Privacy and personal data processing policy

Effective date: September 26, 2026

1. Identity of the data controller

COLAB AI S.A.S. (hereinafter, "COLAB"), a commercial company incorporated in Colombia, identified with Tax ID (NIT) 901819763-6, domiciled at AUTOPISTA KM 7 VÍA PIEDECUESTA COSTADO ORIENTAL VÍA MANTILLA 180 BALCONES DE RUITOQUE TORRE 2 ETAPA1 APTO 1702, Colombia. Phone: +57 314 4651563. Email: admin@colabai.tech.

2. Legal framework

This Policy is governed by the Political Constitution of Colombia, Law 1581 of 2012, Decree 1377 of 2013 and other applicable regulations on personal data protection.

3. Scope and roles

COLAB acts as DATA CONTROLLER with respect to the data of prospects, customers, website visitors and users of Colab CRM accounts. With respect to the messaging data of end customers processed on behalf of the companies that use Colab CRM (through WhatsApp Business Platform, Messenger and Instagram), COLAB acts as DATA PROCESSOR, and the client company is the DATA CONTROLLER.

4. Data we collect

• Contact data of prospects and customers: name, email address, phone number, company and content of communications.
• Account data of business users of Colab CRM: registration data, credentials, role and account settings.
• Messaging data of end customers (Meta "Platform Data"): messages and associated data processed on behalf of the client company through the WhatsApp Business Platform, Messenger and Instagram APIs. By way of example, this data may include: the WhatsApp phone number ID, the WhatsApp Business Account ID (WABA ID), the message ID, the content and metadata of the message, the profile name and the phone number of the end customer; on Messenger, the Page-Scoped ID (PSID); and on Instagram, the Instagram-Scoped ID (IGSID). In this case COLAB acts as Processor and the client company as Controller.
• Technical and usage data: IP address, device and browser type, and browsing data.
• Cookies and similar technologies (see Cookies section).

5. Purposes of processing

To provide and manage our software development services; to operate and support Colab CRM; to handle contact requests; to manage the contractual relationship; to comply with legal, accounting and tax obligations; and to improve our services. Collection is limited to data that is relevant and adequate for these purposes.

6. Use of Meta Platform Data

COLAB AI S.A.S. operates the Meta app named "colab-crm", registered as a Tech Provider independent of Meta. When COLAB processes Platform Data obtained from WhatsApp Business Platform, Messenger and Instagram on behalf of the client company, it does so solely to provide the contracted messaging service through Colab CRM. COLAB DOES NOT SELL PERSONAL DATA and complies with the Meta Platform Terms, the WhatsApp Business Messaging Policy and the other applicable policies of Meta Platforms, Inc. The use of this data is limited to what is described in this Policy. Users may request the deletion of their Platform Data at any time by following the instructions on our Data Deletion page: https://colabai.tech/en/data-deletion.

7. Data processed through the mobile app

Colab CRM is also available as a mobile app for Android and iOS, identified as com.colabai.crm. The app is used with an existing account: accounts cannot be created and plans cannot be purchased from it. In addition to the data described in the previous sections, the app processes the following:

• Account data: your email address, your name, your role and the workspace you belong to, in order to sign you in and show you what corresponds to you.
• Device notification identifier: to send you alerts about new messages we use Firebase Cloud Messaging (Google LLC) on Android and the Apple Push Notification service (APNs, Apple Inc.) on iOS. These services assign your installation a technical identifier —a "token"— that we store associated with your account for as long as you keep the app installed and notifications enabled. It is deleted when you sign out or uninstall the app.
• Conversation content: the messages you send and receive from the app, together with their attachments, are processed in the same way as those of the web version.
• Photos and files you choose to attach: when you attach an image or a document to a conversation, the app accesses only the file you select in the system picker. We do not read your photo library or your storage.
• Camera: with your permission, and only when you choose to take a photo to attach it to a conversation. The app does not access the camera at any other time.
• Microphone: with your permission, and only while you record a voice note to send it in a conversation. There is no background recording.
• Minimum technical data required for operation: device type and operating system, the IP address of the connection and app errors.

