Privacy and personal data processing policy

1. Data controller

Stratify Media S.A.S., tax ID (NIT) [TO BE COMPLETED], domiciled in [TO BE COMPLETED], email for personal data matters: [PRIVACY EMAIL TO BE COMPLETED], phone [TO BE COMPLETED].

2. Two different roles

As controller: we process the data of people who create accounts and use PIGHEAD (name, email, phone, company, sign-in and payment data) and of those who contact us.

As processor: when a client company uploads its own clients' data to PIGHEAD (contacts, conversations, orders), that company is the controller and we process the data only on its behalf and following its instructions. Requests from those data subjects should first go to the company they deal with.

3. Data we process

Account and usage data: name, email, phone, role, company, language, time zone, sign-in records, IP address, device and activity log.

Payment data: what Bold and PayPal report about each payment (amount, status, method, last digits). We never receive the full card number.

Our clients' clients' data (as processor): names, emails, phone numbers, messages, files and the commercial information the company uploads.

4. What we use it for

To provide and improve the service; create and protect accounts; process payments and issue receipts; send service notices (security, expiry, balance); give support; meet legal obligations; and, with your consent, send you commercial information about PIGHEAD, which you can stop at any time.

5. Artificial intelligence

When the client company turns on AI assistants, the necessary content of the conversations is sent to the AI provider (Anthropic) to generate replies. The company can choose to hide personal data before it is sent. [TO BE REVIEWED WITH COUNSEL: provider retention terms].

6. Who we share it with

With providers that help us deliver the service, under confidentiality and security agreements: cloud infrastructure and databases, transactional email (Resend), payment gateways (Bold and PayPal), artificial intelligence (Anthropic) and the platforms the client connects (Meta, Google, TikTok). Some are outside Colombia, so there may be international transfers of data, which we carry out with the safeguards the law requires. We do not sell personal data.

7. Security

Each company only accesses its own information (per-company isolation in the database). Contacts' emails and phone numbers are stored encrypted; passwords, with one-way algorithms. We offer two-step verification and passkeys, log sensitive actions and apply the principle of least privilege.

8. Your rights

As a data subject you can access, update and correct your data; request proof of consent; be informed of how we use it; file complaints with the Superintendence of Industry and Commerce (SIC); withdraw consent or request deletion when there is no legal or contractual duty to keep it; and access your data free of charge.

9. How to exercise them

Write to [PRIVACY EMAIL TO BE COMPLETED] with your name, your request and a way to contact you. Inquiries are answered within ten (10) business days and claims within fifteen (15) business days, extendable as the law allows.

10. Retention

We keep data while the account is active and for any additional time required by law or to defend claims. The client company can request deletion of its information when the service ends.

11. Cookies

The public website uses no advertising or tracking cookies. The application uses a technical cookie to keep the session, essential for it to work. [UPDATE if analytics are added].

12. Changes and effective date

We will publish any change on this page with its date and announce substantial changes. This policy is effective from its publication.