Personal data processing policy

1. Who is responsible for your data, and how to reach us

The data controller is Thrust X LLC, which operates the Clicalto brand.

Our single channel for anything to do with personal data — questions about this policy, requests, complaints, and the exercise of any of your rights — is the email address success@clicalto.com. We do not handle these requests through any other means.

This policy follows Colombia's Law 1581 of 2012 and Decree 1377 of 2013, where most of our clients are. If you are elsewhere, we give you these same rights and these same deadlines, on top of whatever your own law grants you; write to the same address.

2. What data we collect, and when

Check-ins and meetings: if you book a meeting or message us, we use your name, email or number and what you tell us about your business only to prepare the conversation and reply to you.

Onboarding and sign-up: name, email, phone, any website you already have, the service you are hiring and your project description; your company and brand details; and the text, images, logos and files you upload. We also record how you found us and the IP address the form was sent from, the latter only to limit abusive submissions.

Access to your platforms: we never ask for or store your passwords. Access is granted by inviting our email address as a collaborator, and you can revoke it whenever you want.

Payments: your card is processed and stored by Stripe. We neither see nor store your full card number; we keep only the identifiers Stripe returns to us and the status of your subscription.

Editing your site by message: if you use the WhatsApp channel to request changes, we keep your number, the messages you send and the history of changes applied to your site.

We do not ask for sensitive data (health, ethnic origin, biometric data, political or religious beliefs, sexual orientation) or data about minors. Please do not send it through these channels. If it reaches us unrequested, we delete it.

3. What we use it for

To quote your project and reply to you; to deliver the service you hired (building, publishing and maintaining your site, working on your visibility in search engines and AI assistants, and managing your ads where applicable); to charge and invoice you; to communicate with you about your service; to measure and improve our own site; and to meet legal, accounting and tax obligations.

We do not sell your data, we do not rent it, and we do not hand it to third parties so they can advertise to you. If we ever wanted to use it for a purpose outside this policy, we would ask you separately.

4. Your authorisation, and how to withdraw it

We process your data with your authorisation, which you give when you submit your details during onboarding and accept the terms, or when you write to us directly. We also process it where necessary to perform our contract with you or to comply with a legal obligation.

You can withdraw your authorisation at any time by writing to success@clicalto.com. If you withdraw it while the service is active, bear in mind that we will no longer be able to deliver it. We will keep only what the law requires us to keep.

5. Who we share it with

Only the providers we need in order to operate, and only to deliver your service. They act as processors, under our instructions and bound by their own confidentiality and security commitments.

Today they are: Vercel (site hosting and storage for the files you upload), Neon (database), Stripe (payments and subscriptions), Resend (outgoing email), Twilio (WhatsApp messaging), Google (Analytics and Search Console, for measurement), and Anthropic (the artificial intelligence model that processes your messages when you request a change to your site).

We may also hand data to an authority where a rule or a court order requires it. If that happens and the law allows it, we will tell you.

6. Where your data lives, and international transfers

Our providers run servers outside Colombia, mainly in the United States and the European Union. This means your data is transferred to and stored abroad.

By authorising the processing you accept that international transfer. We work only with providers that offer adequate security levels and contractual commitments to protect it.

7. How long we keep it

If you asked for a quote and did not hire us, we keep your data for up to 24 months and then delete it.

If you are a client, we keep it for as long as the service lasts and afterwards for as long as the accounting, tax and legal obligations that apply to us require. Anything we no longer need, we delete.

When the service ends, and if you ask within the following 30 days, we give you a free export of your content and your data in standard formats, exactly as the terms of service say.

8. Your rights

As the owner of your data you can: find out what data of yours we hold and how we use it; update and correct it when it is incomplete or wrong; ask us to delete it, unless a legal or contractual duty requires us to keep it; withdraw your authorisation; ask for proof of the authorisation you gave us; and file a complaint with Colombia's Superintendence of Industry and Commerce.

Nobody can require your sensitive data or a minor's data from you, and answering questions about them is always optional.

9. How to exercise your rights, and how fast we answer

Write to success@clicalto.com from the address you contacted us with, telling us what you need. If you write from a different address we may ask for something that confirms it is you, purely so we do not hand your data to the wrong person.

We answer queries within ten business days at most. Complaints (asking us to correct or delete something, for instance) we resolve within fifteen business days at most, extendable by a further eight business days if we explain why we need the extra time. If a complaint is incomplete, we tell you within the following five days so you can complete it.

Before going to the Superintendence of Industry and Commerce, the law asks that you have raised the complaint with us first. We would rather solve it with you.

10. Security

All traffic is encrypted. The files you upload are stored with private access. Access to the database is restricted to whoever needs it to do the work, and we store no passwords of yours for any platform.

No system is infallible. Should an incident affect your personal data, we will tell you by email and report it to the authority where the rules require it.

11. Cookies and measurement

We use Google Analytics with the IP address anonymised, to understand which pages get visited and how the site performs. On onboarding pages we strip the token from your link before sending anything to analytics, so it is never recorded.

We use no advertising cookies and we do not track you across other sites. You can block cookies in your browser or install Google's Analytics opt-out add-on; the site works just the same.

12. Data inside the sites we build

Separately from the above: when we build and maintain a client's site, the data of the people who reach that site — their contacts, their patients, their buyers — belongs to the client. They are the controller and we act as a processor: we handle it only on their instructions and only to deliver their service.

Every client needs their own data processing policy and their own authorisations. We do not use that data for anything of our own, we do not mix it between clients, and we do not pass it on. When the service ends we hand it back and delete it from our infrastructure.

If you are a user of one of our clients' sites and want to exercise your rights, write to them directly. If you write to us, we will put you in touch with the controller.

13. Minors, changes and contact

Our services are aimed at companies and professionals, not at minors, and we do not knowingly collect data about minors. If you believe a minor's data has reached us, write to us and we will delete it.

If we change this policy, we publish the new version here with its date and, when the change is significant, we tell you by email 30 days in advance. This policy applies from the date of its last update and for as long as we process your data.

For any question or request about your data: success@clicalto.com.