Privacy Policy

1. Data Controller Identity

Renaska is operated by two affiliated entities under common control, which jointly trade under the commercial name Renaska ("Renaska," "we," or "the Company") through renaska.com, renaska.co, renaska.us and their associated applications:

(a) Agencia Leidy Echavarria S.A.S., a company organized under the laws of the Republic of Colombia (NIT 901.147.131-7), with registered address at Calle 34B #65D 43, Medellín, Colombia, legally represented by Andrés Felipe Giraldo Muñoz. It is the operator of the platform (development, technical operation, and support), the owner of the Meta integration (WhatsApp Business, Instagram, and Facebook Messenger), and the Data Controller for the personal data processed through the platform and the managed messaging channels (inbox).

(b) WLM Business Solutions LLC, a limited liability company organized under the laws of the State of Delaware, USA (EIN 32-0770823), with mailing address at 1111B S Governors Ave STE 3961, Dover, DE 19904, USA. It is the entity responsible for the commercialization and billing of the service for the U.S. and international market, and the Data Controller for account and billing data.

Because Agencia Leidy Echavarria S.A.S. is domiciled in Colombia, the processing of platform and messaging-channel data is governed primarily by Colombian Law 1581 of 2012 and Decree 1377 of 2013. For account and billing data processed by WLM Business Solutions LLC, U.S. law additionally applies (Section 5 of the FTC Act and, where its thresholds are exceeded, the California CCPA/CPRA — not currently met; their rights are honored as best practice). Single contact for privacy and to exercise your rights: [email protected]. Office hours: Monday – Friday, 9:00 a.m. – 5:00 p.m.

2. Definitions

For the purposes of this Policy, the following definitions apply, consistent with Colombian Law 1581 of 2012, Decree 1377 of 2013, and the California Consumer Privacy Act (CCPA/CPRA):

(a) Personal Data: any information that identifies or is reasonably linkable to a specific natural person. (b) Sensitive Data: data revealing health information, sexual orientation or gender identity, racial or ethnic origin, political opinions, religious or philosophical beliefs, biometric data, or trade union membership (Renaska does not collect this category). (c) Data Subject / Consumer (CCPA): the natural person whose personal data is processed. (d) Data Controller / Business (CCPA): the entity that determines the purposes and means of processing — in this case, Renaska. (e) Data Processor / Service Provider (CCPA): the entity that processes data on behalf of and under the instructions of the Controller. (f) Processing: any operation performed on personal data — collection, storage, use, disclosure, transfer, deletion, etc. (g) Authorization / Consent: prior, express, and informed consent from the Data Subject. (h) Database: any organized collection of personal data subject to Processing.

3. Personal Data We Collect

Renaska collects only the data necessary to provide the contracted service (data minimization principle):

(a) Registration data: full name, email address, phone number, and country. (b) Business data: company name, tax identification number (NIT or EIN), business address, industry, and number of employees. (c) Payment data: processed directly by Stripe, Wompi, PayPal, or ePayco in accordance with their own policies; Renaska does not store full credit card numbers, CVV codes, or complete banking credentials. (d) Usage and activity data: active modules, actions performed on the platform, event logs, and timestamps. (e) Managed communications data: messages handled through the unified inbox (WhatsApp Business, Instagram Direct, Facebook Messenger, Telegram, TikTok) belonging to the Subscriber's own business operations. (f) Subscriber employee data: name, job title, email address, and access permissions entered by the account administrator. (g) Technical data: IP address (truncated for analytics purposes), browser type, operating system, pages visited, referrer, time zone, and cookie data (see Section 13).

Renaska does NOT collect sensitive personal data as defined under Colombian Law 1581, Article 5.

4. Purposes of Processing

Personal data is processed for the following authorized purposes:

(a) Providing the contracted SaaS service: ERP, invoicing, inventory, point of sale, unified messaging, and all active modules. (b) Managing the subscription agreement, billing, and payment collection. (c) Sending transactional communications: payment confirmations, system alerts, module notifications, password recovery, and email verification. (d) Sending commercial communications, product updates, and newsletters — only with prior, express, and revocable consent. (e) Technical support and customer service. (f) Platform security, fraud detection and prevention, and abuse monitoring. (g) Service improvement through usage analytics (anonymized data or with explicit consent). (h) Processing queries via artificial intelligence (Google Gemini) within the AI Agent module, using only information voluntarily submitted by the user in the chat. (i) Compliance with legal obligations and responding to lawful requests from competent authorities (DIAN, SIC, IRS, FTC, and other regulators). (j) Customer onboarding, training, and lifecycle management.

