that route.

9.5 Profile, notices and privacy policy

The Business must:

• keep a WhatsApp Business profile with customer service details and at least an email, website or phone number;
• not impersonate anyone;
• have its own privacy policy published, by its own means or with the model in section 9.7, and give all notices and obtain all permissions the law requires;
• have a valid legal basis to process its Clients' data;
• provide its own sales terms and be responsible for its transactions and taxes.

Acceptance of these terms is not consent from the Clients.

9.6 Sensitive data

The Business must not ask for or share full card numbers, financial accounts, identity documents or other sensitive identifiers. It must not send health information or other regulated data to the platform where rules forbid it or require special protections. If it may receive sensitive data, it must obtain the explicit consent the law requires.

If it serves minors, it must take the additional measures the law requires.

9.7 Privacy policy model

If the Business has no privacy policy or website, Urpi offers a model text and a page to publish it. It is an optional tool at no additional cost. The Business can use a link to its own policy instead.

The policy belongs to the Business, not to Urpi. By confirming it, the Business:

• adopts the text as its own, after reading it and adapting it to what it really does;
• declares the text is true and is responsible for its content;
• remains the one who decides what it uses its Clients' data for.

The model covers the common case of serving clients on WhatsApp. Urpi does not decide the Business's purposes, does not review its case and gives no legal advice. It does not guarantee that the model is enough for a specific business. The Business must adapt it or seek advice if it processes health data or other sensitive data, mainly serves minors, or uses the data for other purposes, such as marketing campaigns.

The Business must keep its policy up to date. Urpi keeps the confirmed version, the date and time, and who confirmed it. Urpi only hosts the page, on the Business's instructions, and may remove it when the contract ends.

Automatic replies with AI agents are only activated once the Business has confirmed the model or given the link to its own policy.

10. Prohibited activities

The Business may not use Urpi to sell, promote or deal in:

• firearms;
• alcohol and tobacco;
• drugs;
• medical and healthcare products;
• endangered species, and live animals other than livestock;
• hazardous goods;
• real, virtual or fake currency, including initial coin offerings and binary options;
• body parts or fluids;
• fraudulent or deceptive business models;
• real money gambling and gaming;
• adult products and services;
• dating services;
• multi-level marketing;
• payday loans, paycheck advances, peer-to-peer lending, debt collection and bail bonds.

These prohibitions apply even if the Business has licenses or permits. Exceptions Meta allows by country only apply if Meta allows them for that country and the Business meets their conditions.

Nor may Urpi be used by parties, politicians, candidates, campaigns, law enforcement, military forces, security or intelligence agencies, or their political service providers. Government entities and news media must follow Meta's specific rules.

Using Urpi for criminal activities, unfair discrimination, or sexually explicit material or nudity is prohibited.

11. Proper use of data

The Business may not process data obtained through the platform in a way contrary to Meta's terms. In particular, it may not:

• sell, license, share or distribute that data, or its anonymous, aggregated or derived forms;
• use a person's data, except chat content, for any purpose other than supporting messaging with that person;
• create or expand profiles of people, except with chat content, where the law allows;
• re-identify anonymous data;
• forward or share information from one client's chat with another client;
• use that data to create, train or improve AI models, or let third parties do so;
• copy platform data by automated means;
• resell, rent or distribute the platform, or use Urpi to give third parties a similar API service.

12. Artificial intelligence

Control and responsibility. The Business configures and controls its AI agents and must review that configuration. Between Urpi and the Business, what those agents say, offer or agree with Clients is attributed to the Business.

Notice to Clients. The Business must tell its Clients clearly that their data is processed through AI, for what purposes, and that the processing is automated. It must do so in the first automated reply or before. It can use the text in Annex 2. It may not present an agent as if it were a person.

Automated decisions. The Business may not use AI agents for decisions with legal effects or affecting a person's rights, unless it gives them a way to ask for an explanation, give their opinion and challenge it. No contract can oblige the person to waive that right in advance.

Use of agents. The Business may only use AI agents to serve its Clients about its own business, not to offer a general-purpose AI assistant.

Accuracy. AI replies may contain errors. The Business must supervise them.

Training. Urpi does not use WhatsApp messages, nor anonymized, aggregated or derived versions of them, to train, fine-tune or improve AI models, and does not authorize its AI providers to do so.

13. Meta's powers

Meta may limit, suspend or end the access of the Business or of Urpi to its services if it considers its terms were breached, and may require the Business to accept additional terms. Meta may also evaluate the Business's permission mechanisms.

