Privacy and personal data processing policy

The service operates under the commercial name Cautia and receives personal-data requests at hola@cautia.ai. Cautia determines processing needed for accounts, security, support and contact requests.

For customer, insured-person and beneficiary information uploaded by an agency, the agency determines the purpose and acts as controller. Cautia processes that content on its behalf under the agency agreement. Requests concerning that content will be referred to the responsible agency with assistance in responding.

We process your email, provided name and profile, agency memberships and roles, preferences, acceptances, support requests and technical access and usage records. Purposes include authentication, permissions, requested tasks, evidence, abuse prevention and support. Enabled Cautia AI does not require your own AI API key.

Submitted files, messages and instructions may include identification, contact information, insured assets, policies, coverage and values. We store, read, extract and organize them for agency tasks. Optional channels provide connected-account information and content needed by authorized workflows.

We do not sell personal data or use agency documents for our own marketing or training our own model. Operational and security notices are separate from advertising; marketing consent is not a registration requirement.

Authorization is requested through unchecked boxes, with evidence of the accepted version retained. Account authorization covers access, operation and support, not consent on behalf of other people.

You are not required to submit sensitive data. Do not upload medical records, biometric data or information about minors in this pilot. Minimize personal information. Agencies must establish a lawful basis and, where required, obtain each person's prior, express and informed authorization before uploading their data.

Operations use Supabase for identity, databases and storage; Cloudflare for hosting, networking and execution; DeepSeek for AI; and Mistral for OCR where enabled. Each provider receives information needed for its function. Document and conversation text may leave Cautia infrastructure for processing by these services.

Connected channels may involve Composio and Google or Microsoft for email, and Kapso and Meta for WhatsApp, according to enabled features. Availability and permissions depend on the integration and provider terms.

Providers may process information outside Colombia under other jurisdictions. Transmissions and transfers require applicable legal safeguards; accepting this policy does not remove those duties. We do not promise Colombia-only storage or uniform retention or training policies across all providers. Ask hola@cautia.ai about a workflow before supplying restricted information.

Document access is scoped by agency, membership and permissions. Support access must be limited to necessity and confidentiality. No system offers absolute security. Report incidents to hola@cautia.ai.

Information is retained as needed for service, support, security or legal obligations. Request access, return or erasure; identity, authority and retention restrictions will be assessed. Backups and acceptance records may remain restricted for recovery and evidence. Immediate deletion of every copy is not promised.

You may access, update or correct information, request evidence of authorization, learn how data is used, and request erasure or withdraw authorization where permitted. Exercising rights is free. You may complain to Colombia's Superintendence of Industry and Commerce after any legally required prior procedure.

Email hola@cautia.ai with subject Privacy, your name, request and response address. Identity checks will be proportionate; do not send unsolicited sensitive documents. For agency data, identify the agency and document without unnecessary personal information.

Queries are handled within 10 business days, extendable by 5 with reasons and notice. Complaints are handled within 15 business days from the day after receipt, extendable by 8 with notice. Missing information is requested within 5 days; failure to complete a complaint within 2 months is treated as withdrawal. Other rules in Law 1581 of 2012 and its regulations apply.

This version takes effect October 19, 2026. Material changes to purposes or processing will be communicated and new authorization requested when appropriate. This policy does not replace agency obligations to its customers.