Privacy Policy

The data controller is Nelson David Valencia Alzate (ID C.C. 1.000.898.565), a natural person domiciled in Medellín, Colombia, operating under the trade name "Muratrox".

Official channel for privacy matters and rights requests: hola@muratrox.com. We answer inquiries within 10 business days and claims within 15 (Law 1581 of 2012, articles 14 and 15).

Phone: +57 304 455 7835 · Tax ID (NIT): 1.000.898.565-4

This policy is drafted in compliance with the Colombian General Data Protection Regime: Law 1581 of 2012, Decree 1377 of 2013 and related circulars and resolutions issued by the Superintendency of Industry and Commerce (SIC).

If you are a resident of the European Union, we also respect the provisions of the General Data Protection Regulation (GDPR). If you are a resident of California (USA), we respect the analogous rights set out in CCPA/CPRA.

We only collect information necessary to run the service. We group it like this:

• Account data: full name, email, password hash (never plaintext), optional avatar, preferred language, workspace role (owner / member / client) and last login timestamp.
• Project data: titles, briefs, proposals, milestones, chat messages, files you upload, ratings and comments. This information is stored linked to your account and is only visible to you and authorized project members.
• Payment metadata: processor transaction ID, amount, currency and status. We do not store full card numbers, CVV or bank authentication data: that is handled by the payment processor (Wompi) under its own PCI-DSS compliance.
• Technical data: IP address, browser user agent, session cookies and authentication activity logs. Used for security (detecting suspicious access), debugging and operational telemetry.

We process your personal data only for the following purposes:

• Operate the portal: create and maintain your account, authenticate you, display your projects, proposals, milestones and files.
• Transactional communication: send you emails about proposal updates, milestones to pay, payment confirmations, reminders and security notifications. These emails are inherent to the service and are not marketing.
• Process payments: send payment information to the processor (Wompi) to charge, issue receipts and update the status of the milestone or the membership.
• Comply with legal and fiscal obligations: issue invoices, maintain accounting records, respond to requests from competent authorities.
• Keep proof that you accepted the Terms when activating or reactivating a membership (date, version, language and IP).
• Improve the service and prevent fraud: technical log analysis, suspicious access detection, change auditing.

We do not use your data for personalized advertising, do not sell it to third parties, and do not run automated profiling with legal effects on you.

Processing is grounded on one of the following bases:

• Your explicit consent when creating an account and accepting these policies.
• Performance of the contract in force between you and us (accepted proposal for a project).
• Compliance with applicable legal obligations (tax, accounting, SIC requirements).
• Our legitimate interest in keeping the service secure and preventing fraud, provided it does not override your fundamental rights.

To run the portal we rely on technology providers (data processors). Each one only processes the data necessary for its function and under data-processing agreements:

• Supabase (database and authentication): stores your account, project data, messages and files. Hosted in the United States.
• Vercel (hosting and edge): runs the portal code and delivers pages. Hosted in the United States.
• n8n (WhatsApp assistant automation): receives the messages your customers send over WhatsApp and routes them to the assistant. It may keep a technical log of each run, including the message, for up to 7 days to diagnose failures. Hosted in the European Union.
• Google (Gemini API): the AI model that writes the assistant's replies receives the conversation text it needs to answer, the business information and that person's history with the business (their orders, bookings and complaints). Hosted in the United States.
• Resend (transactional email): sends system emails (milestone updates, confirmations, password recovery). Hosted in the United States.
• Sentry (error monitoring): records technical failures so they can be fixed. Application text is masked. Hosted in the United States.
• Wompi (payment processor): processes payments via card, PSE, Nequi and other methods. Operated in Colombia under local regulation.
• Professional advisers (accountant and lawyer): only what is needed to keep the books and meet legal obligations, under a duty of confidentiality.
• Competent authorities: only upon formal legal request (court, SIC, DIAN, etc.).

We do not sell your information or use it for advertising. There are no third-party tracking pixels (Facebook, Google Ads, etc.) in the client portal.

