Privacy policy

1. Data controller

The data controller is Miguel Ángel Sánchez Soto, an individual operating under the trade name Nodo Labs.

• Trade name: Nodo Labs (also NodoLabs).
• Controller’s legal name (individual): Miguel Ángel Sánchez Soto.
• NIT: 1107847952-1.
• Domicile: Cali, Valle del Cauca, Colombia.
• Physical address: Avenida 2G #40-158, barrio Vipasa.
• Email: hola@nodolabs.online.
• Phone / WhatsApp published on the site: +57 317 400 0055.
• Website: https://nodolabs.online.
• Team that handles requests, queries, and claims: Nodo Labs, at hola@nodolabs.online. As published on the site, the studio is operated by Miguel Ángel Sánchez Soto and Diego Alejandro Duran.

Miguel Ángel Sánchez Soto, operating as Nodo Labs, is the controller. The providers in the processors section process data for Nodo Labs or, when you use their service directly, as controllers of that service.

2. Data we process

We process what this policy’s purposes require. We do not ask for sensitive data or for data about children or adolescents.

Contact form

Name, email, project description, page language, and a record that you checked the authorization. A hidden field is a spam trap: if it is filled in, the request is rejected and is not stored as a message.

Project assistant

The text you type, the language, the currency you pick, and the solution you opened the chat from, if any. The assistant uses that to build a scope reference. Your name and email are asked only if you choose to send a request, and they travel with the contact form. If you type your name, email, or other details into the chat itself, that text is also processed to generate the reply.

The assistant asks you not to send passwords, API keys, payment details, or sensitive data.

Booking

The booking button opens a Google Calendar page by default. Google receives what you submit there, usually your name, email, time, and the booking form’s answers. Nodo Labs sees the appointment on the studio calendar. If the site is configured with another scheduler, such as Cal.com or another page, that provider receives the booking details instead of Google.

Email, WhatsApp, and Instagram

If you email hola@nodolabs.online, we keep what we need to reply. If you open WhatsApp to +57 317 400 0055, WhatsApp (Meta) processes the conversation and Nodo Labs receives the message in order to answer. The Instagram link (instagram.com/nodolabsonline) does not hand us your profile. If you message that account, we process the public name, the identifier, and the message in order to reply.

Technical data

When you use the site, the server receives the IP address, the browser, and the requested page because that is how hosting works. On the form and the chat, the IP is turned into a SHA-256 hash and used only to slow abuse. The hash is used in a rolling 10-minute window and is not written to a database. Inactive entries are removed when another request is processed after that window or when the instance restarts. We may also store the language you chose.

Measurement and advertising

• Vercel Web Analytics. Measures visits in aggregate: page, referrer, browser, operating system, device type, and estimated country. It does not use cookies, and Nodo Labs does not build an advertising profile with it.
• Meta Pixel, ID 936372219194316. Records a page view on each visit and a contact event when someone uses a WhatsApp call-to-action on the landing page. It may set cookies such as _fbp and, if you arrive from an ad, _fbc. Meta may match those events to a Facebook or Instagram account under its own policy.

3. Purposes

• Reply to requests, prepare a scope reference, and arrange a conversation.
• Send the confirmation you asked for and write to you about that project.
• Deliver the work if we reach an agreement, and keep the records of that relationship.
• Measure how the site is used, see which content and campaigns lead to contact, and improve the experience.
• Prevent spam, abuse, and unauthorized use of the form and the chat.
• Handle habeas data queries and claims, and meet legal duties.
• Publish brand content and reply to messages on the channels and integrations in the social section.

We do not sell personal data. We do not make automated decisions that produce legal effects. The assistant’s figure is an initial reference; someone on the team reviews it before hours or budget are agreed.

4. Authorization

Law 1581 of 2012 requires the data subject’s prior, express, and informed authorization, except for the cases in article 10, such as an order from a public authority or data that is public by nature.