5. Legal Basis for Processing

For account and billing data processed by WLM Business Solutions LLC (United States), U.S. law applies. Section 5 of the Federal Trade Commission Act (FTC Act, 15 U.S.C. § 45) prohibits unfair or deceptive acts; every statement in this Policy is a binding commitment enforceable by the FTC. The California Online Privacy Protection Act (CalOPPA, Cal. Bus. & Prof. Code § 22575) applies as soon as any California resident uses the service, requiring us to post this Policy conspicuously and disclose how we respond to Do Not Track signals (see Section 13). CCPA/CPRA rights are included as best practice; they become legally mandatory if Renaska exceeds $26,625,000 in annual gross revenue or processes data of 100,000+ consumers per year — thresholds not currently met.

For processing by Agencia Leidy Echavarria S.A.S. under Law 1581/2012 (Arts. 6, 9, 10): (a) Performance of the subscription contract: the primary basis. (b) Prior, express, and informed consent: obtained at registration; silence does not constitute consent (Decree 1377/2013, Art. 7). (c) Legal obligation: record retention. (d) Legitimate interest: platform security and fraud prevention, subordinate to the Data Subject's rights. Renaska does NOT sell personal data or share it with third parties for cross-context behavioral advertising, except for Meta ad measurement (pixel and server event), which only happens if you accept the cookie banner (see the Prospects and Demo Requests section).

6. Sensitive Data Processing

Renaska does not collect, store, or process sensitive personal data as defined under Colombian Law 1581, Article 5 (health data, sexual orientation, racial or ethnic origin, political opinions, religious beliefs, biometric data, or trade union membership).

Should any future module or feature require processing of sensitive data, Renaska will: (i) obtain separate, explicit consent from the Data Subject; (ii) update this Policy with at least 10 calendar days' advance notice; and (iii) make any required filings with the Colombian Superintendency of Industry and Commerce (SIC) as mandated by applicable law.

7. Sharing with Third Parties (Sub-processors)

Renaska shares personal data exclusively with the following Data Processors (sub-processors), under contractual instructions and Data Processing Agreements (DPAs) that ensure appropriate levels of protection:

(a) Neon Inc. — PostgreSQL database hosting (USA / EU). (b) Cloudflare Inc. — R2 file storage and content delivery (USA / global). (c) Redis Inc. (redis.io) — Redis cache and message queues (USA). (d) Stripe Inc. — international payment processing (USA). (e) Wompi (WOMPI S.A.S.) — payment processing in Colombia. (f) PayPal Holdings Inc. — payment processing (USA). (g) ePayco (EPAYCO.COM S.A.S.) — payment processing in Colombia. (h) Meta Platforms Inc. — WhatsApp Business, Instagram Direct, and Facebook Messenger (USA / Ireland). (i) Telegram FZ-LLC — Telegram messaging (Dubai, UAE). (j) Google LLC — OAuth 2.0 authentication and Gemini AI (USA). (k) TikTok (ByteDance Ltd.) — TikTok post comments (Ireland). (l) SMTP provider configured by Subscriber — transactional email (infrastructure defined by the client).

Renaska does NOT sell, rent, lease, or disclose personal data to third parties for their own purposes unrelated to the contracted service.

8. Data Processed Outside Colombia — Structural Disclosure

Although Agencia Leidy Echavarria S.A.S., the Data Controller, is domiciled in Colombia, the platform's technical infrastructure (databases, file storage, cache, messaging, and processing) is located primarily in the United States and the European Union (see Section 7). Accordingly, using the Service entails the transmission of Colombian data subjects' data to Data Processors located abroad, primarily in the United States — a country that does not hold a formal adequacy determination from the Colombian SIC.

In accordance with Colombian Law 1581, Article 26 and SIC External Circular 003 of December 19, 2025 (which adopts Model Contractual Clauses for international transfers to countries without an adequacy determination), this cross-border processing is supported by: (a) The prior, express, and informed consent of the Data Subject given at the time of registration and acceptance of this Policy; by using the Service, Colombian users expressly consent to their data being processed in the USA. (b) The adoption by Renaska of the Model Contractual Clauses established under SIC External Circular 003/2025, which constitute the adequate guarantee for the international transfer of personal data to the USA. (c) Data Processing Agreements (DPAs) with each sub-processor incorporating equivalent protection obligations consistent with Colombian requirements. (d) Internationally recognized security certifications held by sub-processors (SOC 2 Type II, ISO 27001). Renaska maintains an up-to-date record of sub-processors and their locations, available upon request from the SIC or Data Subject at [email protected].

9. Data Retention

Personal data is retained for the following periods:

(a) Account and business profile data: for the duration of the active subscription. Upon cancellation, retained for 30 days to allow data export, then securely deleted or irreversibly anonymized. (b) Billing and accounting records: up to 10 years in accordance with Colombian fiscal obligations (DIAN) and up to 7 years for U.S. tax-relevant records. (c) Managed communications (inbox): up to 2 years or the retention period configured by the Subscriber in the platform, whichever is shorter. (d) Subscriber employee data: deleted or anonymized within 30 days of contract termination. (e) Security and audit logs: up to 12 months. (f) Cookie consent records: 12 months from the last consent update, renewed upon material policy changes.

