Privacy and Data Protection Policy

1. Data Controller

Base Computing S.A.S., a company incorporated in the Republic of Colombia, is the controller for personal data collected through the Trace service and its associated channels.

• Legal name: Base Computing S.A.S.
• Domicile: Medellín, Colombia.
• Website: basecomputing.com.co
• Data protection contact: [email protected]

2. Regulatory framework

Personal data processing is governed primarily by Colombian Law 1581 of 2012, Decree 1377 of 2013, the SIC Circular and related regulations. For data subjects located in other jurisdictions, Base Computing also observes the general principles of minimization, purpose limitation, legality and proportionality.

3. Definitions

• Data subject: the individual whose personal data is processed.
• Controller: Base Computing, which decides on the processing.
• Processor: any party processing data on behalf of the Controller.
• Personal data: information that identifies or can identify a natural person.
• Sensitive data: data that affects privacy or whose misuse may cause discrimination. Trace does not request sensitive data.
• Authorization: prior, express and informed consent of the data subject.

4. Categories of data we process

4.1 Customer data (contracting user)

• Identification: first name, last name, ID number, account creation date.
• Contact: email, phone, address.
• Business: legal name, tax ID, business address, sector, size.
• Account: encrypted credentials, preferences, configuration.
• Billing: payment history, amounts. Payment method data is processed by PCI-DSS certified payment providers; Base Computing does not store full card numbers.
• Usage: activity logs, IP, browser, OS and feature-usage metrics. These metrics are tied to a persistent pseudonymous identifier (not to your name), so they are treated as personal data rather than anonymous data. See section 11.

4.2 Third-party data uploaded by the Customer

When the Customer uploads to the service personal data of their own customers, suppliers or end users (name, email, phone, purchase history), Base Computing acts as Processor. The Customer, as Controller, represents having obtained valid authorization from those data subjects to have their data processed in SaaS platforms and shared with processors.

5. Purposes of processing

Base Computing processes personal data for the following purposes:

• Create, maintain and manage the Customer's Trace account.
• Provide the contracted service and its features.
• Process payments, billing and tax obligations.
• Handle inquiries, requests, complaints and claims.
• Send operational communications (service changes, incidents, maintenance, term updates).
• Send commercial communications about Trace and Base Computing products, with the Customer's consent.
• Improve the service by analyzing how features are used, via analytics tools that rely on pseudonymous identifiers.
• Answer the questions the Customer puts to the Trace assistant about their own data, under the terms of section 12.
• Comply with legal, regulatory and accounting obligations.
• Prevent fraud, abuse and security violations.

6. Data subject's authorization

By creating an account and accepting these terms, the data subject grants express, prior and informed authorization for processing their personal data under this Policy. Authorization may be revoked at any time by request to the contact email. Revocation is not retroactive and may make it impossible to continue providing the service.

7. Data retention

• Accounting and billing data: 10 years (Article 28 of Law 962 of 2005).
• Operational and account data: up to 30 calendar days after account termination to allow export; then deleted from active systems.
• Backups: up to 90 days after termination.
• Security and audit logs: up to 2 years for incident investigation.

8. Data subject rights

Under Colombian Law 1581 of 2012, the data subject has the right to:

• Know, update and rectify their personal data.
• Request proof of the authorization granted.
• Be informed about the use of their data.
• File complaints with the Superintendency of Industry and Commerce (SIC).
• Revoke authorization and request deletion when there is no legal or contractual duty to retain.
• Access free of charge their data.

9. How to exercise these rights

Send a communication to [email protected]indicating: (i) full name and ID; (ii) clear description of the right exercised and underlying facts; (iii) notification address or email; (iv) supporting documents when applicable.

Legal response times:

• Inquiries: up to 10 business days, extendable for 5 more.
• Complaints: up to 15 business days, extendable for 8 more.

10. Information security

Base Computing implements reasonable technical, administrative and organizational measures to protect personal data against loss, unauthorized access, misuse, alteration or disclosure:

• Encryption in transit (TLS 1.2 or higher) and at rest when applicable.
• Password storage with hashing functions (never in plaintext).
• Role-based access control.
• Audit logs of sensitive operations.
• Periodic backups.
• Confidentiality agreements with staff and providers.

No system is invulnerable. If we detect a security breach affecting data subjects, we will notify the affected parties and the competent authority within legal timeframes.

11. Processors and third parties

To provide the service, Base Computing relies on providers acting as processors under contractual instructions (cloud infrastructure, payment gateways, transactional email). Only the strictly necessary data is shared, under confidentiality and protection clauses equivalent to those in this Policy.

