Personal Data Processing Policy

The Data Controller is DESARROLLO DE SOFTWARE DE COLOMBIA S.A.S., a commercial company incorporated under Colombian law, identified with Tax ID (NIT) 901.241.856-1, domiciled in the city of Bucaramanga, Santander, Colombia. For any matter relating to privacy, the exercise of rights, or inquiries about this Policy, you may contact us at the email privacidad@sabero.co, which is our official channel for such purposes.

This Policy is based on and complies with: (i) article 15 of the Political Constitution of Colombia (fundamental right to habeas data); (ii) Statutory Law 1581 of 2012, which issues general provisions for the protection of personal data; (iii) Decree 1377 of 2013, partially regulating Law 1581; (iv) Sole Regulatory Decree 1074 of 2015; (v) External Circular 002 of 2024 of the Superintendency of Industry and Commerce; and (vi) other rules that may modify, add to, or regulate them. The Superintendency of Industry and Commerce (SIC) is the supervisory authority for personal data protection in Colombia.

We collect the following categories of personal data: (1) Identification and account data: full name, email, and password (stored in encrypted form using hash functions). (2) Academic and usage data: education level, preferred language, exams taken, answers, timing, progress by subject, attempt history, flashcards created, review sessions, custom exams, interactions with the AI Tutor and AI Coach (including conversation content to deliver and improve the service). (3) Technical data: IP address, browser type and version, operating system, device identifier, access logs, errors, and events. (4) Billing data (when you purchase a plan): name, type and number of identification document, email, phone, and minimum data required by the payment gateway; we do not store full credit card numbers on our servers. We do not intentionally collect or process sensitive data (e.g. health, biometric, political, religious, or sexual orientation data) unless you voluntarily provide it through a support channel, in which case we will apply the enhanced protections of article 6 of Law 1581 of 2012.

We process your personal data for the following purposes: (i) provide and operate the service (exams, AI Tutor, AI Coach, flashcards, analytics, IRT estimates); (ii) personalize your experience and recommend content; (iii) improve the platform and the quality of our AI models through aggregated and, where possible, anonymized analysis; (iv) process payments, issue invoices, and manage subscriptions; (v) communicate with you about the service, support, contractual changes, and updates; (vi) send commercial or promotional communications only with your express authorization, with the option to unsubscribe at any time; (vii) prevent fraud and abuse and comply with legal obligations; and (viii) respond to requests from competent authorities under the law.

The processing of your data is based on your prior, express, and informed authorization, granted by ticking the acceptance box during registration and/or by continuing to use the platform after becoming aware of this Policy, in accordance with articles 9 and 10 of Law 1581 of 2012. Additionally, we process data based on (i) the performance of the service contract; (ii) compliance with legal obligations; and (iii) legitimate interests when your rights do not prevail (e.g. platform security and fraud prevention). You may revoke your authorization at any time under the "Procedure to exercise your rights" section, without affecting processing already carried out.

The AI features (AI Tutor, AI Coach, question variations, explanations, flashcards) are powered by APIs from recognized technology providers, such as OpenAI, Anthropic, and Google, which act as Data Processors under binding contractual confidentiality and security agreements. Your queries are sent encrypted and processed to generate the response. Pursuant to the API commercial terms of these providers, the data sent is not used by them to train their general models. Sabero may use anonymized or aggregated interactions to improve the quality and security of the service. We do not make automated decisions with legal effects about you without meaningful human intervention.

We share personal data, strictly as necessary, with the following Data Processors, who provide services to us under contractual confidentiality and security obligations: (i) infrastructure and hosting: Vercel, Amazon Web Services, Supabase, or equivalents; (ii) payment processing: Wompi and the financial institutions authorized in Colombia; (iii) artificial intelligence: OpenAI, Anthropic, Google, or other equivalent providers; (iv) analytics and technical monitoring: PostHog, Sentry, or equivalent tools; (v) transactional communication: email and messaging providers (e.g. Resend, Postmark). This list may be updated; you may request the current version by writing to privacidad@sabero.co. We do not sell your personal data. We may disclose it to authorities when required by a legal order or to protect rights and safety, as provided by law.