What the app does not do. It does not use analytics or advertising tools, it does not track your activity across other apps or websites, it does not access your location, your device contacts or your device calendar, and it does not process payments or allow purchases.

Your permissions, always revocable. You may withdraw the camera, microphone and notification permissions at any time from your device settings. The app will keep working, without the features that depend on them.

Deleting your account from the app. You can request the deletion of your account and its associated data from within the app itself, under Settings → Account and privacy → Request account deletion, or by following the instructions at https://colabai.tech/en/data-deletion.

8. Transfer and transmission to third parties

We may share data with: platform providers (Meta, as provider of the WhatsApp Business Platform, Messenger and Instagram APIs); hosting and infrastructure providers; push notification providers for the mobile app (Google LLC, through Firebase Cloud Messaging, and Apple Inc., through APNs), which process only the device identifier and the notification content required to deliver it; and payment processors, where applicable. These third parties process the data in accordance with the authorized purposes and adequate security measures.

9. International transfers

Some providers may be located outside Colombia. In such cases we adopt measures to ensure that the transfer or transmission complies with Colombian data protection regulations.

10. Retention

We retain data for as long as necessary to fulfill the purposes described and the applicable legal, accounting and tax obligations. Once those purposes have been fulfilled, we proceed with its deletion or anonymization.

11. Security measures

COLAB adopts reasonable administrative, technical and physical measures, in line with industry standards, to protect personal data. Data is encrypted in transit (HTTPS and WebSocket over TLS), both from the website and from the mobile app. COLAB employs commercially reasonable efforts and does not guarantee absolute security.

12. Rights of data subjects

In accordance with Article 8 of Law 1581 of 2012, the data subject has the right to: know, update and rectify their personal data; request proof of the authorization granted; be informed about the use that has been made of their data; file complaints with the Superintendence of Industry and Commerce for violations of the law; revoke the authorization and/or request the deletion of the data; and access their personal data that has been processed, free of charge.

To specifically exercise the right of deletion (erasure) of data obtained from Meta platforms, the data subject may follow the step-by-step instructions available at https://colabai.tech/en/data-deletion or write to admin@colabai.tech.

13. Procedure and response times

Requests, inquiries and claims must be sent to admin@colabai.tech, including the data subject's identification and a description of the request. In accordance with Law 1581 of 2012: INQUIRIES will be addressed within a maximum of TEN (10) BUSINESS DAYS from the date of receipt (Article 14); CLAIMS will be addressed within a maximum of FIFTEEN (15) BUSINESS DAYS from the day following the date of receipt (Article 15). When it is not possible to respond within these terms, the data subject will be informed of the reasons for the delay and the response date. Data deletion and revocation of authorization are processed as claims, in accordance with Article 9 of Decree 1377 of 2013 and Article 15 of Law 1581 of 2012.

14. Minors

COLAB's services, including Colab CRM and its mobile app, are intended for companies and their professional users, and not for anyone under 18. COLAB does not knowingly collect personal data from minors through user accounts; if we learn that an account belongs to a minor, we will delete it together with its data. As regards the messaging data of end customers processed on behalf of client companies, it is the company, as Data Controller, that must obtain the authorizations required by law, including that of the legal representative when the data subject is a minor (Article 7 of Law 1581 of 2012).

15. Cookies

Our website uses technical and analytics cookies for its operation and to improve the browsing experience. Users can configure their browser to accept, block or delete them.

16. Changes to this policy

Any substantial change to this Policy will be communicated in a timely manner through our website, prior to its implementation.

17. Supervisory authority

The Superintendence of Industry and Commerce (SIC), through its Deputy Office for Personal Data Protection, oversees personal data protection in Colombia (Article 19 of Law 1581 of 2012). The data subject may file complaints with the SIC once the inquiry or claim process with COLAB has been exhausted.