Privacy Policy

1. Purpose and scope

ALACARTTA S.A.S. (“Alacartta”, “we”, “us” or the “Company”) recognizes the importance of privacy and every person’s right to know, update, rectify and control the information processed about them.

This Policy explains how Alacartta collects, records, organizes, stores, consults, uses, transmits, analyzes, updates, anonymizes, deletes and, in general, processes personal data, through both manual and automated operations, in connection with the activities covered by this version.

The scope includes the alacartta.com website; its editorial content; the Grow initiative; communications and relationships with interested persons, leads, business contacts, research or feedback participants; channels enabled through WhatsApp, Instagram, Facebook and email; and, once Authentication V1 becomes publicly effective, the creation and use of Alacartta accounts, authentication through phone, email or Google, OTP verification, sessions, access recovery, Product Profile, verified-identifier linkage and resolution of authorized access context.

Authentication V1 identifies and authenticates a person, but a valid session does not by itself grant authority to act on behalf of a business or Internal Staff access. Permissions and access contexts are resolved separately.

This version does not govern as publicly available capabilities the full functional scope of the B2B Panel, the Cartta B2C experience, order processing, checkout, paid plans, paid subscriptions or Mercado Pago. Before enabling features that materially change personal-data processing, Alacartta will conduct the corresponding legal review and update this Policy when necessary.

2. Data Controller

The Data Controller responsible for the processing of personal data is:

Legal name: ALACARTTA S.A.S.
Tax ID (NIT): 901979629-2
Domicile: Bogotá D.C., Colombia
Address: Carrera 65 A 98 25 Oficina 4004, Andes Norte, Bogotá D.C.
General email: hola@alacartta.com
Data protection email: privacidad@alacartta.com
Legal matters email: legal@alacartta.com
Business telephone: +57 333 742 4242
Website: alacartta.com

The Privacy function of ALACARTTA S.A.S., through privacidad@alacartta.com, is responsible for handling petitions, inquiries and claims related to the processing of personal data and the exercise of Habeas Data rights.

3. Persons to whom this Policy may apply

This Policy may apply, depending on the specific interaction, to website visitors; readers of content; persons who contact Alacartta through WhatsApp, Instagram, Facebook or email; prospective customers and business contacts; persons who provide feedback or voluntarily participate in research activities; Alacartta account holders; owners, administrators, employees, collaborators or representatives of businesses; persons invited to a business context; authorized internal staff when using the same authentication gateway; and other natural persons whose data is lawfully processed in connection with the activities covered by this version.

Authenticating a person does not by itself establish that the person is authorized to represent a business. Where a feature requires such authorization, Alacartta resolves the access context separately.

4. Personal data we may process

Alacartta applies a data-minimization approach and seeks to process only information reasonably necessary for each purpose.

Identification and contact: Name, email address, telephone number, WhatsApp, Instagram or Facebook identifier and, where supplied by the platform, username or basic profile information.

Authentication and identity: Technical authentication-user identifier, provider or method used, verification status, provider identifiers where applicable and, for Google, the basic identity information associated with the openid, email and profile scopes. Authentication V1 does not request access to Gmail, Drive, Calendar, Contacts or other Google APIs.

Session and security: Session identifiers and metadata, authentication dates and times, events necessary to prevent abuse, fraud or unauthorized access, and technical records reasonably necessary to diagnose or protect the service.

Access recovery: Challenge identifiers, proof type, masked destination, expiration, status and outcome of recovery processes where necessary to restore access securely.

Product identity and access context: Product Profile, relationship with the canonical Person, verified identifiers and the minimum data required to determine whether a person has an authorized Business Context or Internal Staff Context.

Professional or business information: Business name, business type, relationship with the business and other information voluntarily provided by the person or reasonably necessary to activate a business context where applicable.

Communication content: Messages, replies, comments, requests, questions, feedback and other content sent in conversations with Alacartta.

Conversational and operational information: Originating channel, date and time, conversation status, message and conversation identifiers, interaction history, support status and data required to perform a handoff to a team member.

Technical information: Technical information necessary to operate, protect and diagnose the services, including request identifiers, security events, technical logs and data automatically provided by the infrastructure used.

