1. Scope and roles in data processing
This Policy explains how ServiUno processes personal data through serviuno.com.co, its administrative dashboard, forms, shared links, integrations and other related features (collectively, the “Platform”).
ServiUno acts as the Data Controller for data it determines and uses to create and manage accounts, authenticate users, manage subscriptions and payments, provide support, protect the Platform, fulfill its own obligations and maintain administrative records.
When a customer company records or uploads data concerning its customers, guests, employees, suppliers or other third parties to operate its business, that company is normally the Data Controller and ServiUno acts as the Data Processor, processing the information to provide the Platform and following the company’s instructions.
This Policy does not replace the notice or policy that each customer company must make available to its own data subjects.
- Platform
- ServiUno
- Stated place of business
- Bogotá D.C., Colombia
- Website
- serviuno.com.co
- Privacy contact channel
- jfajardor9210@gmail.com
2. Data we may process
The specific categories depend on the enabled modules and the information each company chooses to record:
- Account and company: trade name, administrator, username or email, password stored as a hash, plan, modules, subscription status, NIT, telephone number, address, email, logo and settings.
- Users and employees: name, position, department, telephone number, schedules, commissions, role, permissions and activity associated with operations carried out on the Platform.
- Customers and vehicles: name, telephone number, email, visit and spending history, license plate, vehicle type, model, color and photographs.
- Appointments, orders and services: dates, services, assigned staff, mileage, photographs, complaints, diagnoses, recommendations, comments, events and authorization or handover signatures.
- Accommodation: guest, contact details, document type and number, nationality, company, stay, accompanying guests, booking origin and purpose, guarantee, deposit, rate, preferences, requests and notes.
- Business operations: sales, quotes, products, services, amounts, discounts, payment methods, credit, memberships, benefits, inventory, cash management and reports.
- Transfer verification: connected Gmail account, bank notice identifier and technical authentication, originating bank or application, amount, currency, reference, date, time, partially masked account, match result and verification trail. On Android, when the company enables it, normalized financial events extracted from permitted notifications are also processed; the general history of messages or notifications is not uploaded.
- Tax and accounting information: identification, billing details, RFC or EIN where applicable, tax regime, CFDI use, billing or delivery addresses, product classifications, descriptions, line items, taxes, withholding taxes, totals, CUFE or UUID, provider, status and audit records.
- Files and documents: images, PDF, XML, CSV or text, file metadata, counterparties, identification details, numbers, dates, items, amounts, notes, tags and AI extraction results.
- Tasks and questionnaires: description, people responsible, people with access, dates, responses, participant identification or position and photographic evidence.
- Orders and integrations: identifiers, origin, channel, contact and delivery details, payment method, notes, products, quantities, prices, totals and technical content received.
- Technical data and communications: session, last activity, expiry, local preferences, print agent information, email recipient, subject, content and attachments, and messages prepared for WhatsApp.
Information may come from the data subject, the customer company, authorized users, people completing forms, connected platforms and payment or invoicing providers.
3. Purposes of processing
We process information, as applicable, to:
- create, authenticate, manage and protect accounts and workspaces;
- provide the contracted modules and record the operations indicated by the customer company;
- manage plans, periods, charges, confirmations and subscription statuses;
- facilitate payments through ePayco and retain references, statuses and metadata returned by the gateway;
- process the company’s own customer payments through Stripe when it enables that service, reconcile payments and, with Stripe Tax enabled, calculate and retain the tax breakdown of supported sales;
- detect incoming payment or transfer notices authorized by the company, compare them with the amount and reference of the payment due, prevent the same evidence from being assigned to two receipts and maintain an audit trail;
- issue, retrieve and audit electronic invoices through the configured provider and facilitate tax compliance;
- send invoices, reports and notifications by email or prepare messages to share through WhatsApp;
- receive orders and synchronize information with authorized integrations;
- extract, classify, summarize and query documents using artificial intelligence, and provide the administrative assistant;
- generate PDFs, tracking, quote, loyalty or questionnaire links, and print jobs;
- apply permissions, maintain traceability, prevent unauthorized access, diagnose failures and handle support, inquiries or complaints;
- comply with legal, contractual, tax and accounting obligations and requests from competent authorities.
The Platform currently does not include its own behavioral advertising tools or offer personal data for sale.
