PERSONAL DATA PROCESSING POLICY
(Colombian Law 1581 of 2012 and Decree 1377 of 2013, compiled in Decree 1074 of 2015)
Last updated: November 13, 2026

1. DATA CONTROLLER
Name or company: [OWNER NAME OR COMPANY]
Identification: [TAX ID]
Address: [ADDRESS], [CITY], Colombia
Email for exercising rights: [CONTACT EMAIL]

2. SCOPE
This policy applies to the personal data Ciberkit collects from users who create an account, subscribe to PRO or contact us. It does not apply to the information users process in the tools, which stays in their browser.

3. DEFINITIONS
The definitions of article 3 of Law 1581 of 2012 apply: authorization, database, personal data, sensitive data, processor, controller, data subject and processing.

4. PRINCIPLES
Processing follows the principles of legality, purpose limitation, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality.

5. DATA PROCESSED AND PURPOSES
5.1. Identification and contact data (name, email): create and manage the account, authenticate the user, send transactional communications and handle requests.
5.2. Security data (password hash, encrypted MFA secret, hashed recovery codes, sign-in records with IP address): protect the account and prevent fraud and unauthorized access.
5.3. Subscription data (plan, status, dates, payment provider identifiers): manage the PRO plan, billing and tax obligations.
Ciberkit does not request sensitive data or data from children and adolescents.

6. AUTHORIZATION
The data subject gives prior, express and informed authorization by ticking the acceptance box when creating an account or signing in with Google. We keep proof of the acceptance date.

7. RIGHTS OF THE DATA SUBJECT
a) Know, update and rectify their data.
b) Request proof of the authorization given.
c) Be informed, upon request, about how their data has been used.
d) File complaints with the Superintendence of Industry and Commerce for breaches of the law.
e) Revoke the authorization and/or request deletion of the data when principles, rights and legal guarantees are not respected, provided there is no legal or contractual duty to keep it.
f) Access their personal data free of charge.

8. PROCEDURE FOR QUERIES AND CLAIMS
8.1. Channel: email to [CONTACT EMAIL] stating name, account email, a description of the request and supporting documents if any. The "Download my data" and "Delete my account" functions under "Your account" allow direct exercise of the rights of access and erasure.
8.2. Queries: answered within ten (10) business days of receipt, extendable by five (5) business days giving reasons.
8.3. Claims: answered within fifteen (15) business days from the day after receipt, extendable by eight (8) business days giving reasons. If a claim is incomplete, the requester will be asked to complete it within five (5) days; after two (2) months without reply it will be deemed withdrawn.

9. INTERNATIONAL TRANSFER AND TRANSMISSION
Data is hosted and processed by providers (Supabase, Vercel, Resend, Lemon Squeezy, Google) that may be located outside Colombia. Transmission is made to processors offering adequate protection levels or under transmission agreements, in accordance with article 26 of Law 1581 of 2012 and article 25 of Decree 1377 of 2013.

10. INFORMATION SECURITY
Reasonable technical, human and administrative measures are applied: encryption in transit, slow password hashing (bcrypt), secret encryption, server-only database access, least privilege and logging of access attempts.

11. VALIDITY
This policy applies from its publication. Databases are kept while the account exists and for any additional time required by law. Substantial changes will be communicated to data subjects before they apply.