Some of our providers (Supabase, Vercel, Resend, Google and Sentry) have infrastructure located primarily in the United States, and n8n in the European Union. This implies an international transfer of your personal data.

Since these providers process data on our behalf, this is an international transmission: we carry it out under article 26 of Law 1581 of 2012 and articles 24 and 25 of Decree 1377 of 2013, under each provider's data processing agreement, which requires them to protect the information to standards equivalent to Colombian law. The United States and the member states of the European Union are on the SIC's list of countries with an adequate level of protection (External Circular 005 of 2017). Each provider has its own international certifications (SOC 2, ISO 27001, GDPR), which we can share upon request.

We keep your information only as long as needed to fulfill the stated purposes:

• Account data and active project data: while your account is open.
• Accounting and tax information linked to payments: 5 years after project closure, in compliance with Colombian tax obligations.
• Record of your acceptance of the Terms (date, version, language and IP): for as long as the relationship lasts and 5 years after, like the accounting information.
• Technical security logs: up to 12 months.
• Data of a business (conversations, contacts, orders, catalog, files) that cancels its membership, or whose membership has been suspended for non-payment for 90 days (it is canceled automatically that day, unless its plan includes hosting for a website it already had: that one we cancel after notifying it by email): deleted 30 days after cancellation, except the accounting information and the record of acceptance of the Terms, which are kept as stated in the points above. Before deletion we notify the business by email and it can download its orders, bookings or leads (depending on its business) from its dashboard.
• If you close your account and there is no legal obligation to retain, we delete or anonymize the data within a reasonable timeframe.

As the data subject you have the following rights (Law 1581/2012, Decree 1377/2013):

• Access, update and rectify your personal data. Most of this you can do directly from Settings inside the portal.
• Request proof of the authorization granted for processing.
• Be informed about the use given to your data.
• File complaints with the Superintendency of Industry and Commerce (SIC) for violations of Law 1581.
• Revoke authorization and/or request data deletion when there is no legal or contractual obligation preventing it.
• Free access to your personal data that has been subject to processing.

To exercise any of these rights, write to hola@muratrox.com from the email linked to your account, stating what you need. We answer inquiries (what data we hold and how we use it) within 10 business days, and claims (correcting, updating or deleting data, or revoking your authorization) within 15 business days. If we cannot make it, we tell you why and the new date, which is no more than 5 extra business days for an inquiry or 8 for a claim. We usually answer much sooner.

We use strictly necessary cookies to run the portal:

• Supabase session cookie: keeps you securely signed in. Without it you cannot access the portal.
• Language cookie: remembers whether you chose Spanish or English on the landing.
• Theme cookie: remembers your light / dark mode preference.
• Connecting your WhatsApp (businesses only): in Settings, the section to connect the number loads Meta's sign-up tool. That tool uses its own cookies so you can log in to Facebook and authorize the connection, and it tells Meta it was used, under Meta's privacy policy. It does not load on any other screen.

We do not use advertising cookies or third-party tracking on the client portal. The public landing may include basic anonymized analytics to understand which parts visitors view most.

To find and fix errors, Sentry (our error monitoring provider) may record how part of the visits to the portal looked, and always the visits where something failed. In that recording all text, everything you type and all images are masked, so neither what you read nor what you type can be seen. It uses your browser's storage for the length of the visit, not advertising cookies.

We apply reasonable technical and organizational measures to protect your information:

• Encryption in transit (TLS 1.3) on all communications with the portal.
• Encryption at rest on the database, at the provider level (Supabase).
• Irreversible hashing (bcrypt) for passwords: not even we can read them.
• Per-workspace data isolation via Row-Level Security in the database.
• Restricted production access for authorized personnel only, and only for operational tasks.
• OTP verification to the current email when a user wants to change their account email (to prevent session hijacking).
• Automatic inactive-session timeout and brute-force protection on login.
• Each business's WhatsApp keys are stored encrypted in a vault that only the server can access.
• If a security incident happens, we follow a written plan: contain it, and notify the affected business and the authorities without delay, within the legal timeframes.

Muratrox is not directed at people under 18 and we do not knowingly collect data from minors. If we detect that a minor created an account, we delete it together with the associated information.