Upon expiry of these periods, data is securely deleted using processes that prevent recovery, or irreversibly anonymized. Subscribers may request early deletion by submitting a formal request to [email protected], unless a legal obligation requires continued retention.

10. Rights of Data Subjects

Under Colombian Law 1581 of 2012 (Articles 8 and 16) and, for California residents, under the CCPA/CPRA, Data Subjects have the following rights:

(a) Right to Know (Access): access to the personal data Renaska processes about you and information on its origin, use, purposes, and recipients. (b) Right to Update and Rectify: correct inaccurate, incomplete, or misleading data. (c) Right to Deletion (Right to be Forgotten): request erasure of data when no legal or contractual obligation requires its retention. (d) Right to Revoke Consent: withdraw consent at any time without retroactive effect (Law 1581, Art. 8.e). (e) Right to Object: object to processing based on legitimate interest where there are substantiated grounds. (f) Right to Lodge a Complaint: file a complaint with the Colombian Superintendency of Industry and Commerce (SIC) at www.sic.gov.co | 01 8000 910165.

Additional rights for California residents (CCPA/CPRA): (g) Right to Data Portability: receive a copy of your data in a machine-readable format. (h) Right to Correct Inaccurate Personal Information. (i) Right to Limit Use and Disclosure of Sensitive Personal Information. (j) Right to Non-Discrimination: Renaska will not provide inferior service or penalize you for exercising your privacy rights. (k) Right to Opt-Out of Sale or Sharing: Renaska does not sell personal information and shares it with Meta only to measure ads (pixel and server event) when you accept the cookie banner; if you do not accept, nothing is shared, and you can change your choice at any time via "Cookie preferences". (l) Right to Lodge a Complaint with the FTC (www.ftc.gov) or the California Attorney General (www.oag.ca.gov).

11. How to Exercise Your Rights

To exercise any of the rights described in Section 10, please:

1. Submit a written request to [email protected] including: (i) your full legal name; (ii) your national ID, passport number, or other verifiable identifier; (iii) a clear description of the right you wish to exercise; (iv) your preferred contact address for the response.

2. Renaska will acknowledge receipt of your request within 2 business days.

3. If your request is incomplete, Renaska will notify you within 5 business days to provide the missing information, without this interrupting the response deadline.

4. Renaska will respond within 15 business days of receiving the complete request. We apply this 15-business-day deadline uniformly to all users, as it is the shorter of Colombian Law 1581 (Art. 14, 15 business days) and the CCPA (§ 1798.130, 45 calendar days).

5. If Renaska cannot respond within the legal deadline, it will communicate the reasons for the delay before the deadline expires.

6. Exercising your rights is free of charge. For requests that are manifestly unfounded or excessive (particularly if repetitive), Renaska may charge a reasonable administrative fee or decline to act, providing written justification.

12. Information Security

Renaska implements technical, organizational, and physical security measures appropriate to the level of risk, to protect personal data against unauthorized access, loss, alteration, disclosure, or destruction:

(a) Encryption in transit: TLS 1.3 for all communications between clients and Renaska servers. (b) Encryption at rest: AES-256 for the database (Neon PostgreSQL) and file storage (Cloudflare R2). (c) Multi-tenant isolation: each company operates on an independent PostgreSQL schema (`tenant_{slug}`), preventing cross-tenant data access. (d) Access control: Role-Based Access Control (RBAC) with owner / admin / agent / viewer roles and the principle of least privilege; short-lived JWT authentication tokens plus httpOnly Secure SameSite refresh token cookies. (e) Two-factor authentication (2FA): available and strongly recommended for all users. (f) Incident response: in the event of a security breach affecting personal data, Renaska will notify affected Data Subjects and the Colombian SIC within 15 business days of becoming aware of the incident (Decree 1377/2013, Art. 17.b). For U.S. users, Renaska will comply with applicable state data breach notification laws. (g) Periodic security reviews and vulnerability management. (h) Employee access restricted on a need-to-know basis.

13. Cookies and Similar Technologies

Renaska uses cookies and similar local storage technologies on renaska.com, renaska.co, and renaska.us.

Renaska uses only strictly necessary cookies: (a) session and authentication (accessToken, refreshToken, and, where applicable, the platform admin session); (b) Cloudflare security and anti-bot protection (Cloudflare Turnstile); and (c) cookies set by Google Sign-In or Meta/Facebook connection providers, used only when the user activates those features. These cookies do not require prior consent and cannot be disabled without affecting site functionality. Apart from these, the site does not use functional or analytics cookies.

