Privacy Policy

In compliance with Law 1581 of 2012 and Regulatory Decree 1377 of 2013, KYZEN A.I. S.A.S., hereinafter "Kyzen", acts as the data controller for personal data collected through its platform, with the following identifying information:

Company name: KYZEN A.I. S.A.S. Registered address: Barranquilla, Atlántico, Colombia Contact email: matt@kyzen.club Website: kyzen.live

This Policy is governed by current Colombian legislation, in particular: (i) Law 1581 of 2012 on Personal Data Protection; (ii) Decree 1377 of 2013, partial regulation of Law 1581; and (iii) External Circular 002 of 2015 of the Superintendence of Industry and Commerce. Should services be extended to users in the European Union, compliance with the General Data Protection Regulation (GDPR) will be incorporated.

3.1. Data provided directly by the user Kyzen collects the following data when a user creates an account or interacts with the Service: full name, email address, business or company name (workspace), phone number linked to the WhatsApp Business account, payment information —processed by specialized third parties— and communications sent through support channels.

3.2. Data generated by platform usage During service delivery, the following data is generated: WhatsApp conversations processed through Kyzen, contact data entered into the CRM by the user, activity logs, access records, timestamps, and technical metadata such as IP address, browser type, and operating system.

3.3. Third-party data —user's contacts— When managing WhatsApp conversations, the user enters their own customers' data into the system. In this scenario, Kyzen acts exclusively as a data processor, while the user holds the role of data controller with respect to those data subjects. The user warrants that they have obtained prior, express, and informed consent from their contacts for the processing of their personal data.

The personal data collected is processed for the following purposes: creating and managing the user's account on the platform; providing, operating, and improving the CRM and WhatsApp automation Service; processing, analyzing, and generating automated responses in WhatsApp conversations through Artificial Intelligence algorithms and Large Language Models (LLMs) provided by third parties; sending Service-related communications, including alerts, updates, and technical support; complying with applicable legal and regulatory obligations in the Republic of Colombia; detecting and preventing fraud, abuse, or unauthorized activity; and conducting internal analyses to improve the platform using exclusively anonymized or aggregated data.

Kyzen does not sell, rent, or commercialize users' personal data to third parties for advertising or commercial purposes unrelated to the Service.

In accordance with Article 9 of Law 1581 of 2012, the processing of personal data requires the prior, express, and informed authorization of the data subject. By creating an account on the Kyzen platform, the user grants authorization for the processing of their data in accordance with the terms of this Policy. Such authorization may be revoked at any time by written request to the email address indicated in Article I.

In accordance with Article 8 of Law 1581 of 2012, data subjects have the following rights: to know, update, and correct their personal data; to request proof of the authorization granted for processing; to be informed about how their data is used; to file complaints with the Superintendence of Industry and Commerce (SIC); to revoke authorization and/or request deletion of their data when there is no legal or contractual obligation to retain it; and to access free of charge their data that has been processed.

The response period for inquiries is ten (10) business days and fifteen (15) business days for claims.

Data is stored on servers and cloud infrastructure managed through Railway and Artificial Intelligence service providers, located primarily in the United States of America. By accepting this Policy, the user expressly authorizes the international transfer of their data to such infrastructure, under the terms set forth in Title VIII of Law 1581 of 2012.

Kyzen implements the following technical and organizational security measures: (i) data encryption in transit via TLS/HTTPS protocol; (ii) restricted access to data based on the principle of necessity; and (iii) data isolation per workspace through a multi-tenant architecture.

Personal data will be retained for as long as the user's account is active or as necessary for the provision of the contracted Service. Following account cancellation, data will be deleted or anonymized within a maximum period of sixty (60) business days, unless a legal obligation requires retention for a longer period.

Kyzen shares information exclusively with the following third parties, who act as data processors under strict contractual data protection obligations:

• Meta Platforms Inc.: provider of the WhatsApp Business API, essential for Service operation. • Railway: server and database infrastructure provider. • Vercel: infrastructure provider for the kyzen.live website. • Artificial Intelligence Model Providers: OpenAI, Anthropic, and Google, in commercial mode, which prohibits using data to train public models. • Mercado Pago: recurring payment processor. • Competent Colombian authorities, when required by law, regulation, or court order.

Kyzen reserves the right to modify this Policy at any time to reflect changes in Colombian legislation, in its providers' policies, or in the Service's features. Changes will be notified to the user with reasonable advance notice via email or platform notice. Continued use of the Service after notification constitutes acceptance of the updated Policy.