Privacy notice

Who is responsible

KAURO DATA S.A.S. (a sociedad por acciones simplificada incorporated in Colombia, tax ID NIT 902120412-8) operates Kauro. Its registered address is Calle 109 # 15 BIS - 04 Apartamento 201, Bucaramanga, Santander, Colombia. Its postal contact is KAURO DATA S.A.S., Calle 109 # 15 BIS - 04 Apartamento 201, Bucaramanga, Santander, Colombia. Its legal contact is contact@kaurodata.com. Its phone number is +57 314 402 2549.

This notice takes effect on 2026-11-10.

For the information described below about the people who deal with Kauro, Kauro is the controller (responsable del tratamiento under Colombian law) and decides why and how it is used. For the CRM data that a customer uploads, Kauro is a processor (encargado del tratamiento) acting on the customer's instructions, as the data processing terms describe, and the customer decides why that data is processed.

What information is handled and why

Kauro handles the following, each for the purpose stated.

• Account and sign-in details of the people who use Kauro, such as name, business e-mail, role and company, and the facts of their sign-in, such as e-mail verification, two-step verification and session records; when a person signs in with an account at Google LLC, the name, e-mail address, whether it is verified, the account identifier and any workspace domain that Google LLC returns; and when a person uses a passkey, its public key only, because the passkey and any fingerprint or face check stay on the person's device: to run accounts and orders, protect access and send the notices the service needs.
• The answers given on the contact form, such as buyer type, destination, approximate size, timeline and a short description: to judge whether the service fits and to reply. An automatic reply goes to the address typed in the form, through Kauro's e-mail provider, and repeats nothing else from the form.
• Billing details, asked for before a customer's first order, such as the buyer's legal name, tax ID, address and tax status, accepted by an automatic rule from the declared country and tax identification, with details the rule flags going to a person: to invoice and to meet tax duties, which include reporting invoices to the Colombian tax authority. Kauro keeps the invoice file, with the buyer's legal name, tax ID and address, for as long as the tax rules require.
• The domain of a sign-in address as a digest with its class, never the address, and daily counts under digests of a person's identifier, a domain and a network: to limit abuse of the free check.
• The answer to the optional question after a delivery, a score and any comment the person writes, with the account and project and no user's name: to improve the service.
• Payment and refund details, such as the references of a transfer; the amount, time, transfer identifier and sender's name in the payment provider's notice, without an account number, bank code or address; the paying bank the buyer states; the sender's details as Kauro's bank statement shows them, held in the matching records only as a digest; and, for a refund, the holder's company name, the invoice address and the details needed to send it: to match payments and to return money.
• Support messages written in the workspace or sent by e-mail to Kauro's support address: to answer them and keep the record of each case.
• The CRM files that a customer uploads and the data derived from them, such as profiles (which hold column names and counts, shown to the customer's authorized users), proposals, decisions and delivery packages, and, after the files are deleted, the project's record of its column names, its decisions and its destination details, which a repeat project the customer starts can reuse (a column name is whatever the file's first row holds, so upload files with a header row): to run the free data health check the customer asks for and to prepare the delivery the customer ordered.
• When model assistance is used for a project, a limited context for a model-assisted proposal, sent only to a model provider listed below and deleted with the project data it came from.
• Statistics about visits to Kauro's website, kept without cookies and without storing anything on your device: the page visited and when, whether a sign-up or contact link was followed and from which section, the website that linked to it (its name only), the campaign tags and referral code in the link, and a daily code computed from your network address and browser. For about two days that code can be matched again to a network and a browser, so Kauro treats it as personal information; it is deleted at the first visit to the website after those two days, and the visit can then no longer be tied to a network or a browser. When you create an account within those two days, Kauro records which visit led to it: to learn which pages and channels bring customers. A browser that sends a Do Not Track or Global Privacy Control signal is not counted.
• The referral code used for a customer account, whether it came through a link or was typed, when, and which user applied it, and a first-party cookie (kauro_ref) on the device of a person who opens an affiliate link, holding only the code and the click for 180 days: to record which affiliate introduced the account and to work out what that affiliate is owed. It is deleted in the browser at any time.
• Details of the people and companies who sign up as affiliates, such as name, e-mail address, country, the payment details they give, the record of their acceptance of the affiliate agreement, digests of a tax identification and a payout account when Kauro records them, and the amounts they are owed and paid: to send their monthly statement (the payment service reads the name and e-mail address for that), apply the self-referral rule and pay what is due. Kauro treats the digest of a tax identification as personal data.
• Business contact details of people at companies and agencies that Kauro's independent sellers or its affiliate manager contact about Kauro's service. Until a named person agrees, only the company and the channel of the first contact are recorded. Once the person agrees, their name, role, business e-mail address or professional profile, the record of that agreement with its date and channel, and notes of the conversation are kept in Kauro's own sales sheets: to present Kauro's service, answer the person's questions and follow up the conversation they agreed to. The first message says who is writing, that Kauro pays them, how the contact was found and how to stop the messages. Kauro does not collect personal, non-business contact details for this, nor sensitive data or the data of children.
• Details of the independent contractors who work for Kauro, such as its sellers, its affiliate manager and freelance support: name, identity and tax numbers, contact details, payment account, tax and social security documents, and the contract with its statements and claims: to run and pay each contract and meet Kauro's tax, accounting and social security duties. Kauro shares them with its accountant, its bank and payment services, and with authorities when the law requires.
• Whether a person has stopped follow-ups or authorized re-clean reminders, with a log of each act (purpose, channel, time, text version and source), and a random code for the stop link: to honour those choices.
• Minimized operational and security records that hold no CRM content and no secrets: to run the service safely.

