Privacy Policy

Last updated: October 2026

At iMLabs we take the protection of your personal data seriously. This policy explains what information we collect, how we use it, and how we protect it, both on our website and in our iMBilling platform.

Who we are

iMLabs SpA is the company responsible for processing the personal data collected through our website (imlabs.cl) and through iMBilling, our business management platform that includes electronic invoicing. For any privacy inquiry, you can reach us using the contact details at the bottom of this page.

Information we collect

We collect only the data necessary to provide our services:

Contact data

Name, email address, phone number, company name, and position when you complete our contact or consultation forms.

Account and business data (iMBilling)

Account identification data, access credentials (passwords are stored securely, never in plain text), and the business information you manage in the platform. You remain the owner of your data and documents.

Usage and technical data

Information about how you interact with our services, access logs, and technical data such as IP address and browser type, used for security and service improvement.

Connecting with Google (Gmail API)

iMBilling offers an optional feature to send your documents from your own Gmail or Google Workspace account through the Gmail API. This feature is only enabled if you authorize the connection and can be disabled at any time; you can also keep using traditional email sending.

Permission requested: sending email only, plus the basic data needed to identify the connected account.
What we do: send, only at your request, the emails you originate in the platform (for example, sending a document to your recipient or a test email).
What we do NOT do: we do not read, import, index, or store the contents of your mailbox. The send permission grants no read access to your email, contacts, calendar, or files.
What we store: an authorization token and the address of the connected account, both protected with encryption. We never store your Google password.
Revocation: you can disconnect your account at any time from the iMBilling settings or from your Google account permissions page.

Limited Use of Google data

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, this data is used exclusively to provide the email-sending feature you requested; it is not transferred to third parties except as necessary to provide the service, to comply with the law, or with your consent; it is not used for advertising; and it is not made available to people to read.

iMLabs’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Digital marketing management service (iMlabs Ads and Google data)

This service is optional and applies only to clients who hire iMLabs to manage their advertising, analytics or search engine optimization. If you have not hired that service, iMLabs does not access any of your Google accounts and this section does not apply to you.

What it is. iMlabs Ads is an internal tool of iMLabs SpA. It is not sold, not licensed and not available to the public: it is used only by the iMLabs team to deliver the contracted service. It connects to Google APIs with an iMLabs Google account, to which each client voluntarily grants access from their own accounts (for example, by adding iMLabs as a user or by linking their Google Ads account to the iMLabs manager account).

Which Google data we use and why

Google service	Permission requested	What we use it for
Google Ads	Google Ads management (adwords)	Read campaign, keyword and search term performance, and apply the management changes (keywords, negatives, ads, budgets) the client contracted. Every change is reviewed and approved by an iMLabs team member before it is applied.
Google Analytics	Read-only (analytics.readonly)	Read sessions, landing pages and key events to measure results.
Google Search Console	Read-only (webmasters.readonly)	Read queries, pages, clicks and positions in organic search.
Google Tag Manager	Read, edit and publish containers	Audit and fix measurement (tags, triggers, consent) on the client’s site. Changes are prepared in a workspace and published only with human approval.
Google Account	Email address (userinfo.email)	Identify which Google account is connected.

What we do not do with Google data

We do not sell, rent or transfer it to third parties for advertising, data brokerage or resale.
We do not use it to serve personalized advertising or for any purpose other than the contracted service.
We do not combine one client’s data with another’s or show it to other clients.
We do not use it to train general-purpose or third-party artificial intelligence models.
No person reads the data except the iMLabs team delivering the service, or when the client authorizes it, for security reasons or to comply with the law.

Use of AI assistants. To analyze the data, the iMLabs team may use artificial intelligence assistants that process the information as data processors, under commercial terms that prohibit them from using it to train their models. The AI does not apply changes on its own: every modification to a client account requires human approval.

Aggregate, not personal, data. The Google Ads, Analytics and Search Console reports we use are aggregate metrics (by campaign, page, query or day). We do not collect personal data about visitors to the client’s site through these APIs.

Storage, security and retention. Data is stored on servers controlled by iMLabs, with access restricted to the team and encrypted connections; Google credentials are stored securely and we never store passwords. We keep the metrics history for as long as the service lasts (typically the last 6 months of daily data). When the service ends, we delete that client’s data within 30 days, unless required by law.

