Privacy Policy

Last updated: October 30, 2026 · Version 2.1

This is a courtesy translation. The Spanish version is the binding one, as EGIXIA S.A.S. is incorporated in Colombia and the processing is governed by Colombian law.

Controller identification

• Legal name: EGIXIA S.A.S.
• Tax ID (NIT): 900.607.880-6
• Registered address: Av. Calle 26 # 92-32, Connecta Centro Empresarial, Edificio G2, Bogotá D.C., Colombia
• Data protection contact: privacidad@egixia.com
• General contact: contacto@egixia.com

1. Scope

This Policy explains how EGIXIA S.A.S. ("EGIXIA") processes personal data on ai.egixia.com, in its artificial intelligence agents and in related services (the "Service"), under Colombian Statutory Law 1581 of 2012, Decree 1074 of 2015 and the instructions of the Superintendence of Industry and Commerce (SIC). Where applicable based on the data subject's residence, we also observe the principles of the European Union's GDPR and Brazil's LGPD.

2. Our role by type of information

• Information you or your organization process with the agents (documents, quotations, supplier data, instructions and outputs; "User Content"): EGIXIA acts as Processor on behalf of the company or person that contracts the Service. That company or person is the Controller and obtains authorization from the data subjects whose data it uploads.
• Account, business relationship, support and website form data: EGIXIA acts as Controller.

3. Information we process

As Controller

• Account data: name, email, company, job title, phone number and access credentials.
• Profile and commercial qualification data: country, website, number of employees, ERP in use, interests and the professional information you enter in your profile or in contact, demo or trial forms.
• Communications and support: the content of your messages and support cases.
• Plan and credits: assigned plan, balance and use of usage credits.
• Usage and log data: IP address, approximate city, browser, operating system, pages visited, site searches, access dates and times, interactions with the agents and error logs.
• Cookies and similar technologies: as described in our Cookie Policy.

As Processor

User Content, which may include personal data of supplier contacts, representatives and staff.

4. How we use the information

Data we process as Controller

• To create and manage your account, access and credits.
• To provide the Service and technical support.
• To answer your contact, demo or trial requests. To handle them better, we may use AI tools to prepare a summary of the information you submit in the form.
• To send Service and security notices and, with your authorization, commercial communications you can opt out of at any time.
• To measure and improve the site with analytics, according to your cookie preferences.
• To produce aggregated, anonymized statistics that do not identify individuals or companies.
• To protect the security of the Service, prevent fraud and comply with legal obligations.

User Content

We use it only to run the tasks you request from the agents, deliver the outputs, support you and comply with the law. We do not use it for our own purposes.

5. Authorization

We request your prior, express and informed authorization through the acceptance checkbox at sign-up and in the contact, demo and trial forms, or through a contract clause, and we keep proof of it with its date and the version of the policy accepted. Silence, mere browsing or mere use of the Service is not considered authorization.

If you upload third parties' personal data to the Service, you represent that you have their authorization or a legal basis that exempts it, and that you informed them of this processing.

6. How the AI agents handle your information

• No training: EGIXIA does not use User Content to train, fine-tune or improve AI models, ours or third parties', nor does it provide it to third parties for that purpose.
• Separation: one organization's information is not used to serve another, and the agents do not share memory across clients.
• You decide: outputs support your decisions. The agents do not send communications to third parties, award contracts or approve payments without the approval of an authorized user.
• Review the outputs: AI may produce inaccurate or incomplete information; verify it before use.

7. Who we share information with

We do not sell personal data. We share information with providers that process it on our behalf, under contracts or terms of service that govern security and data use:

• Lovable — application hosting, database, authentication, file storage and server functions, on Supabase infrastructure.
• Artificial intelligence model providers — processing of User Content and form data to generate the requested outputs.
• Public web search services — they receive the search text and company names or domains when you use the supplier search agents.
• Resend — transactional email.
• Google (Analytics and Ads) and Microsoft Clarity — analytics and advertising measurement, according to your cookie preferences.
• n8n and Slack — internal notifications to our sales and support teams about requests, cases and account activity.

We also share information when required by law or a competent authority, to protect rights and safety, in corporate transactions such as mergers or acquisitions, or with your authorization.

8. International transfers and transmissions

Our providers process information outside Colombia, mainly in the United States and the European Union. The United States is on the SIC's list of countries with an adequate level of protection. When we process information on behalf of an organization, those transmissions are governed by the personal data transmission agreement signed with it.

9. Retention

• Prospects and commercial requests: up to 2 years from the last contact, unless you request earlier deletion.
• Account data: while the account is active and then for the applicable legal periods.
• User Content: for as long as needed to provide the Service. If you or your organization request deletion, or when the contract ends, we return or delete it within 60 days, unless the law requires us to keep it.
• Technical and security logs: up to 1 year.

10. Security and incidents

We apply technical and organizational measures such as encryption in transit (TLS 1.2 or higher) and at rest on our providers' infrastructure, per-user and per-organization access control enforced in the database, and activity logs. No transmission or storage is completely secure.

If an incident affects personal data, we report it to the SIC as required by law and inform data subjects when appropriate. Organizations on whose behalf we process information are informed no later than 72 hours after the incident is confirmed.

11. Your rights

• To know, update and rectify your personal data.
• To request proof of the authorization granted.
• To be informed about how we use your data.
• To withdraw authorization and request deletion, where no legal or contractual duty to retain applies.
• To access your personal data free of charge.
• To file complaints with the SIC after completing the inquiry or claim process with EGIXIA.

To exercise them, write to privacidad@egixia.com. We answer inquiries within ten (10) business days, extendable by five (5), and claims within fifteen (15) business days, extendable by eight (8), under articles 14 and 15 of Law 1581 of 2012. You can also request deletion of your account at that address.

If your request concerns an organization's User Content, we forward it to that organization, which is the Controller: claims within two (2) business days and inquiries within five (5) business days, and we inform you of the transfer.

12. Cookies

Details are in our Cookie Policy.

13. Sensitive data and minors

The Service is not designed to process sensitive data or data of minors; please do not upload them. The Service is not directed to individuals under 18. If we identify a minor's data, we delete it.

14. Changes to this policy

We will publish each version on this page with its date. Material changes affecting the processing of User Content will be notified to active clients thirty (30) days in advance.

15. Contact

EGIXIA S.A.S. — NIT 900.607.880-6
Av. Calle 26 # 92-32, Connecta Centro Empresarial, Edificio G2, Bogotá D.C., Colombia
Data protection: privacidad@egixia.com
General contact: contacto@egixia.com