Acceptance, authorization and privacy information: Date and time, source or surface, version of the Terms and Privacy Policy, version of the acceptance text/event when separately controlled, language or locale where applicable, rights requests and the status and outcome of their handling.

Feedback and research: Responses, comments or observations a person chooses to provide to help understand problems or improve Alacartta’s services.

Alacartta does not currently request financial or payment-card information to process payments because that capability is not active under this version.

5. How we obtain data

Data may be obtained directly from the person when they write, reply, provide information, complete registration or voluntarily interact with Alacartta; automatically when technical infrastructure generates information strictly necessary to provide, protect or diagnose the service; through platforms the person chooses to use, such as WhatsApp, Instagram or Facebook; or, when the person chooses to continue with Google, from Google in relation to the basic identity information authorized by the openid, email and profile scopes.

Where applicable, Alacartta may also securely resolve that an authenticated identifier corresponds to an existing Person or Product Profile. Such resolution does not imply automatically merging ambiguous identities or granting permissions over a business.

Where authorization is legally required, Alacartta will clearly inform the person of the processing, its purposes, the Data Subject’s rights and the Data Controller’s contact details, and will retain reasonable evidence of that information and the associated manifestation.

Silence, inactivity or a preselected option will not be treated as authorization.

6. Purposes of processing

Alacartta may process personal data, as applicable to each interaction, to:

• respond to inquiries, requests or messages;
• provide assistance and support;
• identify and manage persons interested in Alacartta’s services;
• create or complete a Product Profile where applicable;
• verify identity through phone, email or Google;
• request, deliver and verify OTP codes where that method is used;
• establish, maintain and protect an authenticated session;
• recover access where sufficient signals exist to do so securely;
• resolve whether an identity is returning, requires registration or requires recovery;
• securely and idempotently link verified identifiers with a Person or Product Profile;
• separately resolve authorized access contexts;
• preserve and resume a navigation intent or private action where safe and authorized;
• record minimum evidence of legal acceptance associated with registration;
• maintain continuity in conversations initiated by the Data Subject;
• understand the business context about which a person requests information;
• activate a Business Context where the applicable experience requires it and the person supplies the corresponding information;
• transfer a conversation to a team member where human attention is required;
• send confirmations or follow-ups directly related to a request initiated by the Data Subject;
• receive and analyze feedback;
• conduct research aimed at developing and improving services;
• diagnose failures and protect infrastructure security and integrity;
• prevent abuse, fraud or unauthorized uses;
• manage technology providers required to operate these processes;
• handle privacy requests;
• comply with legal obligations or legitimate requests from authorities;
• exercise or defend Alacartta’s rights where necessary.

Data must not be used for purposes incompatible with those disclosed or authorized.

Commercial communications

Authenticating, verifying a phone or email, using Google, receiving an OTP or creating an account will not by itself be treated as authorization to receive recurring marketing.

When Alacartta enables a specific recurring-communications choice during registration, that choice will be separate from acceptance of the Terms and from the processing necessary for Authentication, will not be preselected, and a negative answer will not prevent account creation.

Until a canonical capability exists to persist and honor communication preferences, Alacartta will not enable that choice at runtime or store a parallel boolean that could incorrectly imply an active subscription.

7. Authorization

Except where the law provides otherwise, Alacartta will carry out processing with prior, express and informed authorization, capable of later consultation.

Authorization may be obtained through written, electronic or conversational mechanisms or through unequivocal conduct other than silence, provided the person has previously received the information required by law and Alacartta can retain evidence of the mechanism and applicable context.

In Authentication V1 Minimal Registration, the interface preserves the visible pattern approved in Figma:

By selecting “Accept and continue”, I accept the Terms and Conditions and acknowledge Alacartta’s Privacy Policy.

Links to both documents are available at the same capture point. Acceptance of the Terms and acknowledgement of the Privacy Policy will not, by themselves and in the abstract, be treated as an automatic substitute for any authorization required by law. For Authentication V1, Alacartta documents the complete registration context, the purposes necessary to create and protect the account and the deliberate “Accept and continue” action as the affirmative electronic event whose sufficiency depends on clear, complete and consultable prior information and on retaining verifiable evidence of the act.

Evidence for this capture point must identify, at a minimum, the person or authenticated identity, date/time, source, Terms version, Privacy version, acceptance-pattern version and locale where applicable.