How to revoke access. The client can withdraw access at any time without going through us: by removing iMLabs as a user of their Google Ads, Analytics, Search Console or Tag Manager account, or by unlinking their Google Ads account from our manager account. They can also request deletion by writing to contacto@imlabs.cl. iMLabs can revoke its own connection at https://myaccount.google.com/permissions.

Limited Use

iMLabs’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Email campaign recipients

This section applies to people who receive campaign emails that an iMBilling customer sends through our platform.

Who is responsible. The business sending the campaign is the controller of its contacts’ data and is responsible for having their consent. iMLabs acts as a processor: it processes that data only to send the emails the business requests.
What we use. Your email address and, if the business provides it, your name. To measure the campaign we record deliveries, bounces, complaints, opens, clicks and unsubscribes. For opens and clicks we keep only the browser or email client (user agent) and the approximate country. We do not store your IP address. The business can turn open tracking off.
Legal basis. Your consent, given to the business that emails you, under Chilean Law 19.628 and Law 21.719 on personal data protection.
How to unsubscribe. Every email includes an unsubscribe link. It takes effect immediately, and that business can no longer send you campaigns through our platform. Your email client may also show an "unsubscribe" button, which works the same way.
Bounces and complaints. If an email bounces permanently or you mark it as spam, your address is excluded from that business’s future sends.
Security. Addresses and names are stored encrypted. Links in our emails are signed and do not expose your address.
Sending provider. Emails are sent through Amazon Simple Email Service (Amazon Web Services, us-east-1 region, United States). Amazon processes the address and message only to deliver it.
Retention. Addresses and names attached to sends and metrics are deleted after 13 months. Exclusions (unsubscribes, bounces, complaints) are kept as long as needed so you are not emailed again. If you request erasure, they are reduced to an irreversible identifier that cannot be turned back into your address.
Your rights. To access, correct, delete or object, write to the business that emailed you, or to contacto@imlabs.cl, and we will help.

How we use your information

Provide and maintain our services, including issuing and sending documents in iMBilling
Authenticate users and protect accounts
Improve and personalize your experience with our services
Communicate with you about inquiries and service updates
Comply with legal, tax, and regulatory obligations

Who we share information with

We do not sell or rent your personal data. We only share it when necessary to operate the service:

Tax authorities (SII) when it relates to issuing electronic documents
Google, only when you enable the Gmail connection, to send the emails you originate
Google (Google Ads, Analytics, Search Console and Tag Manager), only for clients of the digital marketing management service, to read their data and apply the changes they approve
Artificial intelligence providers acting as data processors, with no right to use the data to train their models
Amazon Web Services (Amazon SES), to send the campaign emails that iMBilling customers request
Google (Google Analytics, Google Tag Manager and reCAPTCHA), to measure site usage when you accept it in the cookie notice and to protect forms against spam
Infrastructure and technology providers that help us operate the platform, under confidentiality obligations
Competent authorities when required by law

Data retention

We retain data only for as long as necessary to fulfill the purposes described or as required by law. Tax documents are retained for the applicable legal periods. The Google connection token is deleted or invalidated when you disconnect the account.

Client marketing data (Google Ads, Analytics, Search Console): kept for as long as the service lasts and deleted within 30 days after it ends, unless required by law.

Security

We apply reasonable security measures aligned with industry best practices:

Encryption of data in transit (HTTPS) and of sensitive data at rest
Access controls and isolation of information between users
Security monitoring and anti-abuse mechanisms
Secure storage of passwords and credentials
No system is completely infallible; we work to keep these measures up to date

Our infrastructure is hosted on Google Cloud Platform and iMLabs’ own datacenter, with information-security management practices that are ISO 27001 ready.

Your rights

Under Chilean data protection law (Law No. 19.628 and its modernization through Law No. 21.719), you may exercise the following rights over your personal data:

Access your personal data
Rectify inaccurate information
Request deletion (erasure) of your data
Object to the processing of your data
Request data portability where applicable

To exercise these rights, contact us using the details at the bottom of this page. We will respond within the legal timeframes.

International transfers

Some providers may process data outside Chile. In those cases we require adequate safeguards and ensure the processing complies with this policy and applicable law.

Minors

Our services are intended for businesses and professionals. They are not directed at minors, and we do not knowingly collect their data.

Changes to this policy

We may update this policy. We will post the current version on this page with its update date.

Contact

For questions about these terms or about privacy, contact us at:

Email: contacto@imlabs.cl

Location: Santiago, Chile