If Meta asks, Urpi will immediately cut the Business's access to the platform, and this is not a breach by Urpi. Urpi may give Meta the list of businesses with their contact details, and the data its terms require.

The Business must notify Urpi immediately if it learns of a breach of Meta's terms or receives a notice from Meta. If Meta restricts the account because of the Business's acts, Urpi is not responsible for the consequences.

14. Content and intellectual property

The content of the Business and its Clients remains theirs. The Business is responsible for that content and declares it has the rights and legal basis to use it. It authorizes Urpi to process it only to provide the service.

Urpi, its software and its brand belong to its owner, identified in section 1. These terms only give the Business a limited right of use while the contract is in force. The Business must respect the WhatsApp and Meta trademarks and may not present itself as associated with or endorsed by them.

15. Personal data

For Clients' messages and data, the Business is the controller and Urpi the processor. Annex 1 applies.

For Member accounts and billing, Urpi is the controller. The privacy policy applies.

16. Availability and copies

Urpi will use reasonable diligence to keep the service available, but it depends on third parties such as Meta and its providers, and may have interruptions.

Neither Meta nor Urpi offers an archiving service. The Business must keep its own copies of what it needs to retain.

17. Suspension and termination

The Business can end the contract at any time, without penalty, by notice to [email protected]. It will only pay for services provided. It can also disconnect its number from the app or remove Urpi at Meta.

Urpi may suspend or end the service:

• if the Business breaches these terms or Meta's terms;
• if the Business does not pay the subscription;
• if Meta requires it or withdraws access;
• if the law or an authority requires it;
• if necessary to protect people or the security of the service.

If possible, Urpi will warn first and give time to correct. Without cause, Urpi may end the contract with 30 days' prior notice and will refund what was paid for unused time.

18. What happens on termination

Urpi marks the Business as deleted, disconnects its number and deletes the token and PIN. After 30 days, it permanently deletes its clients and messages. Before that period ends, the Business can ask for a copy of its data. Details are in Annex 1 and at urpi.app/en/data-deletion.

19. What Urpi does not guarantee

Urpi provides the service diligently, but does not guarantee that it will be uninterrupted, that AI replies will be accurate, or specific commercial results. Nor does it guarantee that Meta will approve templates or keep the Business's access.

20. Limit of liability

Except as stated in this section, Urpi's total liability to the Business under this contract is limited to what the Business paid Urpi in the 12 months before the event that caused the damage, and only for direct and foreseeable damages.

This limit and the exclusions in these terms do not apply in case of fraud (dolo) or gross negligence (culpa grave) by Urpi, nor to the rights of data subjects, nor to what the law does not allow to be limited. They do not apply to people who are not party to this contract either.

21. Indemnity

The Business will hold Urpi harmless from third-party claims, sanctions and costs arising from its content, its AI agents, its messages, or its breach of these terms, the law or Meta's terms. This does not cover what is due to fraud or gross negligence by Urpi.

22. If you are a consumer

If you use Urpi as a final user and not for an economic activity, or if the law recognizes you as a consumer, these rules apply where more favorable, and prevail over the rest of these terms:

• you keep all rights under Ecuador's Ley Orgánica de Defensa del Consumidor, which cannot be waived;
• sections 19 and 20 do not apply insofar as they limit Urpi's liability for defects in the service;
• you can end the contract at any time with 15 days' written notice before the end of the current period, without penalties or surcharges, and you pay only for what was provided;
• you can exercise the right of return for online purchases, within the legal period, with immediate termination of the contract;
• Urpi can only suspend or end the service for your breach, when the law or an authority requires it, or when Meta withdraws access to its platform;
• Urpi will not change the price or conditions without your acceptance;
• the judges of your domicile have jurisdiction.

23. Changes to these terms

Urpi will give notice of any change 30 days in advance, by email or in the app. If the Business disagrees, it can end the contract without penalty before the change takes effect, and Urpi will refund what was paid for unused time. Important changes require new acceptance.

Urpi may apply changes required by the law or Meta earlier, and will give notice as soon as possible.

24. Governing law and jurisdiction

This contract is governed by the laws of the Republic of Ecuador. Any dispute will be resolved before the competent judges of Ambato, Ecuador, except as stated in section 22. The parties may go to mediation by mutual agreement.

25. Contact and security

For support, privacy, problems or security vulnerability reports, write to [email protected].

Annex 1. Data processing agreement

This annex is the contract between the Business, as controller, and Urpi, as processor, required by Ecuador's Ley Orgánica de Protección de Datos Personales.

