Privacy and data processing policy

1. Who the controller is

The data controller is [COMPANY NAME OR FULL NAME] · [NIT OR CÉDULA NUMBER] · [CITY], Colombia, which operates the Callsy X platform. For any matter regarding your data, email us at callsyxmax@gmail.com or message us on WhatsApp at +57 320 553 3698.

2. Legal framework

This policy is governed by Law 1581 of 2012 (Colombia's general personal data protection regime) and Decree 1377 of 2013, which regulates it, as well as by any other rules that amend or supplement them. When we process data of people outside Colombia, we apply, at a minimum, these same rules.

3. What data we process

Callsy X mainly serves two kinds of people, and it processes different data for each. What people type when they try the homepage demo, and customers' video testimonials, have their own sections (8 and 9).

3.1 Business owners and members (the people who open an account)

• Name and email address, to create the account, confirm it and write to you.
• Password, which we store only in encrypted form, using a one-way algorithm (never as readable text; not even we can see it).
• Business data that you enter: name, the assistant's script, locations, payment methods, business hours, catalog or inventory, and the Telegram chats you link.
• Usage and security data: date and time of sign-in, IP address and security events (failed attempts, lockouts), to protect the account.
• Balance activity: top-ups you report, the assistant's usage and adjustments.

3.2 Each business's end customers (the people who write in on WhatsApp or Telegram)

• WhatsApp number (or Telegram chat ID) and profile name, as provided by the channel's provider.
• The messages they send and the replies they receive, including photos and audio messages they send to the business (for example, a proof of payment).
• Data they provide themselves in the conversation to complete a purchase: shipping address, city, delivery directions.

With respect to end customers, the business that uses Callsy X is the one that decides what their data is processed for (it is the controller), and Callsy X processes that data on the business's behalf, as a processor, following this policy and the business's instructions.

We do not ask for or need sensitive data (health, orientation, beliefs, biometrics). If a customer writes such data in a conversation, it is stored as part of the message and handled with the same care as everything else.

4. What we use it for

• Creating and protecting your account, confirming your email and letting you recover your password.
• Running the assistant: reading the messages from your business's customers and generating replies with the script and the data you set up.
• Handing a conversation off to a person when the assistant cannot resolve it, and sending an alert on Telegram.
• Keeping track of your balance: top-ups, usage and low-balance alerts.
• Showing you the conversations, reports and usage in your dashboard.
• Answering your contact and support messages.
• Preventing abuse: attempt limits, temporary lockouts and logging of security events.

We do not sell data, we do not use it for third-party advertising, and we do not use one business's conversations to train models or to serve another business.

5. Where it is stored

The platform runs on Cloudflare infrastructure (Workers, the D1 database and R2 storage). Data travels encrypted (HTTPS) and provider credentials are stored encrypted. Each business is isolated: its conversations, data and balance are always looked up with that business's identifier, and the platform has automatic controls that prevent one business's information from showing up in another's.

Cloudflare may keep copies in data centers outside Colombia, and the other providers listed in section 6 may process what they receive on servers outside Colombia. This involves an international transfer of data to those providers; by accepting this policy, you authorize that transfer, solely for the purposes described.

6. Who it is shared with

Only with the providers needed for the service to work, and only what each one needs:

We may also share data when an authority requires it in accordance with the law. Outside of those cases, we do not hand data over to third parties.

7. How long we keep it

• Account and business data: for as long as the account is active. If you close the account or ask us to delete it, we delete the business's data and its conversations within a reasonable time, except for what the law requires us to keep (for example, accounting records of top-ups).
• End customers' conversations and files: for as long as the business needs them to serve its customers; the business can ask us to delete them at any time.
• Security events (IP, sign-in attempts): for a short time, long enough to detect abuse.
• Contact form emails: until we answer them and for a reasonable time afterward, in case there is any follow-up.
• What is typed in the homepage demo: deleted after 30 days (section 8).
• Video testimonials: for as long as the customer authorizes it; they are taken down when the customer asks (section 9).

8. The live demo on the homepage

On the homepage you can message a sample assistant (Yuli, from the sample store Tienda Andina) and see how it replies. To make it work:

• We store what you type in the demo and what the assistant replies, including what you type when you try “Hand off to a human”. We use it to reply to you and to improve the service.
• Your messages are sent to the sample assistant's AI model provider (OpenAI, Anthropic or Google) to generate the reply, as with any Callsy X assistant (section 6).
• Your browser stores a random identifier (it is not a cookie and it does not say who you are) to keep the same conversation going. It is replaced by a new one when you restart the demo, and it disappears if you clear this site's data in your browser.
• To prevent abuse, we count how many messages arrive from each connection (IP address) over a short period; that count is deleted automatically when the period ends.
• The conversation is deleted 30 days after its last message.

Do not type real data in the demo: no addresses, ID, card or account numbers, or passwords. It is a sample store, and no one is going to ship an order. If you want to try Callsy X with your business, message us on WhatsApp or email us.

9. Video testimonials

Some customers record a video about how things are going for them with Callsy X. With that video we process their image, their voice and what they say, as well as the name, business, city and quote that go with it.

• They are published only with the customer's authorization. Without that authorization, the video does not appear on the site.
• They are taken down whenever the customer asks. Just email us at callsyxmax@gmail.com or message us on WhatsApp (+57 320 553 3698); we remove it from the site and, if you ask, we delete it as well.
• The videos are stored on Cloudflare (R2 storage), like the rest of the platform, and are shown on the Callsy X website.

10. Your rights and how to exercise them

As the owner of your data, you can, at any time and free of charge:

• Know what data of yours we hold and how we use it.
• Update or correct any data that is incomplete or inaccurate.
• Delete the data, or ask us to stop processing it, when there is no legal duty to keep it.
• Revoke the authorization you gave us.
• File complaints with the Superintendencia de Industria y Comercio (Colombia's Superintendence of Industry and Commerce) if you believe we did not address your request.

To exercise them, email us at callsyxmax@gmail.com or message us on WhatsApp at +57 320 553 3698, stating your name, your account email (or your WhatsApp number if you are a customer of a business) and what you need. We will respond within the time limits set by law. From your dashboard you can also change your name and your password, and delete the business data and the linked Telegram chats.

If you are an end customer of a business that uses Callsy X, you can write to us or directly to the business; either way, we coordinate the response.

11. Cookies

We use a single cookie, the session cookie (callsy_sid), which keeps you signed in to your dashboard. It is a technical cookie, it is not used for tracking or advertising, and it is deleted when you log out or after 7 days without using the dashboard. The public pages do not use cookies or third-party pixels; the homepage demo only stores in your browser the random identifier described in section 8.

12. Changes to this policy

If we change anything significant, we publish the new version on this page with its date and, if you have an account, we let you know by email or in your dashboard. The version in force is the one dated October 15, 2026.