4. Authorization and duties of the customer company
When required by law, processing will take place with the data subject’s prior, express and informed authorization, or on another basis permitted by applicable regulations.
Each customer company must establish and document the authorization or basis allowing it to record data concerning its customers, guests, employees, suppliers and other third parties; inform them of its own purposes; keep information up to date; collect only what is necessary; configure permissions; protect credentials; and respond promptly to data subjects’ rights.
The connection for transfer verification must use a Gmail account controlled and authorized by the company. If it activates optional Android detection, the company must inform the people who manage the device, enable only the necessary banking or financial wallet applications and revoke access when it stops using the feature.
The company must also review results produced by artificial intelligence before using them in accounting, tax, employment, business or service decisions.
5. Sensitive data and children’s data
As a general rule, ServiUno does not require information about health, political or religious views, sex life, ethnic origin or other sensitive categories. However, photographs, signatures, documents, responses and free-text fields could contain such information if a user chooses to include it.
Sensitive information must not be uploaded unless it is strictly necessary, serves a legitimate purpose and has explicit authorization or a legal basis. The data subject is not required to answer questions concerning sensitive data.
Some modules may record the number of children included in a reservation. If other data concerning children or adolescents is processed, the customer company must respect their overriding rights, limit processing to what is necessary and obtain authorization from their legal representative where appropriate.
6. Providers, recipients and transfers
To provide the requested features, we may transmit or disclose information to the following providers, only to the extent necessary:
- ePayco: processes subscription payments. Card or PSE credentials are collected by ePayco; ServiUno receives and retains references, statuses, identifiers and other transaction metadata.
- Siigo, another invoicing operator and DIAN: receive the tax and business data needed to issue, validate or retrieve electronic documents. Communication with DIAN takes place through the configured provider.
- Stripe and Stripe Tax: when the company activates these services in its own account, Stripe processes the payment method and receives the necessary payment data. For tax calculation, it may receive names, contact details, billing or delivery addresses, products, SKUs, quantities, tax classifications, sale location, amounts and currency. ServiUno retains references, statuses, identifiers, amounts and, where applicable, confirmed addresses and tax breakdowns. Card credentials are collected directly by Stripe.
- Facturapi: when the company configures the Mexico integration, it receives issuer and recipient tax data, RFC, legal name, tax regime, postal code, CFDI use, line items, SAT codes, payment form, amounts and taxes to process and retrieve electronic documents. ServiUno retains the request, identifiers, status and UUID and can obtain the XML and PDF. The company manages its organization and certificates directly in Facturapi.
- Brevo: enables emails, content and, where applicable, attached PDF files to be sent.
- Anthropic and OpenAI: process files, queries and operational context when AI extraction or assistance features are used.
- Ordering platforms: exchange catalogs and orders through integrations authorized by the company.
- WhatsApp: receives the number and prefilled message only when a user chooses to open this channel.
- Google Gmail API: when an administrator connects Gmail, it allows recent notices needed for transfer verification to be queried. ServiUno requests read-only access, does not send, modify or delete emails, and retains the encrypted connection token until the company disconnects the account.
- Google Fonts and Cloudflare: supply presentation and site protection resources and may receive technical information associated with a web request.
- Print agent: the program installed on the company’s computer receives the receipt content and reports technical information about the cash register and its printers.
Some providers may process information outside Colombia, depending on their infrastructure and their own policies. These operations will be managed as domestic or international data transmissions or transfers where applicable regulations so determine.
We may also disclose information with the data subject’s authorization, under a judicial or administrative order, to comply with a legal duty or to protect rights and security.
7. Transfer verification, artificial intelligence and protected links
Transfer verification
ServiUno queries recent emails that may correspond to bank notices and processes their content to extract only the fields needed for reconciliation. The full email body is used temporarily for that extraction and is not retained as part of the ordinary record; identifiers, fingerprints and normalized data are stored to deduplicate, audit and associate the result with the receipt.
On Android, local detection is optional and requires the user to grant special notification access. The application discards notifications from packages that are not permitted, transmits only normalized financial fields and temporarily maintains a local queue when offline. ServiUno does not request permissions or access to the SMS inbox; on iPhone this feature operates only through Gmail because iOS also does not allow private notifications from other applications to be read.
The use of information obtained from Google APIs is limited to providing and improving this user-facing feature and is subject to the Google API Services User Data Policy, including its Limited Use requirements. ServiUno does not use that data for advertising or transfer it to build commercial profiles.
