Data Processing Policy

Data controller

Entity: «Pendiente: razón social». Tax/registration id: «Pendiente: NIT / identificación». Registered address: «Pendiente: domicilio».

Person or area answering queries and complaints: «Pendiente: área o cargo responsable de datos personales». Privacy contact channel: privacidad@doctiling.app.

Legal framework

This policy is issued under Ley 1581 de 2012, Decreto 1377 de 2013 (compiled in Decreto 1074 de 2015) and the instructions of the Superintendencia de Industria y Comercio (SIC). Where a user or customer is in the European Union, the GDPR applies in addition.

Purposes by type of data

Demo requests: email, name and company are used only to respond to your demo request and follow up.

Account data: your profile (name, email, preferences) is used to operate your account and personalize the product.

Documents and knowledge bases: stored and processed to provide the product's core function — grounded AI answers over your own content.

AI usage: your prompts and retrieved content are sent to the configured language-model provider only to answer your query; never used to train models.

Service messages: transactional emails (magic-link sign-in, invitations, notifications) sent to operate the account you hold.

Sensitive data and third parties' data in documents

The product does not require sensitive data (health, biometric, political or religious views, sexual life, ethnic origin) and we do not classify the content you upload. Sensitive data may only be processed with the explicit authorization of its subject (Ley 1581 arts. 5 and 6); answering any question about sensitive data or about minors is optional.

Whoever uploads a document that contains other people's personal data warrants that they hold the authorization or legal basis to do so and act as controller of that data; we process it only on their instructions, as described in the Data Processing Agreement.

Data subject rights

Under Ley 1581 art. 8 you may: know, update and rectify your personal data; request proof of the authorization you granted; be informed of the use given to your data; revoke the authorization and request deletion when the processing does not respect the law; and access your data free of charge.

You can exercise access and deletion (export and account deletion) directly from your profile in the product.

You may file a complaint with the Superintendencia de Industria y Comercio (SIC) for breaches of the law, after first bringing your query or complaint to us (Ley 1581 art. 16).

Procedure for requests and complaints

Queries (know/update/rectify): answered within 10 business days from receipt at privacidad@doctiling.app, extendable once by 5 additional business days when the volume of requests prevents an earlier answer; we tell you before the first deadline expires.

Complaints (revoke/delete, or a complaint about how data was processed): answered within 15 business days, extendable once by 8 additional business days. Both channels run through privacidad@doctiling.app.

An incomplete complaint is returned to you within 5 business days so you can complete it; if we hear nothing back within two months, the complaint is understood withdrawn. While a complaint is open we mark the record "complaint in progress" within 2 business days (Ley 1581 art. 15).

International transmission to processors

To operate the product we transmit personal data to processors that act on our behalf and under contract, in the following categories, all located in the United States: hosting infrastructure, database services, transactional email, federated authentication, anti-bot protection, language-model providers and vector/search-embedding providers. This is a transmission to processors (Decreto 1074 de 2015, art. 2.2.2.25.5.2), not a transfer to another controller.

The Superintendencia de Industria y Comercio lists that country among those with an adequate level of protection (Circular Externa 005 de 2017). None of these providers use your content for purposes other than executing the specific request that reaches them; the sub-processors page has the detail by category.

Retention by data type

Account data: while the account exists, plus a 30-day grace period after a deletion request.

Documents and knowledge bases: while the account exists.

Deleted knowledge bases and documents, with their attachments: 15 days in the trash, restorable by the user; then erased for good, irreversibly. The user can erase them sooner.

MCP call trail (audit metadata, no content): 90 days.

Compliance trail (consent, export, deletion events): 5 years, surviving account deletion, as a record of the authorization and of how the rights were served.

Demo requests: 12 months.

Minors

The product is aimed at adults. We do not process personal data of minors under 18 years of age except with the authorization of their legal representative, respecting the best interests of the minor and their fundamental rights (Ley 1581 art. 7; Decreto 1377 art. 12).

Security and data breaches

Summary of our security posture, plus how to report a vulnerability, is published at https://www.doctiling.app/en/security.

If a personal data breach occurs, we notify the affected data subjects without undue delay and report it to the Superintendencia de Industria y Comercio (Ley 1581 art. 17 lit. n; within fifteen business days for controllers registered in the RNBD). Customers with a signed Data Processing Agreement are notified within 72 hours.

Validity and last update

This policy is in force and was last updated on 2026-10-08. It replaces any earlier version and is reviewed at least once a year.