Authorization and choices

Where Colombian law requires your prior, express and informed authorization, Kauro asks for it before it collects the information, and keeps proof of it.

Commercial messages are optional and are authorized separately. They never condition the service, and you can withdraw that authorization at any time.

For a person Kauro's sellers or affiliate manager contact, the basis is that person's prior authorization, asked for when they first want to continue the conversation and recorded with its date and channel. A company's own details are not personal information. If the person does not agree, or does not reply within 30 days, their details are deleted, and only a mark not to contact them again is kept if they asked to stop. For a contractor, the basis is the authorization given in the contract, which is needed to pay them.

Kauro does not ask for sensitive data; if a question ever touches it, answering is optional. Kauro does not knowingly handle the data of children or adolescents.

What Kauro does not accept

Credentials and authentication secrets, full payment card data, sensitive data as Colombian law defines it (such as health or biometric data, political or religious views, sex life and union membership) and its equivalents under other laws, data of children and adolescents, and any other category whose obligations or security needs go beyond the qualified service are not accepted.

A field called notes can hold sensitive information. Kauro cannot promise to find it in uploaded files, so do not upload material from the excluded categories.

If prohibited material is found, Kauro pauses the affected work, limits access, tells the authorized contact and follows the deletion and incident procedure. It does not copy the material into a support case or a model prompt to explain the problem.

Where information is processed and who receives it

These providers process information under Kauro's instructions. Each entry says what it receives. No provider receives raw CRM files merely because it is one of Kauro's business vendors. Kauro's accountant receives at each month end the list of sales, with the buyer's legal name, tax ID and country, to keep the books, and receives no CRM records.

Kauro's independent contractors handle information for Kauro as its processors (encargados del tratamiento under Colombian law), under written contracts that bind them to Kauro's instructions, to confidentiality and to this notice: its sellers and its affiliate manager handle the sales and affiliate records they work on, and freelance support handles the written support questions it answers. None of them gets access to a customer's account, files or CRM data. They may work from outside Colombia, and they work in Kauro's own company workspace, whose provider is listed below.