Authentication V1 does not request sensitive data as a registration requirement.

The choice regarding recurring commercial communications, once enabled, will be separate and will not be inferred from the acceptance described above.

8. WhatsApp, Instagram and Facebook

Alacartta uses WhatsApp, Instagram and Facebook as channels for interactions with interested persons and contacts.

When a person uses one of these channels, certain data is initially processed by the relevant platform under its own terms and privacy policies. Alacartta does not control processing performed by those platforms for their independent purposes.

Once Alacartta receives the information necessary to handle the interaction, it may process that information in its own systems for the purposes described in this Policy.

Through WhatsApp, the system may store the contact’s telephone number, incoming and outgoing messages, message identifiers, conversation status, name, email, business and other information voluntarily provided. It may also transfer certain conversations to Alacartta’s human team where personal attention is requested or required.

For Authentication V1, WhatsApp may additionally be used as the delivery transport for an OTP code associated with the phone the person is using to authenticate. Supabase Auth remains the verification and session authority; receiving an OTP through WhatsApp does not turn that interaction into a commercial conversation or grant authorization for recurring marketing.

Instagram and Facebook also have integrations for managing messages, platform identifiers and, in certain scenarios, human attention. They are not Authentication V1 authentication methods under this version.

9. Artificial intelligence and automation

Alacartta may use artificial intelligence systems to support certain conversational interactions, for example to interpret the intent of a message, organize context and generate a response.

For this purpose, the strictly necessary content of the conversation and certain contextual data may be sent to a technology provider that processes the information in order to provide that functionality.

Alacartta currently uses OpenAI services for some of these operations and seeks to limit the information shared to what is necessary for the relevant purpose.

Alacartta does not currently use these systems to make solely automated decisions that, by themselves, produce legal effects or similarly significant effects on persons.

If materially different AI uses are introduced in the future, a new legal review will be conducted before they are enabled.

10. Sensitive data

Alacartta does not ordinarily request sensitive data as part of its normal flows and recommends that persons not send this type of information through fields or messages when it is not necessary.

Because conversational channels allow free-form text, a person may spontaneously provide sensitive information that Alacartta did not request. In that case, data-minimization measures will be applied and, when it is necessary to retain or use that information, the existence of a sufficient legal basis will be verified.

Answering questions concerning sensitive data will always be optional when applicable.

11. Data concerning children and adolescents

The services currently offered by Alacartta are primarily directed to adults associated with food businesses.

Alacartta does not intentionally seek to collect personal data from children or adolescents.

If Alacartta identifies that it has received information relating to a minor without an adequate legal basis, it will assess its deletion or the processing that is appropriate, taking into account the child’s best interests and prevailing rights.

12. Providers and third parties

To operate its services, Alacartta may use technology providers that process information required to provide infrastructure, storage, authentication, communications, support, automation or related services.

Relevant technology providers currently used, depending on the flow, include:

Vercel: Hosting, website delivery and execution of applications/APIs.

Supabase: Authentication V1 infrastructure for Auth users, provider identities, OTP, sessions, OAuth/PKCE exchange where applicable, and data functions associated with Product Identity and Access Context.

Google: Identity provider when a person chooses to continue with Google. Authentication V1 limits access to the basic openid, email and profile scopes.

Google / Firebase / Google Cloud: Firestore, Firebase Functions/Cloud Run, technical storage and services associated with other Alacartta flows.

Google / Gmail: Sending certain operational emails.

Meta: WhatsApp, Instagram and Facebook. In Authentication V1, WhatsApp may be used as the phone-OTP delivery transport.

Slack: Human support and handoff for certain conversations.

Notion: Internal organization of contacts, companies, opportunities or other operational information depending on the flow.

OpenAI: Processing of certain interactions using AI. Identity proof, OTP verification, Product Identity and access authorization are not delegated to the conversational model.

The existence of a provider does not mean that it receives all information about a person. Alacartta seeks to limit disclosure to what is necessary for the applicable service or flow.

Legal roles, locations and applicable contractual mechanisms may vary according to the specific service and processing. Alacartta will maintain its internal provider inventory and review applicable agreements and safeguards.

