Privacy Policy

Last updated: October 6, 2026

Ver en Español

1. Introduction

Heruismo LLC ("Company", "we", "us", or "our") operates the Tellen platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

By using the Service, you consent to the practices described in this Privacy Policy.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Name, email address, and password when you create an account, or information provided through Google OAuth authentication.
  • Business Information: RUC (tax identification number), business legal name (razón social), trade name, address, and other business details required for SRI compliance.
  • Contact Information: Names, identification numbers, email addresses, and phone numbers of your customers and suppliers.
  • Product Information: Product names, descriptions, prices, and tax configurations.
  • Invoice Data: All information contained in electronic invoices, including line items, amounts, taxes, and SRI access keys.
  • Digital Certificates: PKCS#12 certificates and associated passwords required for signing documents with the SRI.
  • Assistant Conversations: Messages you send to Tellen AI and the actions it proposes or performs on your behalf.

2.2 Information Collected Automatically

  • Usage Data: Pages visited, features used, and actions taken within the Service.
  • Device Information: Browser type, operating system, and device identifiers.
  • Log Data: IP addresses, access times, and referring URLs.
  • Cookies: Session cookies necessary for authentication and Service functionality.
  • Integration Data: Information about the API tokens and connected apps you authorize (such as the app name, device, and date and IP address of last use).

3. How We Use Your Information

We use the collected information to:

  • Provide, maintain, and improve the Service.
  • Generate and submit electronic documents to the SRI on your behalf.
  • Authenticate your identity and manage your account.
  • Process requests made through the Tellen API and by apps you connect to your account, such as AI assistants.
  • Provide Tellen AI features, such as the assistant, document classification, and tax report explanations.
  • Process payments and manage subscriptions.
  • Send you service-related communications, including updates and security alerts.
  • Respond to your inquiries and provide customer support.
  • Detect, prevent, and address technical issues and security threats.
  • Comply with legal obligations.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

  • SRI Submissions: Invoice and business data is transmitted to Ecuador's SRI as required for electronic document authorization.
  • Service Providers: We use third-party services for hosting, payment processing, email delivery, and artificial intelligence (OpenAI, for Tellen AI features). These providers are contractually bound to protect your data.
  • Apps You Authorize: If you connect an app or AI assistant to your account (for example, through the Tellen connector for Claude or another MCP-compatible app) or use an API token, we share with it the data it requests, within the permissions you grant. See Section 14.
  • Your Customers: When an invoice is authorized by the SRI, we may email it to the customer listed on it.
  • Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction.

5. Data Security

We implement industry-standard security measures to protect your data, including:

  • Encryption of data in transit (TLS/SSL) and at rest.
  • Secure storage of digital certificates with encryption.
  • HMAC-based authentication between internal services.
  • Regular security assessments and updates.
  • Access controls and authentication mechanisms.

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. Invoice data and related tax documents are retained in accordance with Ecuadorian tax law requirements (minimum 7 years).

Upon account deletion, we will remove your personal data within 30 days, except for data we are legally required to retain.

7. Your Rights

You have the right to:

  • Access: Request a copy of your personal data.
  • Correction: Request correction of inaccurate or incomplete data.
  • Deletion: Request deletion of your personal data, subject to legal retention requirements.
  • Export: Request an export of your data in a portable format.
  • Objection: Object to certain processing of your data.

To exercise these rights, contact us at the email address provided below.

8. Cookies

We use essential cookies required for the Service to function, including session management and authentication. We do not use advertising or tracking cookies.

9. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to review their privacy policies before providing any personal information.

10. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

11. International Data Transfers

Your data may be processed and stored on servers located in the United States and other countries. By using the Service, you consent to the transfer of your data to these locations, which may have different data protection laws than your country of residence.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the Service or email. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

13. "Tellen Sync" Browser Extension

Tellen offers an optional Chrome browser extension ("Tellen Sync") that imports your received electronic documents from the SRI portal (srienlinea.sri.gob.ec) into your Tellen account.