For usage analytics, and always with the user's prior consent on the sites where it is requested, two providers are used:

• PostHog Inc. (United States) — product analytics, error tracking and replay of interface interaction. Acts as a data processor: it processes data solely on our instructions. posthog.com/privacy.
• Microsoft Corporation (United States) — Microsoft Clarity: heatmaps and replay of interface interaction. Microsoft acts as an independent controller and may process the data for its own purposes under its privacy statement. privacy.microsoft.com.

Both tools run with masking enabled: form field contents are replaced in your own browser before being sent, so what you type never reaches their servers. Analytics data is retained for up to one year in PostHog and up to nine months in Clarity.

For booking sales meetings, HubSpot, Inc. (United States) is used, acting as a data processor. It handles only the data the person voluntarily enters to book an appointment on the /contacto page — name, email address and any message they choose to add — for the sole purpose of arranging and holding that meeting. It is not fed from other sources, is not used for advertising, and is not active on any other page of the site. legal.hubspot.com/privacy-policy.

The language-model providers involved when the Customer uses the Trace assistant are listed separately, in section 12.

12. Artificial-intelligence assistant (Arnold)

Trace includes a conversational assistant, Arnold, that answers natural-language questions about the data the Customer has loaded. It is an ancillary, optional feature: it is only available to businesses that have it enabled, it only runs when a user opens it and types a question, and it never runs on its own.

12.1 What information is transmitted

To draft an answer, the assistant transmits to a language-model provider the text of the question and the results of the queries it runs against the Customer's database. Specifically, the following may be transmitted:

• The question, exactly as the user wrote it.
• The business name.
• Product and category names, quantities, amounts and dates.
• Customer and supplier names, when the question involves them (for example, "who owes me money?"). These are personal data, which is why the provider acts as a data processor.

Email addresses, phone numbers, postal addresses, identity-document numbers, credentials and payment-method data are never transmitted. The assistant has no access to those fields — not even when it looks up a customer by name, where it only obtains the name and an internal identifier.

Whatever the user types into the chat is transmitted along with the question. Personal or sensitive data that is not needed for the query should therefore not be typed into it.

12.2 Who processes it

The language-model providers that may be involved act as data processors, solely to produce the answer to that specific query:

• Google LLC (United States) — Gemini.
• Groq, Inc. (United States).
• Cerebras Systems Inc. (United States).
• NVIDIA Corporation (United States).
• Microsoft Corporation (United States) — GitHub Models.
• Mistral AI SAS (France).

All of them process data in jurisdictions included by the Superintendencia de Industria y Comercio in its list of countries offering an adequate level of protection. A request is served by the first available provider; the order may vary with each service's availability. No provider other than those listed receives Customer data.

12.3 Use for model training

Base Computing only enables providers and plans whose applicable terms do not permit using the submitted content to train or improve their models. Where a provider offers that guarantee only on its paid plan, that plan is purchased or the provider is not enabled.

12.4 Retention of conversations

Conversations are stored in the Trace database so the user can return to them. They are private to whoever wrote them: other users of the same business cannot see them. They can be deleted at any time from the chat itself, and are removed along with the rest of the account data within the periods set out in section 7.

12.5 Scope of the answers

The assistant makes no decisions and produces no legal effects on any person: it answers questions about data the Customer already holds. Its answers may contain errors and do not constitute accounting, tax, financial or legal advice. Each answer states which queries were run to produce it, so that the Customer can verify it before taking any decision.

13. International transfers

Data may be processed on servers located outside Colombia. Specifically, the analytics and meeting-scheduling data described in section 11 is processed in the United States, and the assistant data described in section 12 in the United States and France: countries included by the Superintendencia de Industria y Comercio in its list of jurisdictions offering an adequate level of data protection, under article 26 of Law 1581 of 2012.

Where a transfer targets a jurisdiction without adequate protection, Base Computing adopts contractual safeguards ensuring protection equivalent to Colombian legislation.

14. Processing of minors' data

Trace is not directed at minors. Base Computing does not intentionally collect personal data from persons under 18. If a minor has provided data, their legal representatives may request deletion at the contact email.

15. Cookies

The use of cookies and similar technologies is governed by the Cookie Policy, an integral part of this Privacy Policy.

16. Changes to this Policy

This Policy may be amended at any time to reflect legal, operational or service changes. Material changes will be communicated to the data subject by email or from the Trace panel at least 15 calendar days before they take effect.

17. Contact

For any inquiry, complaint, claim or exercise of rights related to this Policy, write to [email protected] with the subject "Personal data".