13. International processing and storage

Some providers used by Alacartta, including infrastructure, authentication, communication and identity providers, may operate infrastructure or entities outside Colombia. As a result, certain personal data may be subject to international processing or storage.

Depending on the nature of the operation, this may constitute an international transmission, where a provider processes data on Alacartta’s behalf, or a transfer, where another Data Controller receives data for its own purposes.

Alacartta will seek to use contractual mechanisms and other safeguards applicable under the Colombian regime.

The specific processing location may vary according to the provider, service and technical configuration used. Alacartta will not publicly attribute a specific region or country to a provider unless the applicable configuration and relationship have been verified.

14. Data retention

Alacartta will retain data for the period reasonably necessary for the purposes for which it was processed and will apply data-minimization and storage-limitation principles.

The target operational policy for current processing is:

Inactive lead or contact that does not result in an active relationship: 24 months from the last interaction.

WhatsApp, Instagram or Facebook conversations: 12 months from the last interaction.

Operational copies of conversations used for Slack handoff: Up to 12 months.

Inactive contacts and opportunities in internal systems such as Notion: 24 months from the last activity.

Identifiable feedback: 12 months; thereafter it will be anonymized where reasonably practicable.

Completed brainJobs and mailJobs: 90 days.

Technical deduplication or rate-limiting data: 30 days.

Operational logs that may contain identifiers: Up to 90 days, unless temporarily retained for a security incident.

Privacy requests: Minimum evidence necessary to demonstrate their handling.

Authentication V1 data: Auth users, provider identities, sessions, legal-acceptance evidence, Product Profile, verified-identifier links, recovery and security evidence will be retained for as long as necessary to provide and protect the service, maintain identity integrity, handle rights, resolve incidents and comply with applicable legal or contractual obligations. Alacartta does not currently publish one single fixed period for all these categories because their operational lifecycles differ.

Account closure, loss of a credential and removal of a Business Membership are not equivalent events and may have different retention effects.

These periods or criteria may be extended where a legal obligation, the need to defend rights, a security investigation or a valid contractual duty justifies additional retention. Where identification is no longer necessary, Alacartta will seek to delete, anonymize or restrict the information as appropriate.

Operational implementation status: the quantified periods above remain Alacartta’s target schedule and technical automation/verification of some retention mechanisms remains in progress. Additional Authentication V1-specific periods will be documented only once cleanup capability and applicable obligations have been verified.

15. Deletion, anonymization and revocation

The Data Subject may request deletion of personal data or revocation of authorization where legally applicable.

A deletion request does not necessarily entail immediate and indiscriminate deletion of all information. Alacartta will evaluate the systems in which data associated with the Data Subject exists and will delete, anonymize or restrict processing of data that should no longer be retained.

For Authentication V1, closing or deactivating an account, unlinking a credential, revoking sessions, deleting a Product Profile, removing a Business Membership and deleting personal data are different operations. A request will be handled according to its scope and any legitimate relationship with business, security, compliance or third-party records.

Depending on the flow, this may include data in Supabase Auth and Postgres, Firestore, conversations, processing records, internal systems, operational copies and data held by providers under Alacartta’s control.

Deletion may not apply to particular information where there is a valid legal or contractual duty to retain it.

Until Alacartta has a fully verified self-service account-closure or export experience, these requests will be managed through the privacy channel. Alacartta will not consider a request completed merely because a record has been internally marked as “deleted”; the procedure must reflect the material deletion, anonymization or restriction that is applicable.

16. Security and confidentiality

Alacartta adopts and will continue to develop technical, human and administrative measures that are reasonable and proportionate to the nature of the data processed and the risks identified.

These measures may include access controls; handling secrets and credentials outside public code; system authentication; verification through OTP or an identity provider; sessions managed by specialized infrastructure; separation between authenticated identity and authorization; privilege limitation; operational logging; measures against duplicate or abusive processing; access controls for internal services; provider review; and data-minimization practices.

An authenticated session does not automatically grant access to /panel or /admin. Authorized contexts are resolved separately and private routes must re-check the applicable access.

No system can guarantee absolute security. Accordingly, Alacartta does not promise the complete absence of incidents, but it does commit to the duty to adopt reasonable measures aimed at preventing adulteration, loss, consultation, use or unauthorized or fraudulent access.