• Amazon Web Services, Inc.: Cloud hosting of the service: compute, database, file storage, queues, secrets, logs and sign-in (Amazon Cognito), the sending of sign-in e-mail such as sign-up codes and password resets (Amazon SES, from Kauro's own domain), the sending of affiliates' sign-up codes, welcome messages and monthly statements (Amazon SES, from Kauro's own domain), the receipt of e-mail replies to support cases once that path is enabled (Amazon SES, with each received message kept for 14 days), and language models through Amazon Bedrock only when model assistance is enabled. It receives the customer data uploaded to the service, the name and e-mail address of the people who sign in and of affiliates and, once that path is enabled, the replies sent to Kauro's support address; on Amazon Bedrock it receives only the limited context the data processing terms describe. Location: United States (AWS region us-east-1; Amazon Bedrock, when enabled, only in United States regions). Transfer basis: Transmission to a processor under a written contract with Kauro's instructions; the United States is on the Colombian data protection authority's list of countries with an adequate level of protection.
• Resend: Sending the service e-mail (account, invitation, payment status, delivery, deletion and support notices, the buyer's copy of each invoice, and the automatic reply to the contact form). It receives the recipient's name and e-mail address the text of the message and the attached invoice; no CRM records and no customer files. Location: United States (sent through Amazon SES in AWS region us-east-1). Transfer basis: Transmission to a processor under a written contract with Kauro's instructions; the United States is on the Colombian data protection authority's list of countries with an adequate level of protection.
• Google LLC (Google Workspace): Kauro's company e-mail, including the support mailbox that receives customer replies, and the company's shared sheets in which Kauro and its contractors keep the sales, affiliate and payout records. It receives what people write to Kauro by e-mail and what those sheets hold; customers are asked never to send CRM records by e-mail. Location: Google's data centres, which may be in several countries; Kauro has not restricted the location to a data region. Transfer basis: Transmission to a processor under a written contract with Kauro's instructions (Google's Cloud Data Processing Addendum, accepted on 27 October 2026).
• Cloudflare, Inc.: Domain name service without proxying the site, and an encrypted off-site copy of Kauro's internal repository and records (Cloudflare R2). The copy is encrypted before it leaves Kauro and holds no customer files and no production database. Location: Eastern North America (the Cloudflare R2 location hint ENAM, which does not restrict the jurisdiction). Transfer basis: Kauro's own records, encrypted before they leave Kauro with a key only Kauro holds; Cloudflare receives no readable personal data and no customer files.

International transfers

Kauro's main providers process information outside Colombia, as listed above. A provider that processes information for Kauro receives only what its task needs and is bound by contract to Kauro's instructions: under Colombian law this is a transmission to a processor, not a transfer to a new controller. The basis of each one is listed above.

Providers that decide for themselves

The payment provider and Kauro's bank handle payment information for their own regulated purposes, and the tax authority receives invoice information because the tax law requires it. They decide how they use that information, so they are not listed above as Kauro's processors.

A person who chooses to sign in with an account at Google LLC deals with Google LLC directly, under its own terms. Google LLC decides how it handles that sign-in and learns that the person signed in to Kauro; it receives no CRM records and no customer files through that sign-in.

How long information is kept

Kauro keeps uploaded files and their results only for the windows below. A day is an elapsed period of twenty-four hours.

Account, billing, payment, support and affiliate information is kept while the relationship lasts, and afterwards only for the period that commercial, tax and other legal rules require. A request to stop messages is kept so that it can be honoured. The record of which visit led to an account and which affiliate introduced it is kept with the account's records and deleted with them, up to six months after the account closes, unless commercial or tax rules require keeping it. A person's stop and authorization records are kept for as long as needed to keep honouring the stop, and are then deleted with the account's records. The details of a person Kauro's sellers or affiliate manager contacted are kept while the conversation lasts, and are deleted no later than 12 months after the last contact unless the company becomes a customer. A contractor's details are kept while the contract lasts, and afterwards for the periods that commercial, tax and social security rules set.