A match means that ServiUno detected a compatible notice; it does not replace the bank’s official status. Emails and notifications may be delayed, omitted or manipulated, so ambiguous cases or those without sufficient authentication remain pending review.
Artificial intelligence features
The documents module may send the uploaded file and related context to Anthropic to extract or query information. The administrative assistant may send OpenAI the question, recent messages and operational facts needed to respond.
Responses, classifications and summaries may be incomplete or incorrect. They do not replace human review or accounting, tax, legal or other professional advice, and must not be used as the sole source for decisions affecting an individual.
Token-protected links
ServiUno can generate links for quotes, order tracking, loyalty and questionnaires. Anyone who has the link and its token can access the displayed information without signing in. Depending on the type of link, this may include contact details, vehicle information and photographs, services, diagnosis, amounts, payments, benefits, responses or evidence.
The company and its users must treat these links as confidential, share them only with authorized recipients and report any exposure to the privacy contact channel.
9. Retention, deletion and trash
There is no single automatic retention period for all categories. Data may remain while the account is active, while needed to provide the service or until the company deletes it, subject to legal, tax, accounting, contractual, security or claims-handling obligations.
- Records deleted from general modules go to a trash area holding up to 300 items; permanent deletion is manual.
- Deleting a customer record does not automatically delete its historical orders, payments or appointments.
- Uploaded documents are first marked as deleted; permanent purging removes the file and its record. They do not have a general automatic expiry.
- Expired sessions may be purged; completed print jobs are configured to be purged after seven days when new jobs are generated; questionnaire history retains up to 500 records.
- Payments, invoices, audits, orders and other historical records may be retained for the periods required or permitted by law and the legitimate needs of operations.
- Gmail tokens are deleted when the account is disconnected; device tokens are revoked when the device is unlinked. Normalized evidence linked to a payment may be retained with the financial record to prevent reuse and demonstrate reconciliation.
When closing a company account, confirmation of the scope of deletion may be requested. External providers may retain information under their own policies and obligations, and erasure will not take place where there is a legal or contractual duty to retain it.
10. Information security
The Platform applies technical and organizational measures intended to protect information, such as hashed password storage, protected sessions, permissions by role and action, document restrictions, integration tokens and encryption of certain sensitive settings.
No system is completely secure. Each company must assign the minimum access needed, revoke accounts and integrations it no longer uses, keep its devices protected and avoid sharing passwords or token-protected links.
11. Data subjects’ rights and procedure
Under Law 1581 of 2012, data subjects may:
- know about, access, update and rectify their data;
- request proof of authorization where required;
- be informed of how their information has been used;
- revoke authorization or request erasure where applicable;
- access the data being processed free of charge;
- refrain from answering questions about sensitive data or children’s data;
- file a complaint with the Superintendencia de Industria y Comercio after completing the procedure before the Controller or Processor.
How to submit a request
Inquiries, requests for access, updating, rectification, erasure or revocation, and complaints may be sent to jfajardor9210@gmail.com with the subject “Datos personales”.
The request must state the data subject’s name, preferred reply channel, relationship to the company or account, a clear description of the request and the information needed to locate the data. We may request reasonable evidence of identity, representation or authorization.
If the information was recorded by a customer company, ServiUno may forward the request to that company, cooperate with it and act according to its instructions as Processor.
Response times
Inquiries will be answered within a maximum of ten (10) business days. If a response cannot be provided within that period, the reason will be communicated and the response will be given within the following five (5) business days. Complaints will be handled within a maximum of fifteen (15) business days from the day after receipt; if an extension is needed, the reason will be communicated and the response will be given within the following eight (8) business days.
12. Changes and effective date
This Policy takes effect on August 24, 2026. The September 4, 2026 update described transfer verification through Gmail and, optionally, financial notifications on Android. The September 14, 2026 update adds Stripe payments, Stripe Tax calculation and the Mexico invoicing integration through Facturapi, when configured by each company. Changes will be published on this page and will state their update date. Material changes will be communicated before being applied and, if they involve a new purpose requiring authorization, that authorization will be requested in advance.
13. Contact and regulatory framework
Bogotá D.C., Colombia
Suggested subject: “Datos personales”
This Policy is guided by Law 1581 of 2012, Decree 1074 of 2015 and other applicable Colombian personal data protection rules.