Persons involved in processing must maintain the corresponding confidentiality.

17. Rights of Data Subjects

Under Colombian law, the Data Subject may:

• know, update and rectify their data;
• request proof of authorization when authorization is legally required;
• request information regarding how their data have been used;
• file complaints with the Superintendencia de Industria y Comercio (Colombian Superintendence of Industry and Commerce) after completing the applicable procedure before the Data Controller or Data Processor;
• revoke authorization or request deletion when legally appropriate;
• access their data free of charge under the terms established by law.

18. Channel for exercising rights

Requests relating to personal data should primarily be sent to:

Alacartta may request information reasonably necessary to verify the identity of the requester and prevent data from being disclosed or modified by an unauthorized person.

Rights may be exercised by the Data Subject, their successors where applicable, their duly accredited representatives or attorneys-in-fact, and any other persons authorized by law.

19. Inquiries

A person who wishes to know what personal information Alacartta holds about them may submit an inquiry through the privacy channel.

The request must make it possible to identify the Data Subject and reasonably describe the information being requested.

Inquiries will be answered within a maximum of ten (10) business days from receipt. If it is not possible to respond within that period, Alacartta will explain the reasons for the delay and provide a new response date, which may not exceed five (5) additional business days.

20. Claims

When the Data Subject believes that information should be corrected, updated or deleted; wishes to revoke an authorization; believes that a breach has occurred; or seeks to exercise another right that must be handled as a claim, they may write to privacidad@alacartta.com.

The claim must contain sufficient information to identify the Data Subject, a description of the facts or request, contact details for receiving the response and, where applicable, the documents supporting the request.

If the claim is incomplete, Alacartta may ask the requester to provide the missing information within the periods established by law. If two months pass without the request being completed, the claim may be deemed withdrawn.

Once a complete claim has been received, the appropriate internal indication that a claim is pending will be maintained while the claim is being decided, when applicable.

The maximum period for handling a claim is fifteen (15) business days, counted from the day after receipt. If it is not possible to handle the claim within that period, the reasons for the delay and the response date will be communicated; that additional period may not exceed eight (8) business days.

Before filing a complaint with the Superintendencia de Industria y Comercio in relation to Habeas Data matters, the Data Subject must first complete the inquiry or claim procedure before Alacartta when the law so requires.

21. Cookies and similar technologies

Alacartta’s website may use cookies, local storage or other technologies that are strictly necessary to provide technical functionality, maintain security, deliver content correctly or preserve certain preferences where applicable.

Alacartta will not treat the mere existence of this section as a general authorization to deploy advertising, profiling or non-essential tracking technologies.

If analytics, advertising or other trackers are later introduced in a way that materially changes the current processing, Alacartta will review its information and consent obligations and will update this Policy or adopt a separate Cookie Policy when necessary.

22. External links and platforms

Alacartta’s website or communications may contain links to platforms or services operated by third parties.

When a person leaves an environment controlled by Alacartta and uses an external service, processing carried out directly by that third party will be governed by the third party’s own policies and terms unless expressly stated otherwise.

23. Legal requirements and authorities

Alacartta may provide information where there is a legal obligation, court order, legitimate request from a competent authority or another circumstance permitted by applicable law.

24. Changes to this Policy

Alacartta may update this Policy to reflect regulatory, technological, operational or product changes.

Each version must state its version number and effective date statically.

Version 1.1 incorporates processing associated with Authentication V1 and user accounts, but does not by itself activate capabilities that remain excluded, such as payments, checkout, Cartta B2C or the full functional scope of the B2B Panel.

Where a change materially affects previously disclosed purposes or introduces new processing for which the law requires new authorization, Alacartta will take the corresponding information and authorization steps before applying the new processing.

Previous versions must be retained internally for traceability purposes.

25. Effective term

This Policy will apply from the effective date stated in its published version and will remain in force for as long as Alacartta carries out the processing described here or until it is replaced by a new version.

Version 1.1 takes effect on September 29, 2026 and accompanies the public launch of Authentication V1. Its effective date and version number are kept static so the applicable text can be identified.

Databases and records containing personal data will remain in existence only for the period necessary for the corresponding purposes, without prejudice to legal or contractual retention obligations.