Beyond the project portal, Muratrox offers businesses an automated WhatsApp customer-service service (an AI chatbot) together with a control panel. When a business hires this service, Muratrox processes that business's end-customer data as a Data Processor, while the business acts as the Data Controller for that data.

In practice this means the business decides what its customers' data is used for, and we only process it following their instructions and strictly as needed to run the chatbot and the panel.

For each business that uses the assistant, Muratrox publishes a base privacy policy at muratrox.com/privacidad/<its-business>, which the business must review and may replace with its own. That is the policy that governs for its customers; this section explains what we do as its Processor.

The data processed in this service is:

• WhatsApp phone number and profile name of whoever messages the business.
• Content of the messages exchanged with the assistant and with the business's staff, so we can reply, provide support and keep the conversation history.
• The files the customer sends through the chat (photos, audio, documents or payment receipts), stored so the business can see them in its dashboard.
• Order data: products, quantities, delivery address and notes, chosen payment method and total.
• Booking data (service, date, time and notes) and lead data (what the person is interested in, the status and the business's notes).
• If the business connects its number in coexistence mode, meaning it keeps using the WhatsApp Business app on its phone: the contacts in that app's address book (name and number), even if they never messaged the business; the chat history Meta shares once when connecting; and the messages the owner sends from their phone.
• If the person asks not to be messaged again or to have their data deleted: the date of that request, so it can be honored.
• If the business uses promotions: whether the person agreed to receive them or not, when and from which message (the proof of their consent), and the promotions they received.
• If the business has its website with Muratrox: the messages from its contact form (name, email or phone and message) and analytics of visits and clicks on the WhatsApp button that do not store the IP address as such, but a code derived from it (a hash) that changes every day, to count distinct visitors.
• Technical message metadata: WhatsApp identifiers, timestamps and delivery status.

If a business turns on promotions, Muratrox sends promotions and news by WhatsApp on its behalf and following its instructions, only to people who agreed to receive them: at most one a day and two a week, within the hours allowed by Colombia's Law 2300 of 2023, and each with a button to opt out. Anyone who says no is not asked again.

To send and receive messages, this service relies on the WhatsApp Business Platform, whose contracting entity towards Muratrox is Meta Platforms Ireland Limited, and which processes that data under its own policies and terms. Muratrox is registered with Meta as a technology provider, and in that capacity Meta's Global Data Protection Addendum applies to it.

To draft the automated replies we use Google's Gemini API. The model receives the conversation text it needs to answer, along with the business information (catalog, opening hours and what the business wrote about itself), the details of the order being put together and that person's history with the business (their orders, bookings and complaints: products, totals, dates and statuses). So if someone types personal data in the chat, that text may reach it too. The assistant is instructed not to ask for card numbers, passwords or identity documents.

A business's end customers can exercise their rights (access, correction or deletion) directly with the business or by writing to us at hola@muratrox.com. In that case we pass the request on to the responsible business, and if it is a deletion request the business does not handle, we carry it out ourselves within the 15 business days the law allows. Conversations and orders are kept while the business keeps the service active. If its membership is suspended for non-payment, we stop storing what comes in from its number and keep the rest for up to 90 days; after that the membership is canceled (if its plan includes hosting for a website it already had, we cancel it after notifying it by email) and, as with any cancellation, the data is deleted 30 days later. The business can also delete, at any time and from its panel, the data of a person who asks for it.

We may update this Privacy Policy when operations or a regulatory change require it. When the changes are significant we notify you by email and via an in-portal notice at least 15 calendar days in advance. The current version is always available at this same URL.

Any inquiry, complaint, exercise of rights (access, rectification, cancellation, opposition) or security incident report: write to hola@muratrox.com. That email is our official contact and notification channel. We operate from Medellín, Colombia.

Phone: +57 304 455 7835 · Tax ID (NIT): 1.000.898.565-4

If you consider your rights have been violated, you may also file a complaint with the Superintendency of Industry and Commerce (SIC), the data protection authority in Colombia.