Legal
Privacy policy
Last updated: October 22, 2026
This policy explains what personal data CancebiTech Inc. («Cancebi»), RUC 1316075926001, with registered address at Portoviejo, Manabí, Ecuador, processes through the website cancebi.com and the products of the Cancebi ecosystem.
1 · Who is the controller
The controller is CancebiTech Inc.. For any privacy matter you can write to privacidad@cancebi.com.
When you subscribe to a product there are two distinct roles: Cancebi is the controller of your account data (who you are, how you sign in, which plan you have) and the processor of the business data you enter into the system (your customers, your invoices, your patients). That data is yours: we only process it to provide the service.
2 · What data we process
- Identity and contact: first name, last name, email address and phone number.
- Account and access: password stored as a bcrypt hash (never in clear), active sessions, IP address, browser and access time.
- Company: legal name, tax ID, address, roles and permissions of the people in the organisation.
- Billing: subscribed plan, invoices and payment status. We do not store card numbers: payments are processed by the payment gateway.
- Support: the messages you send us and their history.
- Business data you enter in the products (for example invoices, customers or clinical records). Processed on your behalf and instruction.
3 · Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Create and maintain your account, authenticate you and give access to the products. | Performance of the contract. |
| Issue invoices, charge the subscription and comply with tax obligations. | Performance of the contract and legal obligation. |
| Record access and changes to prevent fraud and investigate incidents. | Legitimate interest in the security of the service. |
| Respond to your support requests. | Performance of the contract. |
| Service communications (changes, maintenance, security notices). | Performance of the contract and legitimate interest. |
We do not use your data for third-party advertising or to build commercial profiles of people.
4 · If you sign in with Google
You can create your account or sign in with your Google account. In that case we receive your name, email address and, if available, your profile picture, and we verify that the email is confirmed. We do not receive your Google password or access to any other Google account data. You can stop using this method at any time and set your own password.
5 · Cookies
This website uses no analytics, advertising or tracking cookies and loads no third-party resources. The products use one strictly necessary session cookie; details are in the cookie policy.
6 · Who we share with
Only with providers acting on our behalf and under contract:
- Our own infrastructure: servers and databases we administer.
- Google Cloud: file storage (photos, documents and backups).
- Amazon SES: transactional email delivery.
- Payment gateways: subscription payment processing.
We do not sell, rent or transfer personal data. We only disclose it to an authority when required by a lawful order.
7 · International transfers
Some providers are outside Ecuador (mainly in the United States). In those cases we require contractual safeguards equivalent to Ecuadorian law.
8 · How long we keep it
Account data is kept while the account exists and, afterwards, for the applicable statutory retention periods (tax documents are kept for seven years). Access logs are kept for the time needed to investigate incidents. When the period ends, they are deleted or anonymised.
9 · Your rights
Under the Ecuadorian Organic Law on Personal Data Protection you may exercise the rights of access, rectification and update, erasure, objection, portability, suspension of processing and not to be subject to decisions based solely on automated assessments.
Write to privacidad@cancebi.com stating which right you exercise. We will reply within the period set by law. If you are not satisfied, you may contact the Superintendence for Personal Data Protection.
If your data sits inside a product (for example a patient record), the request must go to the company responsible for that account: we assist them as processors.
10 · Security
We apply technical and organisational measures: bcrypt passwords, centralised authentication with revocable sessions, encryption in transit, data separation per company, server access control and audit logging. Read the detail in Security.
11 · Minors
The services are aimed at adults and companies. We do not knowingly collect data from anyone under 18 without the authorisation of their legal guardian.
12 · Changes
If we change this policy we will update the date above and, where the change is relevant, tell you by email or inside the product before it applies.
13 · Contact
CancebiTech Inc. · RUC 1316075926001 · Portoviejo, Manabí, Ecuador
Privacy: privacidad@cancebi.com