Privacy Policy

This Privacy Policy clearly and transparently describes how Cyberix S.A.S collects, uses, stores and protects your personal information when you use our business automation services. Cyberix S.A.S, NIT 901.917.790, [email protected].

By using our services, you accept the practices described in this policy. The applicable regime is Colombia's Law 1581 of 2012, Decree 1377 of 2013 and the other Colombian personal data protection rules, supervised by the Superintendencia de Industria y Comercio (SIC). If in the future we process data of European Union residents, we will also apply the GDPR.

User Account

Unique account created to access our automation and business management services.

Personal Data

Any information that allows a natural person to be identified, directly or indirectly.

Data Controller

Cyberix S.A.S, located at Cl. 7D #43A-40, El Poblado, Medellín, Colombia.

Services

Business automation platform, chatbots, WhatsApp integrations, social media and other tools offered.

Cookies

Small data files stored on your device to improve user experience and analyze service usage.

Device

Any equipment that can access the service: computer, mobile phone, tablet or other connected device.

We use your personal information only for the following legitimate purposes:

Service Provision

Provide, maintain and improve our automation services

Account Management

Manage your registration, authentication and preferences

Communications

Send important notifications, updates and technical support

Continuous Improvement

Analyze usage and behavior to improve functionalities

Legal Compliance

Comply with legal and regulatory obligations

Security

Detect and prevent fraud, abuse and security issues

We implement high-level technical, administrative and physical security measures to protect your information:

Encryption in transit

All communications between your browser, WhatsApp, our servers and our providers travel encrypted with HTTPS/TLS

Access controls

Role-based access limited to the staff who need it, with centrally managed identities and passwords never stored in plain text

Continuous review

Error monitoring, periodic dependency updates and review of the team's access

You have the following rights over your personal data:

Know and access

Know and access, free of charge, the personal data we process about you

Update and rectify

Update or correct data that is partial, inaccurate, incomplete or misleading

Proof of authorization

Request a copy of the authorization you gave us, except where the law does not require one

Information on use

Be informed, upon request, of the use we have made of your personal data

Revoke and delete

Revoke your authorization and request deletion of your data when no legal or contractual duty to keep it exists

Complaint before the SIC

File a complaint with the Superintendencia de Industria y Comercio once you have submitted your claim directly to Cyberix

Our conversational assistants on the website and on WhatsApp reply using artificial intelligence. Here is what you should know:

1. 01When you write to one of our assistants you are talking to an automated system, not a person. The assistant identifies itself as such at the start of the conversation.
2. 02Your messages are sent, encrypted in transit, to the language model provider that generates the reply (currently Anthropic, United States) together with the context needed to answer. The provider acts as a processor and, under its commercial terms, does not use those messages to train its models.
3. 03We do not use your conversations to train our own or third-party models.
4. 04The assistant makes no decisions with legal effects on you. Quotes, contracts and any commitment are confirmed by a member of the team.
5. 05You may ask to speak with a person at any time during the conversation, or write to [email protected].
6. 06The contact details you share in the conversation (name, email, phone, company) are stored in our CRM to reply to you and follow up commercially, together with the date and channel on which you accepted this processing.

This policy has been in force since July 9, 2025 and its latest update is the one stated at the top of the document. Databases are kept for as long as the relationship with the data subject lasts and, afterwards, for as long as legal, accounting or contractual obligations require, or until the data subject requests deletion where no duty to retain exists.

The area responsible for handling inquiries and claims about personal data is Cyberix S.A.S Support, at [email protected].