• On the form, and when you confirm sending from the assistant, the checkbox — unchecked by default — is the authorization. It covers the processing described here and the transfer to the processors in this policy. Without that checkbox the request is not sent.
• In the chat, the footer notice links to this policy. The message is processed to answer you. Your name and email are used to contact you only if you confirm sending and check the authorization.
• If you write by email, WhatsApp, or a social network, we use that message to reply and, if a commercial relationship follows, to manage it.

You can ask for proof of the authorization. The record is kept with the internal notice of the request.

The Meta Pixel loads with the site for measurement and advertising even if you never send the form. It is not required to read the content. How to limit it is in the cookies section.

5. Your rights

Under article 8 of Law 1581 of 2012, you may:

• Know, update, and correct your data (conocer, actualizar y rectificar).
• Ask for proof of the authorization.
• Be told, on request, how your data has been used.
• File a complaint with the Superintendence of Industry and Commerce (SIC) for violations of the law, after you have completed the query or claim procedure.
• Revoke the authorization and ask for deletion (suprimir) when there is no legal or contractual duty to keep the data.
• Access, free of charge, the personal data being processed.

These requests are free of charge. The channel is hola@nodolabs.online.

6. Queries and claims

Queries (consultas)

Use a query to know your data, how it was used, or to obtain proof of authorization. Article 14 of Law 1581 of 2012 sets the deadline.

1. Email hola@nodolabs.online with the subject “Consulta de datos personales”.
2. Include your name, an email or phone number, and what you want to know.
3. We answer within ten (10) business days from receipt.
4. If we cannot answer in time, we explain why and give the date of the answer. The extension cannot exceed five (5) additional business days.

Claims (reclamos)

Use a claim to correct, update, or delete data, or to revoke authorization. Article 15 of Law 1581 of 2012 sets the procedure.

1. Email hola@nodolabs.online with the subject “Reclamo de datos personales” or “Supresión de datos”.
2. Include the data subject’s name, a description of the facts, a contact method, and any documents you want to assert.
3. If the claim is incomplete, we ask you to complete it within fifteen (15) days of our notice. If you do not, it is deemed withdrawn.
4. If Nodo Labs is not the right party, we forward it within two (2) business days and tell you.
5. Once the claim is complete, we mark the data “reclamo en trámite” within two (2) business days.
6. We answer within fifteen (15) business days counted from the day after the complete claim is received.
7. If we need more time, we explain why and give the new date. The extension cannot exceed eight (8) additional business days.

Revocation and deletion do not proceed when a legal or contractual duty requires us to keep the data, or when it is needed to recognize, exercise, or defend a right in a judicial or administrative proceeding.

After you complete the query or claim, you may complain to the Superintendence of Industry and Commerce, Deputy Superintendence for Personal Data Protection: www.sic.gov.co.

7. How to ask for deletion

Email hola@nodolabs.online with the subject “Supresión de datos”. Name the channel (form, chat, email, WhatsApp, Instagram, Meta, LinkedIn, X, or Threads), an identifier we can recognize (email, phone, or profile), and which data you want deleted.

We follow the claim procedure: we answer within fifteen (15) business days from the day after the complete claim is received, with an extension of at most eight (8) business days if we tell you why. We delete what Nodo Labs holds, unless a legal or contractual duty requires us to keep it.

We cannot delete data held only by Meta, Google, LinkedIn, X, Vercel, Anthropic, Resend, or another provider. Use that platform’s tools, for example Meta ad settings, and write to us as well if we also have a copy.

8. Sensitive data and minors

We do not request sensitive data: data that affects privacy or whose misuse could cause discrimination, including health, biometrics, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or sex life. Do not include it in the form, the chat, or messages.

If we detect sensitive data we do not need, we do not use it and we delete it when the law allows. Any future processing of sensitive data would require explicit, optional authorization, or an exception in article 6 of Law 1581 of 2012.