13.1 How It Works

  • The extension operates only while you are logged into the SRI portal with your own credentials. The extension does not receive, request, or store your SRI credentials; you authenticate directly with the SRI portal.
  • When you request it, the extension reads the list of received documents (invoices, credit notes, debit notes, withholdings, and purchase liquidations) that the SRI portal displays for the selected period, and transmits them to Tellen for import.
  • The extension activates only on the SRI portal's received-documents page. It does not read or access your activity on any other page or website.

13.2 Data the Extension Handles

  • Received documents: Data from received electronic documents (issuer, access keys, amounts, taxes, and dates) read from the SRI portal and sent to Tellen.
  • SRI session identity: The RUC and legal name shown in the portal, used solely to verify they match the active Tellen account before syncing.
  • Authorization tokens: To connect to Tellen, the extension uses OAuth 2.0. The refresh token is stored locally in the browser (chrome.storage.local) and the access token only in session memory (chrome.storage.session). These tokens are never shared with third parties.

The extension contains no ads or advertising trackers, and does not sell or transfer your data to third parties. Imported data is governed by the other sections of this Policy once stored in Tellen. You can disconnect the extension at any time from its own interface, which removes the locally stored tokens.

14. Tellen API, MCP Connectors, and AI

Tellen offers optional ways to work with your account from other tools: a REST API (the "Tellen API") and an MCP (Model Context Protocol) server that lets AI assistants such as Claude, ChatGPT, Cursor, and other MCP-compatible apps ("Connected Apps") access your Tellen data on your behalf. Tellen also includes built-in AI features ("Tellen AI").

14.1 Tellen API

  • Tokens: You access the API with tokens you create in your account settings. Each token is shown only once; we store a cryptographic hash and a short prefix to identify it, never the full token.
  • Access: Each token is tied to one business account and can do everything the API allows within it, including managing contacts, products, and digital certificates, and issuing documents to the SRI. Keep your tokens as secure as a password.
  • Usage records: We record the date and IP address of each token's last use to help you detect unauthorized use.
  • Revocation: You can deactivate a token at any time from your account settings.

14.2 MCP Connectors (Claude and Other AI Apps)

  • Authorization: You connect an app by signing in to Tellen and approving it on our consent screen (OAuth 2.0 with PKCE). The app never receives your Tellen password. Connected Apps may register themselves automatically; we store the name and redirect address they provide.
  • What a Connected App can do: It acts as you, limited to your role permissions in each business you belong to. Currently it can list your businesses and switch between them; read invoices, contacts (including name, identification number, email, phone, and address), products, and emission points; create, edit, and delete draft invoices; submit invoices to the SRI; and void authorized invoices. As in the dashboard, invoices authorized by the SRI may be emailed automatically to your customer.
  • Data sent to the AI provider: Data a Connected App retrieves from Tellen is sent to that app and its provider (for example, Anthropic for Claude or OpenAI for ChatGPT) and is processed under that provider's terms and privacy policy, not this Policy. We do not control how those providers store or use it. Review their policies and settings before connecting.
  • Your responsibility: Connected Apps act on your instructions. Review actions with legal or tax effect, such as submitting or voiding invoices, before confirming them in the app. You are responsible for actions taken by apps you authorize.
  • Tokens: Access tokens expire after one hour. Refresh tokens are rotated on each use and remain valid until you revoke access.
  • Revocation: You can see and revoke Connected Apps at any time under "Apps conectadas" (Connected apps) in your account settings. Revoking stops further access immediately, but it does not delete data the app already received; delete that data directly in the app.
  • Logs: We keep technical records (such as time, IP address, and errors) of requests to the MCP server for security and troubleshooting. Error reports contain only account and user identifiers, not your business data.

14.3 Tellen AI

  • When you use Tellen AI features, such as the assistant, the classification of received documents, or tax report explanations, we send your messages and the data needed to respond (for example, relevant contacts, invoices, products, or purchases) to OpenAI, our AI provider, for processing. Under OpenAI's API terms, this data is not used to train its models.
  • We store your conversations, the actions the assistant performs, and document analyses in your account so you can review them, along with usage records for your plan's Tellen AI allowance.
  • Tellen AI asks for your confirmation before making changes to your data.

We do not sell data accessed through the Tellen API, Connected Apps, or Tellen AI, and we do not use it to train AI models.

15. Contact

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Heruismo LLC
Email: legal@heurismo.com