Deleted data is removed from the storage of Kauro's hosting provider within seven days after the deletion, except while a hold that an incident investigation or the law requires keeps it.

• An upload that is not completed: It is removed when its inspection ends or 24 hours after the upload started, whichever comes first.
• The files and results of a free data health check that is not followed by a purchase: They stay available for 7 days after the check is ready or has failed, and are removed no later than 14 days after the files were sealed.
• The files and the delivery package of a purchased project: They stay available for 7 days after the first package is ready, and are removed no later than 14 days after payment is confirmed.
• A project delivered in stages: Its workflow ends 21 days after the first stage is released and no later than 30 days after payment is confirmed; the final delivery then stays available for at most 7 days. Each stage shows its own deadline and the date of deletion.
• Import receipt data: It is removed 7 days after its verification reaches a final state, or with the project when a staged project still needs it.
• Target settings your team confirmed: A saved setting is used to prepare a new delivery for 30 days at most, and stops being used at once when the target changes in a material way. It stays in the project's record, and a repeat project can start from it only after your team confirms it again.
• The project's record: Its column names and counts, decisions and destination details stay after the files are deleted, while the account is active and up to six months after it closes. A repeat project can reuse them.
• The limited context sent to a model provider: It is deleted together with the project data it came from.
• Application logs: They are kept for 30 days and contain no CRM content and no secrets.
• Minimised security records: They are kept for 180 days, and longer only under an explicit legal basis.
• Financial and legal records: They are kept for the period the applicable rules require and are stored apart from CRM contents.

Your rights

Under Colombian law you can know, update and correct your information; ask for proof of the authorization you gave; be told how your information has been used; withdraw your authorization or ask for deletion where no legal or contractual duty requires keeping the information; access it free of charge; and complain to the Superintendencia de Industria y Comercio once you have completed the query or complaint procedure with Kauro. The law that applies to you may give you other rights, such as restriction, objection or portability. These rights apply to everyone this notice covers, including a person Kauro's sellers or affiliate manager contacted, who can also ask at any time to stop being contacted.

A request is checked and limited to what it covers before anything is disclosed or deleted. CRM data can belong to a customer of Kauro, and that customer decides how its own data is handled, so Kauro coordinates with the customer instead of giving one person's record to someone it has not verified. Kauro keeps only the minimum needed to show that a request was made and answered.

A deletion request does not remove records that the law requires Kauro to keep, such as invoices. Kauro explains which records remain and why.

Privacy requests and complaints

Send a request or a complaint to contact@kaurodata.com, or by post to KAURO DATA S.A.S., Calle 109 # 15 BIS - 04 Apartamento 201, Bucaramanga, Santander, Colombia. Kauro records the date it received the request and the deadline that the applicable law sets, and answers within it.

Under Colombian law Kauro answers a question about your information within ten business days, and can extend that once by up to five business days, telling you why and when it will answer before the first period ends. It resolves a complaint within fifteen business days, and can extend that once by up to eight business days in the same way. If a complaint is incomplete, Kauro asks you within five days of receiving it for what is missing; if two months pass without that information, the complaint is treated as withdrawn.

Security incidents

If an incident affects information, Kauro identifies what was affected, contains it, and notifies the people and authorities that the law and its contracts require, including the Colombian data protection authority. It gives the facts it knows first and updates them as the investigation continues.

Full processing policy

Kauro's Personal Data Processing Policy sets out the full procedures. Ask the legal contact for a copy; once it is published, it is on this website next to this notice. Kauro announces any substantial change to it before the change applies.

Changes and versions

A change to this notice is published as a new version with its own effective date. The version label at the top of this page names the document, its effective date and a digest of its exact text, so a label always identifies the same words. An order keeps the version its customer accepted; a later edit to this page does not amend it.

Contact

Write to contact@kaurodata.com, or by post to KAURO DATA S.A.S., Calle 109 # 15 BIS - 04 Apartamento 201, Bucaramanga, Santander, Colombia.