Privacy and Personal Data Processing Policy

This policy applies to the personal data we process through our website, our artificial intelligence agents on WhatsApp, phone calls, voice widget, web chat, SMS, Instagram, and Messenger, and in our relationship with customers and prospects.

It is governed by Colombian Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015), and other Colombian data protection rules. When we process data of people located in the European Union, we also apply the General Data Protection Regulation (GDPR).

• As controller: we process data of people who visit our website, talk to our agents to learn about Fluya, request a demo, or are our customers and business contacts.
• As processor: when we operate AI agents for our customers (for example, a clinic, a dealership, or a real estate company), we process their prospects’ data on their behalf and under their instructions. In that case, our customer is the controller and must have the data subjects’ authorization and its own privacy policy. To exercise your rights over that data, you can contact that company or write to us and we will forward your request.

• Identity and contact: name, phone number, WhatsApp or social media profile name, email address, and company.
• Conversation content: text messages, voice notes, images, and files you send via WhatsApp, web chat, SMS, Instagram, or Messenger.
• Calls: audio recording, transcript, and summary of calls handled or made by our voice agents.
• Website voice widget: audio from your microphone, only while the conversation is active and after you allow it in your browser.
• Commercial information: need or product of interest, budget, purchase timeline, availability, and booked appointments.
• Browsing: approximate IP address, device and browser type, pages visited, and clicks and scrolling within each page, collected through Google Analytics and Microsoft Clarity cookies. Clarity may create anonymous browsing recordings in which the text you type is hidden.

We do not request sensitive data. If you choose to share it in a conversation (for example, health information when contacting a clinic), it will only be used to handle your request. You are not required to answer questions about sensitive data.

• Answering your inquiries and talking with you on the channel you choose.
• Qualifying your commercial interest, booking meetings or demos, and transferring the conversation to a representative.
• Following up on open requests and, if you authorized it, sending you commercial information about Fluya.
• Providing and improving our services, monitoring quality, and handling complaints.
• Measuring and improving how the website works.
• Complying with legal, contractual, and accounting obligations.

Calls with our voice agents are recorded and transcribed to keep a record of the conversation, book correctly, monitor quality, and handle complaints. We inform you at the start of the call. If you do not want to continue a recorded call, you can end it and ask us to contact you another way.

Our agents generate responses automatically using third-party language models, such as those from OpenAI, Google (Gemini), and Anthropic (Claude). You can always ask to speak with a person.

The agents classify commercial interest to prioritize attention, but they do not make decisions that produce legal effects on you: final commercial decisions are made by people. We do not sell your data or use it for purposes other than those described in this policy.

We only share data with providers that help us deliver the service, under confidentiality and security agreements:

• Meta Platforms: WhatsApp Business, Instagram, and Messenger.
• Artificial intelligence providers: OpenAI, Google, and Anthropic.
• Telephony, voice, and transcription providers.
• Cloud hosting and infrastructure providers.
• Google Analytics and Microsoft Clarity: website measurement, heatmaps, and anonymous browsing recordings.
• The CRM and calendar of the customer we handle the conversation for, when acting as processor.
• Authorities, when required by law.

Some of these providers store or process data outside Colombia, mainly in the United States. By accepting this policy you authorize those transfers, which we carry out with providers that offer adequate levels of protection and under the contractual safeguards required by law.

Our website uses Google Analytics and Microsoft Clarity cookies to measure visits, understand how each page is used (heatmaps and anonymous browsing recordings), and improve the experience. You can block or delete them in your browser settings or install the Google Analytics opt-out add-on. The site will keep working without them.

We keep data for as long as needed for the purposes described, while a commercial relationship exists, or as required by law. When acting as processor, we keep data according to the controlling customer’s instructions. After that period, we delete or anonymize it.

As a data subject, you have the right to:

• Know, update, and correct your personal data.
• Request proof of the authorization you gave us.
• Be informed about how we use your data.
• Revoke your authorization and request deletion of your data when there is no legal or contractual duty to keep it.
• Access your data free of charge.
• File complaints with Colombia’s Superintendence of Industry and Commerce (SIC) after completing the process with us.
• Ask us not to contact you for commercial purposes. On WhatsApp or SMS, simply reply that you no longer want to receive messages.

If you are in the European Union, you may also exercise the rights to restriction of processing, objection, and data portability, and lodge a complaint with your data protection authority.

Write to info@fluya.ai with your name, the phone number or email you used to interact with us, your request, and a way to reply to you. We may ask for additional information to verify your identity.

• Inquiries: we reply within 10 business days, extendable by 5 more business days if needed, in which case we will tell you why.
• Complaints (correction, update, deletion, or non-compliance): we reply within 15 business days, extendable by 8 more business days. If a complaint is incomplete, we will ask you to complete it within 5 days; if 2 months pass without a response, we will consider it withdrawn.

We apply reasonable technical, human, and administrative measures to protect data against loss, unauthorized access, or misuse, including restricted access to information and encrypted communications with our providers.

Our services are intended for businesses and adults. We do not knowingly collect data from people under 18. If we find that we have received it, we will delete it.

This policy is effective as of October 17, 2026. If we make material changes, we will publish the new version on this page with its effective date.