Privacy and Personal Data Processing Policy
Last updated: October 26, 2026
Read the Terms of Service1. Controller and scope
Restop S.A.S., a Colombian company with tax identification number (NIT) 901.429.289-2, operates under the PAI brand. Its contact address is DIAGONAL 67 31 # 150, Medellín, Antioquia, Colombia; telephone +57 3003523827. Customer Support handles data protection requests at soporte@productos-ai.com.
This Privacy and Personal Data Processing Policy covers the PAI website, applications, SaaS platform, products, customer support and integrations that refer to this document. It applies to our operations in Colombia and our services to customers in Latin America, the United States, Europe, Africa and other territories.
Processing is subject to Colombian Law 1581 of 2012 and its implementing rules, including Decree 1074 of 2015, and any other data protection laws applicable to the particular processing. PAI’s location in Colombia does not exclude mandatory protections or rights available to individuals in other countries.
2. Our own data and data processed for customers
PAI acts as a controller when it determines the purposes and means of processing, for example to administer subscriber accounts, manage business relationships, invoice and handle requests.
When a customer uses PAI to manage data about its contacts, users or consumers, the customer determines the purposes of processing and PAI acts as a processor to the extent it processes that data under the customer’s instructions. The customer must have a valid legal basis, inform individuals and obtain any required authorizations before adding data to the service.
A subscriber’s acceptance of this policy does not replace other individuals’ authorization or entitle the subscriber to use their data without a lawful basis. Data processing agreements with customers must address instructions, scope, confidentiality, security, providers, assistance with individuals’ rights and the return or deletion of information.
3. Information and processing purposes
Depending on the services used, we process identification and contact data such as name, email address and telephone number; account and organization information; contracting, billing and transaction information; support requests; and messages, documents, files and other content that a user or customer submits to PAI.
Technical and usage data may also be processed, including IP address, browser, device, access logs and activity events. Integrations may supply data necessary for the features enabled by the user.
Processing operations include collection, storage, consultation, use, disclosure and deletion, as appropriate. Their purposes are to create and administer accounts; authenticate users; provide contracted features, including AI and messaging; handle requests; manage payments and contractual obligations; protect the service and prevent abuse; resolve incidents; and comply with legal obligations.
Analysis of service operation and usage must respect the stated purpose and applicable privacy choices. PAI’s commercial communications serve a different purpose from communications needed to provide the service and are addressed in the communications section.
5. Transactional notifications and commercial communications
PAI uses the contact details provided to send necessary notifications about accounts, authentication, security, billing, support, contractual changes and service delivery. These transactional communications are distinct from advertising.
PAI may send commercial information about its own products, features, offers and services through authorized contact channels, with the prior, express and informed authorization required and subject to applicable legal restrictions. Contractual acceptance does not replace the specific requirements for valid marketing authorization.
You may request to unsubscribe from commercial communications or withdraw authorization for that purpose at any time and free of charge by emailing soporte@productos-ai.com and identifying the email address or telephone number to unsubscribe. Customer Support will handle the request. Unsubscribing does not close your account or prevent necessary service-related or legally required transactional notices.
6. Artificial intelligence and providers
PAI does not use user or customer data, including conversations, to train artificial intelligence models. Processing content to generate a response or perform a requested feature is distinct from using it to train a model.
To provide the service, PAI uses AI providers such as Anthropic, OpenAI and Google; Amazon Web Services (AWS) hosting; and WhatsApp and Meta messaging services. Depending on the feature used, these providers may receive and process the content and data necessary to perform it.
The scope of each provider’s processing depends on the integration, the contracted service and the applicable agreements. The statement about PAI’s use of data is not a blanket guarantee concerning every third-party product. You may ask Customer Support for information about the providers involved in processing your data.
AI-generated results may be inaccurate and should be reviewed in context. Customers are responsible for assessing the legal requirements of their use cases, particularly where they affect rights or produce consequential decisions about individuals.
7. Recipients and international processing
Data may be processed in Colombia and in other countries where providers needed to deliver the service operate. Data may also be disclosed to competent authorities where legally required, or to other recipients with a valid legal basis and for a disclosed purpose.
Under Colombian law, a transmission involves a processor acting on behalf of a controller; a transfer involves a recipient acting as a controller. Transmissions must be governed by the required agreements and obligations. International transfers subject to Colombian law must comply with Article 26 of Law 1581 of 2012 and applicable rules of the Superintendence of Industry and Commerce.
Where other territorial laws apply, including those of the European Economic Area or the United Kingdom, their transfer requirements must be met, through adequacy decisions, contractual safeguards or another legally permissible mechanism, as appropriate. This policy does not state that all countries provide equivalent protection or constitute blanket authorization to transfer data.
You may request information about the destinations and safeguards applicable to your processing through Customer Support.
8. Rights and requests
You may learn about, access free of charge, update and correct your data; request proof of authorization where required; obtain information about how your data is used; and request deletion or withdraw authorization where legally available. Deletion or withdrawal may be limited by legal or contractual retention obligations.
Write to soporte@productos-ai.com, addressed to Customer Support, or submit your request to the contact address above. Identify your relationship with PAI, the data or facts concerned and a reply contact. Only information necessary to verify your identity or authority and handle your request will be requested.
In Colombia, inquiries are answered within ten (10) business days of receipt. If an extension is needed, reasons and a response date will be provided, with no more than five (5) additional business days. Claims are answered within fifteen (15) business days starting on the day after receipt, extendable by up to eight (8) business days with prior notice of the reasons and response date.
If a claim is incomplete, correction will be requested within five (5) days of receipt. If the requested information is not received within two (2) months of that request, the claim will be considered withdrawn. A recipient without authority to resolve a claim will forward it to the appropriate party within two (2) business days and inform the individual. Once a complete claim is received, the relevant database will be marked “claim pending” within two (2) business days until resolution.
Under Colombian law, you may complain to the Superintendence of Industry and Commerce after completing the inquiry or claim procedure with the controller or processor. Where other laws apply, you may also exercise additional rights they provide, such as objection, restriction or portability, and contact the competent authority. Applicable deadlines and requirements will be observed.
If PAI processes your data on behalf of a customer, the request will be handled with the relevant controller in accordance with applicable obligations.
9. Retention and security
Data is retained for the period necessary for the disclosed purposes and the relationship with the user or customer, taking into account legal obligations, claims and applicable processing agreements. Closing an account does not mean immediate deletion of all information that must legally be retained.
When no purpose or obligation justifies retention, data must be deleted or anonymized under the applicable procedures. You may request information about retention criteria for a particular category of data.
PAI must apply appropriate technical, administrative and organizational measures to protect information against unauthorized access, use, alteration or loss. No system is completely secure. Incidents will be handled and notified in accordance with applicable legal and contractual obligations.
10. Sensitive data and children
General processing authorization does not by itself permit processing of sensitive data or children’s and adolescents’ data. Individuals are not required to authorize processing of sensitive data; where such processing is legally permissible, its sensitive nature and purpose must be disclosed and the required express authorization obtained.
Processing children’s data requires respect for their best interests, fundamental rights and other conditions under applicable law. Customers must not add such data to the service without first checking the requirements and measures relevant to the case.
12. Effective date and changes
This policy version was updated on October 26, 2026. The lifetime of the databases is linked to the purposes and retention criteria described here.
Material changes will be communicated through the appropriate channels before implementation where required by law. Where a change of purpose requires new authorization, it must be obtained before the new processing begins. Publishing a new version does not retroactively expand an earlier authorization.