Privacy policy

1. Who is responsible for your data

DESARROLLANDO ANDO S.A.S. («DesarrollAndo», «we») is the Colombian company responsible for processing your personal data on this platform, under Law 1581 of 2012 and Decree 1377 of 2013 (now compiled in Decree 1074 of 2015).

• Tax ID (NIT): 901.908.287-3.

• Address: Calle 46 # 27-03, Manizales, Caldas, Colombia.

• Commercial registration: 0000242055 at the Manizales Chamber of Commerce.

• Legal representative: Germán Darío Gómez Hernández.

• Email for personal data matters: datos@desarrollandoando.com.

2. What data we collect

We only collect what the platform needs to work:

• Your email address, when you sign in with a magic link or join the waitlist.

• If you sign in with Google: your name, your email and, if Google sends it, your profile picture. We never receive your Google password.

• On the waitlist: your name (optional), your country, the product you are interested in and your language.

• The content of your projects: what you write in conversations, the ideas, files and decisions you share, and the code and documents the agents generate for you.

• Usage and cost records: what you do on the platform, which tasks the agents run, how much they consume (for example, the real cost of AI models) and your credit balance.

• The origin of your account: if you arrived through a partner's link, that link's code.

• Technical and security data: IP address, browser and device type, access dates and times, and the signals from the bot check (see section 6).

We do not ask for sensitive data (health, ethnic origin, beliefs, biometric data, among others). We only process data about children and teenagers with the authorization of their legal representative (parent or guardian), respecting their rights and best interests, as required by article 7 of Law 1581. Please do not write sensitive data or other people's personal data into your projects unless you are authorized to. If your projects process other people's personal data (for example, your app's users), you are the controller of that data and we only process it on your behalf, to provide the service and with the security measures in this policy.

3. What we use your data for

• Creating and maintaining your account, signing you in and keeping your session.

• Providing the service: letting the AI agents understand, build, test and publish your project, and letting the human experts you book help you.

• Keeping track of your credit balance (including the welcome credit), your usage and, once paid plans exist, billing.

• Protecting the platform: detecting bots, abuse and fraud, and limiting repeated attempts.

• Letting you know when it is your turn if you are on the waitlist, and sending you service messages (important changes, security, billing).

• Measuring and improving the platform with internal figures (for example, how many people finish each stage).

• Running the partner program (knowing which link an account came from) without showing the partner your personal data.

• Complying with legal, accounting and tax obligations, and answering requests from authorities.

We do not sell your data. We do not use the content of your projects to train AI models. We do not send marketing emails or advertising today. If we ever do, we will first ask for your separate authorization, which you can withdraw at any time.

4. Your authorization

Before you join the waitlist or sign in to the platform we show you the link to this policy. By doing so you give us your prior, express and informed authorization to process your data for the purposes in this policy. We keep proof of that authorization (date, channel and policy version). You can revoke it at any time (section 8), except where the law or an active contract requires us to keep the data.

5. Who we share your data with and international transfers

To provide the service we use providers that process data on our behalf (processors). Several are outside Colombia, mainly in the United States, so your data is transferred to other countries:

• Supabase (United States): the platform's database and authentication. The database is in the United States, on Amazon Web Services (AWS) servers in the east of the country (region us-east-1).

• Vercel (United States, with a global network): hosts the website and the platform.

• Anthropic (United States): AI models (Claude) that read your project's instructions and content to generate answers and code. We use its commercial API, which under its terms does not use that data to train its models.

• E2B (United States): isolated sandboxes where the agents run and test your project's code.

• Railway (United States): servers where the agent engine runs.

• Google (United States): signing in with your Google account.

• Cloudflare (United States, with a global network): domain names, network protection and the Turnstile bot check.

With each processor we have or accept data processing terms that require them to use the data only to provide their service to us and to protect it. Colombia's Superintendence of Industry and Commerce (External Circular 005 of 2017) considers that the United States offers an adequate level of protection. If we add a new processor that handles your data (for example, another AI model provider), we will update this list and let you know before we start using it.

We may also hand over data to authorities when a law or an order requires it. If a human expert helps you in a session you book, they will see the project information needed for that session.

6. Bot check (Cloudflare Turnstile)

To keep bots from abusing sign-up and the welcome credit, the «Sign in» page uses Cloudflare Turnstile in invisible mode: usually you don't have to do anything. To decide whether you are a person, Turnstile collects technical signals from your browser and device (for example, your IP address and browser data) and only returns the result of the check to us.

Cloudflare processes that information under its Turnstile Privacy Addendum, which you can read here: https://www.cloudflare.com/turnstile-privacy-policy/.

7. Cookies

We only use necessary cookies: those that keep your session open securely and those the bot check needs. We do not use advertising or third-party tracking cookies. The app also stores a copy of the page on your device so it opens faster.

8. Your rights and how to exercise them

As the data subject you have the right to:

• Know, update and correct your data.

• Request proof of the authorization you gave us.

• Be told, on request, how we have used your data.

• Revoke the authorization and ask us to delete your data, when there is no legal or contractual duty to keep it.

• Access your personal data free of charge.

• File complaints with Colombia's Superintendence of Industry and Commerce (www.sic.gov.co) after making your request or claim to us.

To exercise them, write to datos@desarrollandoando.com from your account's email (or prove in another way that you are the data subject or their representative), with your name, what you are asking for and, for a claim, the facts and documents you want to rely on.

• Requests: we answer within 10 business days at most; if we can't, we tell you why and answer within 5 more business days at most.

• Claims (correct, update, delete or revoke): we answer within 15 business days at most; if we can't, we tell you why and answer within 8 more business days at most.

9. How we protect your data

We keep each organization's data separate in the database, encrypt connections, keep service keys out of the code, limit which team members can see personal data and log internal queries. Outside production we only use made-up data. No system is perfect: if an incident affects your data, we will let you know and report it to the authority as the law requires.

10. How long we keep your data and validity of this policy

We keep your data while you have an account or are on the waitlist, and for as long as it is needed for the purposes in this policy. When you close your account or ask us to delete your data, we delete or anonymize it within the time frame for claims (section 8). We only keep what the law requires us to keep, such as accounting and billing records (up to 10 years), and only for that purpose.

This policy applies from the date it is published on this page and remains in force while DesarrollAndo processes personal data. If we change it in an important way, we will let you know in advance by email or inside the platform.