Some of our Data Processors process data in countries other than Colombia (e.g. the United States or European Union countries). Pursuant to article 26 of Law 1581 of 2012 and article 24 of Decree 1377 of 2013, we carry out international transfers when: (i) the destination country has an adequate level of protection according to the SIC; (ii) we have your express authorization; or (iii) equivalent contractual clauses are signed to guarantee security and confidentiality standards analogous to those required by Colombian law.

We retain your personal data for as long as your account is active and for as long as necessary to fulfill the purposes described, meet legal, accounting, and tax obligations (e.g. retention of tax supports for five (5) years under article 28 of Law 962 of 2005), and for the exercise or defense of claims. Upon closing your account, we will delete or anonymize your personal data within a reasonable period, unless the law imposes a longer term.

We adopt reasonable technical, human, and administrative measures to protect your data from loss, unauthorized access, alteration, or destruction, including: encryption in transit (TLS) and at rest where appropriate, access control under the least-privilege principle, secure authentication, event logging, periodic backups, and confidentiality agreements with our Data Processors. No system is completely secure; in the event of a security incident compromising personal data, we will comply with the duty to report to the SIC and affected data subjects in accordance with External Circular 002 of 2024.

Sabero is primarily aimed at students preparing for university admission exams, a group that includes minors. Pursuant to article 7 of Law 1581 of 2012 and article 12 of Decree 1377 of 2013, the processing of data of children and adolescents is only permitted when: (i) it responds to and respects the best interest of the minor; (ii) the prevalence of their fundamental rights is guaranteed; and (iii) there is authorization from the legal representative, taking into account the opinion of the minor. Upon registration, the minor declares to have the knowledge and authorization of their father, mother, or legal representative. The latter may at any time request access, correction, deletion, or revocation of the authorization by writing to privacidad@sabero.co and attaching a copy of the document evidencing the representation.

As the data subject, you have the right to: (i) know, update, and rectify your data before the Controller or Processors; (ii) request proof of the authorization granted; (iii) be informed, upon request, of the use of your data; (iv) file complaints with the SIC for infringements of Law 1581 of 2012; (v) revoke authorization and/or request deletion of the data when the constitutional and legal principles, rights, and guarantees are not respected; and (vi) access free of charge the data that has been processed. These rights may be exercised directly by the data subject, by their heirs, legal representative, or duly authorized attorney.

You may exercise your rights by sending a request to privacidad@sabero.co with the following information: (i) full name and identification document; (ii) email registered in Sabero; (iii) clear description of the right you wish to exercise (inquiry, update, correction, deletion, or revocation); (iv) physical or electronic address for notifications; and (v) supporting documents where applicable. Inquiries will be addressed within a maximum term of ten (10) business days from receipt, extendable by five (5) additional business days, pursuant to article 14 of Law 1581. Complaints will be addressed within fifteen (15) business days following receipt, extendable by eight (8) additional business days, under article 15 of the same law. If you consider that the handling has not been adequate, you may file a complaint with the Superintendency of Industry and Commerce (www.sic.gov.co).

We use cookies and local storage technologies (localStorage and sessionStorage) to: (i) keep your session active; (ii) remember preferences such as language and theme; (iii) perform usage analytics that help us improve the product; and (iv) prevent fraud. You can control cookies through your browser settings; disabling some may affect the functionality of the service. We do not use third-party advertising cookies. When using non-essential cookies, we will request your prior consent through a banner or equivalent mechanism.

We may modify this Policy to reflect changes in the service, in our practices, or in applicable regulations. We will publish the updated version on the platform and update the "Last updated" date. Substantial changes will be communicated at least ten (10) business days in advance by email or in-product notice. Continued use of the platform after the effective date implies your acceptance of the then-current version.

For any concern, exercise of rights, or notification relating to this Policy, please contact us at: DESARROLLO DE SOFTWARE DE COLOMBIA S.A.S., NIT 901.241.856-1, domiciled in Bucaramanga, Santander, Colombia. Email: privacidad@sabero.co. The competent authority for complaints regarding personal data protection is the Superintendency of Industry and Commerce (SIC), headquartered in Bogotá D.C., Colombia, website www.sic.gov.co.