1. Object and purpose

Urpi processes personal data on behalf of the Business to receive, store, show and reply to its Clients' WhatsApp messages, also with AI agents.

2. Duration

It lasts while the contract is in force and until Urpi finishes deleting or returning the data.

3. Nature of the processing

Reception, storage, consultation, automated processing with AI, sending, recording of delivery and reading, and deletion.

4. Data subjects and data categories

• Data subjects: the Business's Clients and, for the messages they write, the Business's Members.
• Data: phone number; WhatsApp profile name; message text; identifiers, date and time; delivery status and read marks; AI system inputs and outputs. Messages may contain anything the person writes, including sensitive data.

5. Instructions

Urpi processes the data only on the documented instructions of the Business. These terms, the settings the Business makes in the app and its written requests are those instructions. If Urpi believes an instruction is illegal, it will tell the Business.

The Business permanently instructs Urpi to delete the data of a data subject who requests it directly from Urpi or through Meta, within 10 working days, even if the Business does not reply. The only exception is what the Business states in writing, within that period, that a law requires it to keep.

6. Urpi's obligations

Urpi undertakes to:

1. not use the data for purposes other than those of this annex, nor for its own purposes;
2. not transfer or communicate the data to third parties, even for storage, except to the sub-processors of clause 8 or when the law requires it;
3. keep each Business's data separate from that of other businesses;
4. have security measures before starting to process the data and maintain them, including storing the token and PIN encrypted;
5. require confidentiality from those who access the data;
6. notify the Business by email of any security breach, as soon as possible and within 2 working days of learning of it, with the available information;
7. forward to the Business within 2 working days any rights request it receives, and tell it immediately if Meta communicates a data subject's request;
8. help the Business reply to those requests;
9. suspend processing within 3 working days of the Business's request;
10. carry out deletion of a data subject within 3 working days of the Business's instruction, and give it proof;
11. give the Business enough information on how the AI systems work, their limits, risks and controls, and support it in its impact assessments;
12. keep the records the law requires and let the Business, on request, review its records and audit compliance with this annex.

The commitment on model training in section 12 also applies to this processing.

7. The Business's obligations

The Business undertakes to:

1. have a valid legal basis and give its Clients the information the law requires, including on AI;
2. reply to rights requests within 10 working days, and within 3 working days for suspension and revocation of consent, counted from when the Business or Urpi receives them;
3. give Urpi instructions in time to meet those deadlines;
4. set the message retention period, if different from 24 months from the Client's last message;
5. notify the Authority and data subjects of breaches, when applicable;
6. meet its own duties as controller, including those on data protection officers and records that apply to it.

8. Sub-processors

The Business expressly authorizes Urpi to use these sub-processors:

• cloud hosting providers;
• artificial intelligence providers.

They may be outside Ecuador. Urpi keeps an up-to-date list of them, with their country, and gives it to the Business on request. The Business must treat it as confidential information. Urpi will give 30 days' notice of any change of sub-processor. If the Business disagrees, it can end the contract. Urpi is liable to the Business for the sub-processors it hires.

Meta is not a sub-processor of Urpi: it provides the WhatsApp API to the Business under Meta's terms.

9. End of processing

On termination, Urpi applies section 18 of these terms. It deletes the data, or returns it if the Business asks before the period ends, under the supervision of the Authority where applicable, and gives proof of deletion. It only keeps, blocked, what the law requires it to retain.

Permanent deletion includes clients and messages. The WhatsApp account row stays as history, without token or PIN.

10. Retention

Messages are kept for 24 months from the Client's last message or for the period the Business sets.

Annex 2. Model notice for Clients

The Business can use this text in its first automated reply and adapt it to its case. The link can be the page from section 9.7. The notice is sent to Clients in their language; in Spanish it reads:

Hola, le atiende un asistente de inteligencia artificial de [NOMBRE DEL NEGOCIO]. Sus mensajes se tratan de forma automatizada para responderle. Si prefiere hablar con una persona: [VÍA PARA HABLAR CON UNA PERSONA]. Política de privacidad: [ENLACE A LA POLÍTICA DEL NEGOCIO]. Urpi procesa estos mensajes por cuenta nuestra: https://urpi.app/privacy

In English:

Hello, you are being served by an artificial intelligence assistant of [BUSINESS NAME]. Your messages are processed automatically to reply to you. If you prefer to talk to a person: [WAY TO REACH A PERSON]. Privacy policy: [LINK TO THE BUSINESS'S POLICY]. Urpi processes these messages on our behalf: https://urpi.app/en/privacy