1. Data controller
The controller of the personal data of platform users is:
- Name: Notific
- Domicile: Bogotá D.C., Colombia
- Email: legal@notific.app
2. Definitions
- Data subject: the natural person whose personal data is processed.
- Personal data: any information that identifies or can identify a natural person.
- Processing: any operation on personal data, such as collection, storage, use, transfer or deletion.
- Controller: whoever decides on the database and the processing.
- Processor: whoever processes data on the controller's behalf.
- Authorization: the data subject's prior, express and informed consent.
3. Data we process
As controller, about Notific users:
- Sign-up data: name, email and password (stored only as a hash).
- The WhatsApp numbers you connect and the linked-device session, stored encrypted.
- Billing and transaction data. Card details are handled directly by the payment gateway; we do not store them.
- Technical data: IP address, browser type, activity logs and the cookies needed to keep you signed in.
As processor, on behalf of each user: their recipients' phone numbers, names and variables, and message content. In that case the user is the controller and must have their recipients' authorization.
4. Why we use your data
- To create and manage your account and provide the messaging service.
- To process payments, issue receipts and keep accounting records.
- To send transactional emails: verification, password resets, number alerts and service notices.
- To prevent fraud, spam and uses against the Acceptable use policy, and to keep the platform secure.
- To handle support requests, inquiries and complaints.
- To meet legal obligations and requests from authorities.
- With your consent, to send you product news. You can unsubscribe at any time.
5. Sensitive data and minors
We do not request sensitive data or data from children and adolescents. If you use Notific for reminders that may reveal sensitive data (for example health data, such as medication reminders), you are responsible for obtaining the data subject's express authorization. Answering questions about sensitive data is always optional.
6. Your rights
As a data subject you have the right to:
- Know, update and correct your personal data.
- Request proof of the authorization you gave us.
- Be informed about how your data has been used.
- File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law.
- Revoke your authorization and request deletion of your data when there is no legal or contractual duty to keep it.
- Access your personal data free of charge.
7. How to exercise your rights
Send your request to legal@notific.app with your name, your account email, a description of what you are asking for and any supporting documents. We may ask for additional information to verify your identity.
- Inquiries: answered within ten (10) business days, extendable by five (5) more business days with notice of the reason.
- Complaints (correction, update, deletion or breach): answered within fifteen (15) business days, extendable by eight (8) more business days with notice of the reason.
- If a complaint is incomplete, we will ask you to complete it within five (5) days. If two (2) months pass without a reply, we will consider it withdrawn.
Before going to the SIC, you must first complete this procedure with us.
8. Providers and international transfers
To operate we use infrastructure, database, email and payment providers. Some have servers outside Colombia, so your data may be transferred to other countries. We only share what is needed to provide the service, with providers that offer adequate protection and under confidentiality agreements. We do not sell your personal data.
9. Security
We apply reasonable technical and organizational measures: hashed passwords, encrypted WhatsApp sessions and webhook secrets, HTTPS connections and restricted data access. No system is infallible; if an incident affects your data, we will inform you and report it to the SIC as required by law.
10. Retention
We keep your data while your account is active and for as long as needed to meet legal, accounting and tax obligations. Message history is kept so you can review it and can be deleted when you close your account.
12. Validity and changes
This policy is effective from the update date shown above. Databases will be kept for as long as needed for the purposes described. If we make substantial changes, we will tell you before applying them.