1.Status of this document
This document is a draft and is pending review by a legal advisor before final publication. Until then it may change and should not be taken as the final version.
Company details that are not yet defined appear in square brackets with the word "Pending".
2.Data controller
Legal name: [Pending: legal name]. Tax ID (NIT): [Pending: tax ID]. Address: [Pending: address]. Email for privacy matters: [Pending: privacy contact email].
3.Legal framework
This policy is governed by Law 1581 of 2012, by Decree 1377 of 2013 (now compiled in Decree 1074 of 2015) and by any other rules that amend or supplement them. The data protection authority in Colombia is the Superintendencia de Industria y Comercio (SIC).
4.Processing and purposes
The data we collect is account data, the financial records you enter, the attachments you upload, voice transcripts and the technical data needed; and, only if you turn on bank automation, the emails or statements you share.
The purposes of the processing are:
- Creating and managing your account and providing the service to you.
- Processing your records for budgets, reports and recommendations.
- Processing content with third-party artificial intelligence, only with your express authorization.
- Ensuring security and preventing fraud and abuse.
- Applying the limits of your plan and managing billing once it is active.
- Sending you communications about your account and the service.
- Complying with legal obligations.
5.Data subject authorization
Processing requires your prior, express and informed authorization, which we make known when you create the account and, for artificial intelligence, through a separate consent. We record the version accepted and the date.
You can revoke your authorization or request the deletion of your data at any time, unless there is a legal or contractual duty to keep it.
6.Rights of data subjects
As a data subject you have the right to:
- Know, update and correct your personal data.
- Request proof of the authorization you granted.
- Be informed about how your data has been used.
- File complaints with the Superintendencia de Industria y Comercio for violations of the law.
- Revoke the authorization and request the deletion of your data when legal principles, rights and guarantees are not respected.
- Access your personal data being processed free of charge.
7.Area responsible for requests, inquiries and claims
Requests, inquiries and claims are handled by the data protection area, by writing to [Pending: privacy contact email]. Include your name, a way to reply to you and a description of what you are asking for, so that we can verify your identity.
8.Procedure for inquiries
With an inquiry you can ask for access to your data or to information about its processing. We will respond within a maximum of ten (10) business days from the date of receipt.
If we cannot respond within that period, we will tell you the reasons and the new date, which will not exceed five (5) additional business days.
9.Procedure for claims
If you believe your data should be corrected, updated or deleted, or that the law has been breached, you can file a claim with your identification and a description of the facts. If it is incomplete, we will ask you to complete it within five (5) days of receiving it.
We will resolve the claim within a maximum of fifteen (15) business days from the day after we receive it complete. If that is not possible, we will tell you the reasons and the new date, which will not exceed eight (8) additional business days. Only after going through this process can you turn to the Superintendencia de Industria y Comercio.
10.Sensitive data and minors' data
We do not ask for sensitive data as part of the service. If any content you upload includes it, you are not obliged to provide it and its processing will require your express authorization.
Data of children and adolescents is only processed when their legal representative records it and authorizes it, respecting the best interests of the minor. Supervised accounts for minors aged 13 to 17 are pending and are not available yet.
11.International transfer and transmission
Your data is stored on Google Firebase and Google Cloud infrastructure. The content you send to artificial intelligence features is transmitted to third-party artificial intelligence providers, which may be outside Colombia, and only after your express authorization.
We require these providers to process the data only to provide the service to us and with adequate security measures. We do not sell your financial data.
12.Validity and changes
This policy applies from the date shown at the top. Your data is processed while you have an account and for any additional time required by a legal obligation. If we substantially change the purposes, we will ask for a new authorization.