Meta advertising cookies: when the site measures its ads with Meta, it shows a cookie banner and only loads the Meta pixel (cookies _fbp and _fbc) if you click "Accept". If you click "Reject" or make no choice, the pixel is not loaded and nothing is sent to Meta from your browser. Your choice is remembered in this browser and you can change it at any time with "Cookie preferences" in the site footer. While the site does not measure ads with Meta, it shows no such banner and uses no advertising cookies.

You can block or delete the essential cookies through your browser settings, though doing so may prevent login and proper site functionality.

California residents: we do not sell personal information; advertising cookies and the sharing of data with Meta for ad measurement happen only if you accept the cookie banner.

Do Not Track (CalOPPA — Cal. Bus. & Prof. Code § 22575(b)(7)): Renaska does NOT currently alter its data collection practices in response to "Do Not Track" or similar signals transmitted by web browsers. This disclosure is required by California law; it does not indicate active tracking behavior.

14. Prospects and Demo Requests

This section applies to anyone who leaves their details in the "Book a demo" form on renaska.com or renaska.us.

(a) Data we ask for: the fields the form asks for (for example name, phone number and your answers to its questions). (b) Verification: if the form asks to verify your phone, we send a code to the number you give to confirm it is yours. (c) Contact: with your authorization, the Renaska team may contact you by WhatsApp or phone about your request, including through an AI assistant; consent is not required to buy. (d) Record of your authorization: we keep the consent text you saw, its version, the language, the date and time, the page address, the privacy notice that applied, and hashed fingerprints of your IP address and browser.

(e) Ad measurement with Meta: only if you accept the cookie banner, the site loads the Meta pixel (page-view and demo-request events, using the _fbp and _fbc cookies) and, when your request is complete (after phone verification, or at submit if no verification is asked), Renaska sends Meta the request event with the page address, your phone number hashed with SHA-256, a hashed identifier, your IP address and browser data, to measure the results of ads. If you do not accept, nothing is sent to Meta. We keep a record that you accepted the banner.

(f) Rights: you may access, update, correct or delete your data, or revoke your authorization, by writing to [email protected] (see sections 10 and 11).

(g) "Call me": if you tap "Call me" and enter your number, a Renaska artificial intelligence assistant calls you right away, at any time. The number is not verified before the call. At most one request per number is allowed every 24 hours. If the person who answers says they did not ask for the call, the number is blocked from future calls.

15. Children's Privacy

Renaska is a business management platform intended exclusively for individuals aged 18 and older and for authorized representatives of business entities. The platform is not directed at minors.

Renaska does not knowingly collect personal data from children under 14 years of age (Colombian Law 2489 of 2025) or from children under 13 years of age (U.S. Children's Online Privacy Protection Act — COPPA, 15 U.S.C. §§ 6501–6506). If we discover that we have inadvertently collected data from a minor without appropriate parental or guardian authorization, we will delete that information immediately. If you believe a minor has provided personal information to Renaska, please contact us at [email protected].

16. Changes to This Policy

Renaska may update this Policy when necessary to reflect changes in our service, applicable law, or data processing practices.

For material changes (new purposes, new sub-processors, changes to Data Subject rights): (a) We will notify Data Subjects at least 10 calendar days in advance by email and/or via a prominent notice on the platform. (b) Where required by Colombian Decree 1377/2013, Article 9, we will request new explicit consent before applying the changes. For non-material changes (typographical corrections, updated contact details): we will simply publish the updated version. All versions include the last-updated date in the header of this page.

17. Data Protection Officer Contact

Data Protection Officer — Colombia (Law 1581/2012):

Email: [email protected] | Subject: "DATA PROTECTION — [Your Name]" | Response time: up to 15 business days (applied uniformly to all users) | Data Controller: Agencia Leidy Echavarria S.A.S. (NIT 901.147.131-7), Calle 34B #65D 43, Medellín, Colombia | Billing entity: WLM Business Solutions LLC, 1111B S Governors Ave STE 3961, Dover, DE 19904, USA.

CCPA / CPRA Privacy Requests — California, USA (CPRA § 1798.130):

Email: [email protected] | Subject: "CCPA REQUEST — [Your Name]" | Response time: up to 15 business days.

Regulatory authorities: Colombia — Superintendency of Industry and Commerce (SIC): www.sic.gov.co | 01 8000 910165. USA — Federal Trade Commission (FTC): www.ftc.gov | California Attorney General: www.oag.ca.gov.

18. Effective Date

This Privacy and Personal Data Processing Policy takes effect on June 26, 2026, and will remain in force until modified, replaced, or revoked by Renaska.

The most current version will always be available at: renaska.us/legal/privacy (English version) and renaska.com/legal/privacy (Spanish version). By using Renaska's services after this date, the Data Subject acknowledges having read, understood, and accepted the content of this Policy.