Personal Data Processing Policy

1. Data Controller

SOLTYAI S.A.S. ("SoltyAI"), a simplified stock company identified with Colombian tax ID (NIT) 902081265-3, commercial registration 731655 of the Bucaramanga Chamber of Commerce, domiciled in Bucaramanga, Santander, Colombia.

Contact email for personal data matters: privacidad@soltyai.com.

2. Legal framework

This policy is issued in compliance with Colombia's Statutory Law 1581 of 2012, Decree 1074 of 2015 and any rules that amend or regulate them (the Colombian Habeas Data and personal data protection regime). The supervisory authority is the Superintendence of Industry and Commerce (SIC).

3. Definitions

• Data subject: the natural person whose personal data is processed.
• Controller: the party that decides on the database and/or the processing.
• Processor: the party that processes personal data on behalf of the Controller.
• Processing: any operation on data (collection, storage, use, circulation, deletion).
• Authorization: the data subject's prior, express and informed consent.
• Sensitive data: data affecting privacy or whose misuse may lead to discrimination.

4. SoltyAI's dual role

1. As Controller: for its own data: leads and commercial contacts, data of its (business) customers and their contact/billing data, and data of applicants and suppliers.
2. As Processor: for the data of its customers' end customers that SoltyAI's bots collect on the customer's behalf (the customer being the Controller of that data; for example, a real estate agency or a store that hires SoltyAI). That processing is governed by the data processing agreement and the instructions of that Controller.

This policy mainly governs the Controller role. The Processor role is detailed in the contract with each customer.

5. Data processed and purposes

SoltyAI processes identification and contact data (name, phone, email and, where applicable, address and the business customer's tax identification) and interaction data (messages, conversation history, order, appointment or request data), for the following purposes:

• Handling requests, quotes and commercial contact from leads and prospects.
• Providing, operating and supporting the contracted services (bots, automation, integrations).
• Managing the contractual relationship: billing, collection, support and operational communications.
• Sending SoltyAI news and commercial information (only with authorization, with an opt-out in every communication).
• Complying with legal, tax and accounting obligations, and responding to authorities.
• Improving the services and producing internal statistics (aggregated or anonymized where possible).

We do not deliberately collect sensitive data. If a flow were to require it, we would request explicit, separate authorization and inform you that you are not obliged to provide it. Data of minors is handled according to their best interest as required by law.

6. Processors and third parties

To operate, SoltyAI relies on providers that process personal data on its behalf (Processors), several of them located outside Colombia. The data subject's authorization covers that international transmission or transfer, which happens in practice and not only potentially, under security and confidentiality standards. They include:

• Infrastructure and hosting: Hetzner (servers, Germany) and Backblaze B2 (encrypted backups).
• Messaging: Telegram and Meta's WhatsApp Business Platform. Both channels are active: when the data subject writes to the bot, the message content, their phone number or user id and the conversation metadata are processed on the channel's infrastructure (Meta, in the United States, for WhatsApp), under each platform's own policies.
• Artificial intelligence: Anthropic (the Claude model) for AI features. SoltyAI applies usage caps and a deterministic no-AI mode; the content sent is limited to what is needed for the response.
• Email: Google Workspace (corporate email) and Resend (transactional email: document signing, operational notices).
• Payments and invoicing: Wompi (collection) and, once activated, Factus (DIAN electronic invoicing).

SoltyAI requires its Processors to uphold security, confidentiality and purpose-limited use. When the bot runs on a SoltyAI customer's WhatsApp Business account, the Controller of those conversation records is that customer, and SoltyAI acts as their Processor.

7. Data subject rights

Under article 8 of Law 1581 of 2012, as a data subject you may:

• Access, update and rectify your data.
• Request proof of the authorization granted.
• Be informed about how your data has been used.
• File complaints with the SIC for breaches of the law.
• Revoke the authorization and/or request deletion when there is no legal or contractual duty to keep the data.
• Access your data free of charge.

8. Procedure for inquiries and claims

The service channel is the email privacidad@soltyai.com.

• Inquiries: answered within a maximum of ten (10) business days from receipt. If that is not possible, you will be informed and the inquiry answered within the following five (5) business days.
• Claims: the request must identify the data subject, describe the facts and attach supporting documents. If incomplete, the interested party is asked to complete it within the following five (5) days; after two (2) months without response the claim is deemed withdrawn. Claims are resolved within a maximum of fifteen (15) business days from the day after receipt; if that is not possible, you will be informed of the reason and the new date, which will not exceed the following eight (8) business days.

9. Authorization

Processing requires the data subject's prior, express and informed authorization, obtained through physical or electronic means (including the bots' consent message). SoltyAI keeps proof of the authorization with a timestamped record.

10. Security and retention

SoltyAI applies reasonable technical, human and administrative measures: encryption in transit, a database not exposed to the Internet, encrypted backups, key-based access control, secrets management and per-customer isolation. Data is kept while its purpose lasts or a legal duty exists; conversations are kept for twelve (12) months and then anonymized or deleted, unless a legal or contractual obligation, or a different instruction from the customer acting as Controller, applies.

11. Cookies and analytics

This site uses two analytics tools, Google Analytics 4 (Google) and Microsoft Clarity (Microsoft), with cookies. Their code is not downloaded until you accept the banner: while you have not decided, and if you reject, your browser does not connect to Google or Microsoft and your visit is not measured. They measure visits, where the visit came from, pages viewed, clicks on contact buttons and, in Clarity's case, heatmaps and session recordings. We do not send them your name, email, phone number or form content. Both process the data on servers outside Colombia, which is an international transfer covered by your acceptance of the banner. You can withdraw your consent at any time from the Cookie Policy, which also explains each tool.

12. National Database Registry (RNBD)

Registration with the SIC is only mandatory for companies with assets above 100,000 UVT. SoltyAI is below the threshold; it does not apply for now and is reassessed yearly.

13. Term and changes

This policy is effective from its effective date and for as long as SoltyAI processes personal data. Databases remain valid for as long as their purposes. Substantial changes will be communicated through the usual channels before they apply, publishing the updated version on this page.