Privacy and Data Processing Policy

1. Data controller

Andes Sync, based in Medellín, Colombia, is the controller of the personal data collected through andesync.com and its platforms. For any matter related to your data you can write to us at admin@andesync.com.

This policy is issued in compliance with Colombian Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and other Colombian regulations on personal data protection.

2. Data we collect

• Assessment form: name, company, email, WhatsApp number, estimated monthly sales, the message you write to us, your IP address and the source campaign (UTM).
• Account registration: name, email address, company name, plan of interest and password (stored encrypted; we never see it).
• Sign in with Google: if you choose this option, Google shares your name, email address, profile picture and an account identifier with us. We do not access your Gmail, contacts, files or any other data in your Google account.
• Business profile: phone, city, website or social media and the business description you share with us during activation.
• Platform usage: support tickets, messages, last sign-in date and technical logs required for the security of the service.
• Our clients' sales data: when we process sales for a partner business, we process data about its buyers (name, email, phone, what they bought and the purchase amount) on behalf of that business, as a data processor.
• Conversations with our AI assistants: what you write to Andi on our website or to "Ask your business" in your dashboard, together with the answers. Conversations with Andi are stored to serve visitors better and improve the service. Please do not write sensitive data or passwords in these chats.

3. How we use your data

• To answer your requests and carry out the free assessment of your business.
• To create and manage your account, verify your identity and let you sign in.
• To provide the contracted services: development, hosting, settlement of sales and commissions, technical support and IoT integrations.
• To answer, with artificial intelligence, the questions you ask our assistants and, in the dashboard, to analyze your company's sales, customers and products when you request it.
• To send you notices about your account, your tickets and the status of your service.
• To send you commercial information from Andes Sync, only if you authorize it; you can withdraw that authorization at any time.
• To comply with legal, accounting and tax obligations, and to protect the security of the platform.

4. Data obtained from Google

The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google data only to create your account, identify you when you sign in and show your name and picture inside the dashboard. We do not sell it, we do not use it for advertising and we do not share it with third parties except as described in this policy.

5. Who we share data with

We do not sell or rent personal data. We only share it with providers that help us deliver the service and that must protect it:

• Web hosting provider (servers located in the United States).
• Google, when you use Sign in with Google and, if you accept analytics cookies, to measure visits to the website (Google Analytics).
• Payment gateways (for example Wompi, Stripe, MercadoPago or Bold) to process charges and settlements. Andes Sync does not store card data.
• Anthropic (United States), the artificial intelligence provider for our assistants. It receives what you write in the chat and, when a company uses "Ask your business", the data needed to answer, which may include its buyers' names and phone numbers, their purchases and their amounts. According to its privacy policies, Anthropic does not use this data to train its models by default and deletes it within 30 days, unless the law or compliance with its usage policies requires keeping it longer.
• Email providers to send you notices. If you write to us on WhatsApp, that conversation is also governed by WhatsApp's terms.
• Authorities, when a law or court order requires it.

Some of these providers are located outside Colombia, which involves an international transfer or transmission of data that we carry out with the safeguards required by law.

6. Your rights

As the data subject you have the right to:

• Know, update and correct your personal data.
• Request proof of the authorization you gave us.
• Be informed about how we use it.
• Revoke the authorization and request that we delete your data, when there is no legal or contractual duty to keep it.
• Access your data free of charge.
• File complaints with the Colombian Superintendence of Industry and Commerce (SIC).

7. How to exercise your rights

Write to us at admin@andesync.com with your name, the email you registered with and your request. We will answer inquiries within a maximum of ten (10) business days and claims within a maximum of fifteen (15) business days, as provided by Law 1581 of 2012.

You can also update your name and email, or delete your account, from the Settings section of your dashboard.

8. Security and retention

We protect information with encrypted connections (HTTPS), encrypted passwords, data isolation between companies and role-based access control. We keep data while you have an active account or while it is needed for the purposes described and to meet legal obligations.

9. Cookies

We use technical cookies required to keep you signed in and to protect forms.

On our public website we also use Google Analytics, only if you accept it in the cookie notice, to learn in aggregate how many people visit us, from which city and type of device, and which pages they view. IP addresses are anonymized and this data is not used for advertising. You can decline them in the notice or delete them from your browser at any time.

10. Changes to this policy

We may update this policy. We will publish the new version on this page with its update date and, if the change is significant, we will notify you by email.