Privacy Policy

1. Who we are and our role

DataLens is operated by Alot Automations, a business established in Bogotá D.C., Colombia ("Alot Automations", "we", "us"). For personal data processed through the Service, Alot Automations acts as the Responsable del Tratamiento (data controller) under Colombian Law 1581 of 2012 and Decree 1377 of 2013. For users located in the European Union or the United Kingdom, Alot Automations is the data controller under the GDPR and UK GDPR.

For any privacy request or question, contact info@alotautomations.com.

2. Personal data we collect

• Account data — name, email address, hashed credentials, and authentication tokens.
• Content you upload — files (spreadsheets, PDFs, DOCX, images) and the reports you generate.
• Usage and technical data — IP address, device and browser identifiers, timestamps, feature usage, and error logs.
• Support communications — messages you send us and the responses we provide.

We do not collect or store your full payment card details. Payment data is collected directly by Paddle (see Section 6).

3. Purposes of processing

• Providing, operating, and securing the Service, including authenticating you.
• Extracting data from your files and generating reports and insights as you request.
• Preventing fraud, abuse, and security incidents.
• Improving reliability and product quality.
• Customer support and service-related communications.
• Complying with legal, tax, and accounting obligations.

4. Legal basis

Under Colombian Law 1581 of 2012, we process your personal data based on:

• your prior, express, and informed authorization given at signup;
• the performance of the contract represented by these Terms and this Policy; and
• our legitimate interest in operating and securing the Service.

For users in the EU/UK, the equivalent GDPR bases are: performance of a contract (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)), consent where required (Art. 6(1)(a)), and compliance with legal obligations (Art. 6(1)(c)).

5. AI processing

To generate the report you request, file content may be sent transiently to third-party AI providers (including the Lovable AI Gateway, OpenAI, and Google). These providers process the content only long enough to return the result and, per their agreements, do not use your content to train their models. You can avoid this processing by not uploading files.

6. Sharing and recipients

• Cloud infrastructure and AI subprocessors — hosting, database, and AI providers used to run the Service, under confidentiality and data-processing terms.
• Paddle.com Market Ltd. — our reseller and Merchant of Record. Paddle collects and processes your billing information (name, email, address, payment method, tax data) directly to process the sale, subscription management, invoicing, and tax compliance. Paddle acts as an independent controller for this data under its own Privacy Notice.
• Professional advisors — legal, accounting, and audit advisors under confidentiality.
• Authorities — where we are required to disclose data by Colombian law, court order, or other legal process.

We do not sell your personal data.

7. International transfers

Your personal data may be processed outside Colombia (including in the United States and the European Union) by the recipients listed above. Such transfers rely on either the receiving country's adequacy recognition or on contractual safeguards consistent with the guidance of the Colombian Superintendencia de Industria y Comercio (SIC). For EU/UK users, we rely on Standard Contractual Clauses or equivalent transfer mechanisms.

8. Retention

We retain your reports and uploads for as long as your account is active. When you delete content or your account, that content is purged from our production systems within 30 days. We may retain a limited set of records longer where required to comply with legal, tax, or accounting obligations, or to establish, exercise, or defend legal claims.

9. Storage and security

We host data on managed cloud infrastructure with encryption in transit and at rest. Access is restricted through row-level authorization scoped to your account, plus administrative access controls for our personnel. No system is perfectly secure, but we apply technical and organizational measures proportionate to the sensitivity of the data.

10. Your rights

Under Colombian Law 1581 of 2012 you have the right to:

• access your personal data;
• request its update, rectification, or deletion;
• revoke your authorization at any time;
• request proof of the authorization you granted; and
• file a complaint with the Superintendencia de Industria y Comercio (SIC) if you believe your rights have been violated.

We will respond to requests within 15 business days, as required by Colombian law. To exercise these rights, contact info@alotautomations.com.

If you are located in the EU/UK, you additionally have GDPR/UK-GDPR rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to lodge a complaint with your local supervisory authority.

11. Cookies

We use essential cookies to keep you signed in and to keep the Service secure. If we add analytics or marketing cookies in the future, we will present a cookie banner allowing you to manage your preferences.

12. Children

The Service is not intended for children under 13 and we do not knowingly collect data from them.

13. Changes to this notice

We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email.

14. Contact

Questions or privacy requests: info@alotautomations.com.