When a company contracts our assistants or our CRM, the data of its customers, patients or prospects is processed by that company as controller, and by Cyberix as processor, under article 18 of Law 1581 of 2012. In those cases:

• The purpose, the data subjects' authorization and the applicable policy are those of the customer acting as controller. The assistant shows that customer's privacy notice at the start of the conversation.
• Cyberix processes the data only under the customer's instructions, under a Personal Data Processing Annex that forms part of the contract.
• If you are a patient or customer of a company that uses our services and want to exercise your rights, contact that company. If you write to us, we forward your request to the controller within 2 business days and confirm it to you.
• For clinics and health services, the assistant asks only what is needed to book and never requests diagnoses or medical records. The reason for the visit is sensitive data: the patient is not obliged to share it.
• Cyberix does not use its customers' customer data for its own purposes, to train models, or for advertising.

To provide the service, some data is transmitted to providers acting as processors, several of them outside Colombia. The transmission relies on article 26 of Law 1581 of 2012 and on SIC External Circular 005 of 2017, which recognizes the United States as a country with an adequate level of protection, and on your authorization where the law requires it. Each provider is bound by contract to process the data only on our behalf:

Meta Platforms, Inc. (WhatsApp Business Platform)

Transport of WhatsApp messages. United States.

Anthropic, PBC

Generation of the AI assistants' replies. United States. Its commercial terms exclude using your messages to train models.

Google LLC

Calendar, business profile, analytics and site tags, depending on the contracted service. United States.

Hostinger International Ltd.

Hosting of servers, databases and automations. Company based in Cyprus, with data centers in the United States, Europe, Brazil and Asia.

Cloudflare, Inc.

Content delivery network and site protection; data passes encrypted through its network. United States.

Wompi (Bancolombia)

Online payments. Colombia. Cyberix does not store card data.

We update this list whenever a provider changes. You can request the current version at [email protected].

We keep each category of data only as long as its purpose requires or the law demands (Decree 1377 of 2013, article 11). Once the period ends, the data is deleted or anonymized:

Account and customer data

For the duration of the commercial relationship and, afterwards, up to 10 years for the accounting, tax and contractual records the law requires us to keep.

Prospects and web assistant conversations

24 months from the last contact, or earlier if you request deletion.

WhatsApp conversations on behalf of customers

The period instructed by the customer acting as controller; by default, 12 months.

Automation execution data

72 hours.

Technical and security logs

90 days.

Backups

30-day rotation. A deletion reaches the backups in the next cycle.

Google APIs data

24-hour cache; when you delete your account, everything associated is erased within 30 days.

The site uses cookies and browser storage. Necessary ones always work; analytics and marketing ones only activate if you accept them in the cookie notice, and you can change your decision from "Cookie preferences" in the footer:

cyberix_cookie_consent and cx-consent

Necessary. Store your cookie decision. 180 days for the cookie; local storage until you clear it.

cx_session

Necessary. Keeps your session when you sign in on the site. Deleted on sign-out or expiry.

cx_locale and sessionId

Necessary. Remember your language and the chat assistant session.

_ga and _ga_* (Google Analytics)

Analytics. Measure visits and site usage in aggregate. Up to 2 years. Only with your consent.

Marketing tags (Google Tag Manager)

Marketing. Measure campaigns and enable relevant ads. Only with your consent; without it they do not load.

We write to you for commercial purposes only if you authorize it separately; replying to your inquiry or servicing your account is not marketing. Rules we follow:

• You can opt out at any time: reply STOP on WhatsApp, use the link in every email, or write to [email protected]. The opt-out is applied within 5 business days.
• We make commercial contact Monday to Friday between 8:00 and 18:00 and Saturdays between 9:00 and 13:00, Colombia time, and never on Sundays or holidays.
• We do not buy or use third-party contact lists.
• Appointment reminders, invoices and security notices are not commercial communications and are sent while the relationship exists.

Cyberix is undergoing verification with Google and uses Google API services to provide specific functionalities. Below we detail how we use these services and what data we access:

For any questions about this Privacy Policy or the processing of your personal data, you can contact us through:

Email

[email protected]

Phone

+57 312 794 9986

Address

Cl. 7D #43A-40, El Poblado. Medellín, Antioquia, Colombia.

Website

www.cyberix.com.co