The site and the services are aimed at businesses and adults. We do not knowingly process data of children or adolescents. Article 7 of Law 1581 of 2012 restricts that processing. If you believe we hold a minor’s data, email hola@nodolabs.online and we will delete it. An exceptional case would require the legal representative’s authorization and respect for the minor’s prevailing rights.

9. Processors and international transfers

Several providers process data outside Colombia, mainly in the United States. Law 1581 of 2012 conditions that transfer. When you authorize the form or the send step in the assistant, you authorize the transfers those purposes require. Hosting the site transmits technical data to Vercel so the page can be shown to you.

These providers may use the data only for the assignment. Nodo Labs does not sell it or hand it to data brokers.

10. Social networks, posting tools, and apps

This site’s code includes the Meta Pixel, the Instagram link, and the WhatsApp links. It does not include LinkedIn, X, or Threads kits.

Nodo Labs may use developer apps and posting tools on Meta (Facebook and Instagram), LinkedIn, X, and Threads to publish brand content, manage the presence, and reply to messages. When that happens, the platform may provide account or page identifiers, the public name, the content, reach and engagement metrics, and the messages a person sends.

That data is used to publish what was requested, to reply, and to measure the result. It is not sold. Each platform also processes it under its own policy: Meta, WhatsApp, LinkedIn, and X. Google, Vercel, Anthropic, and Resend are covered by their policies linked in the previous section.

If a developer app on those networks accesses a member’s or a page’s data, the scope is what the person or the admin authorizes on that platform’s permission screen, and the purpose is to operate the integration, not a different use and not the sale of the information. Deletion of what Nodo Labs holds is requested through section 7.

11. Retention

• Prospect requests (form, assistant, email, booking, WhatsApp, and social messages): while the contact is being handled and for up to twenty-four (24) months after the last exchange. They are then deleted or dissociated, unless the law requires longer retention or the relationship becomes a contract.
• Customers and records of the relationship: for the life of the contract and, afterward, for the period the applicable rule requires. A merchant’s books and papers may be kept for ten (10) years (article 60 of the Commercial Code) and tax support documents for five (5) years (article 632 of the Tax Statute), counted as each rule provides.
• Chat: this site does not keep a database of the conversation. The text is transmitted to generate the reply. If you send a request, a summary and notes stay in the email and follow the request retention period. Anthropic may retain API inputs for the period its commercial policy sets for safety and abuse. Nodo Labs does not authorize their use to train models.
• IP hash used for abuse limits: in memory, with a rolling ten (10) minute window. Inactive entries are removed when another request is processed after that window or when the instance restarts.
• Vercel analytics and Meta Pixel events: according to each provider’s retention. Meta’s _fbp cookie usually lasts about ninety (90) days.
• Language cookie: see the cookies section.

12. Security

The site is served over HTTPS and sends security headers (HSTS, nosniff, a referrer policy, camera, microphone, and location restrictions, and a content policy that stops other sites from embedding it). The form and the chat reject foreign origins, limit message size, and apply a rate limit. The internal email escapes content to prevent HTML injection. Access to mailboxes and provider accounts is limited to the people who operate Nodo Labs.

No measure is infallible. If security measures are breached, or there is a risk in the administration of data subjects’ information, we will inform the Superintendence of Industry and Commerce and the people affected when Law 1581 of 2012 requires it.

13. Cookies and similar technologies

You can block or delete cookies in the browser. The site can still be read. For Meta ads, use Meta ad settings. Blocking the pixel does not affect the form or the chat.

14. Changes

We may update this policy. The new version is published at this same address and states its effective date. If a change of purpose requires a new authorization, we will ask for it before using data already collected for that new purpose.

15. Effective date

This policy is effective October 29, 2026. Databases remain in place while the purpose continues and, afterward, for the retention periods in section 11.

Queries and claims: hola@nodolabs.online. Data-protection authority: Superintendence of Industry and Commerce, www.sic.gov.co.