Privacy Policy

This is the privacy policy of PhoenixCode, based in Colombia. It explains what personal data we process when you visit phoenixcode.ai, use our products or contact us by phone, WhatsApp, SMS, email or web forms, why we process it, and how to exercise your rights.

If this English version and the Spanish version at /privacidad differ, the Spanish version prevails.

1. Data controller

2. Legal framework

We process personal data under Colombian Statutory Law 1581 of 2012 and Decree 1377 of 2013 (compiled in Decree 1074 of 2015). Where data subjects are in other jurisdictions, we also apply the local rules that govern them.

2.1 When we are the controller and when a processor

• We are the controller of the data of people who contact us, visit the site, use our licences or are our customers and suppliers. That is what this policy covers.
• We are a processor when, in delivering an analysis or migration service, we access personal data held inside a customer's systems, code or databases. The customer is then the controller: we handle that data only on their instructions and under the contract signed with them, and data subjects should address their requests to that customer first.

3. What we process and why

3.1 Sales enquiries and customer service

• Data: name, company, job title, email, phone number, country, the content of your messages and what you tell us about your needs (technology, system size, plan of interest).
• Purposes: answering your requests; preparing proposals and quotes; commercial follow-up; support; keeping the history of our relationship with your company; assigning you an account owner.
• Phone number on the contact form: it is optional. We keep it only if you tick the box agreeing to be contacted by phone or WhatsApp at that number, and we record the date you agreed. We use it only to reach you about your request, and you can ask us at any time to stop using it or to delete it.
• Where it is handled: contact-form requests are also logged in our internal customer-service tool, the same one that handles calls and messages, so that a person on the team answers them.

3.2 Phone calls, WhatsApp and SMS

• Data: phone number, date, duration and status of the call or conversation, message content, the transcript of calls, the summary generated from it and, when we tell you so at the start of the call, the audio recording or the voicemail you leave.
• Virtual assistant: calls and messages to the PhoenixCode number may first be answered by an artificial-intelligence assistant. We tell you so at the start of the conversation. The assistant can log your request and transfer you to a person at any time if you ask.
• Purposes: handling the call or message; recognising you as a customer by your number to route you to your account owner; logging your request; continuity of the conversation; quality control and service improvement.
• What the AI does and does not do: the assistant gives general information, takes your request and hands it to the team. It makes no decisions about prices, contracts or about you: a person always makes those. Your conversations are not used to train artificial-intelligence models; our terms with the model provider do not allow it to train on them.
• Calls we place with the virtual assistant: only if you have previously agreed to be contacted that way. You can withdraw that consent at any time.

3.3 PhoenixCode Lens and the web assessment

• Data: the email linked to the licence, a technical machine fingerprint (an identifier derived from the hardware, with no personal data in clear text) and licence usage counters.
• Source code: Lens analyses code on your machine. Only when you use AI rule extraction, or upload code to the web assessment, is the source of the analysed component sent to our API to be processed by the AI model. Source code is used for nothing other than producing your result.
• Purposes: activating and validating the licence; preventing unauthorised use; metering contracted usage; delivering the analysis you asked for.

3.4 Browsing the website

• Analytics: only if you accept in the cookie notice do we load Google Analytics to collect usage statistics (pages viewed, approximate country, device type). If you do not accept, it is not loaded and no analytics cookie is set.
• Your choice: it is stored in your own browser and you can change it whenever you like: choose again about cookies.
• No advertising: we do not use advertising or cross-site tracking cookies.
• Anti-spam: forms use hCaptcha to prevent automated submissions; that service receives technical data from your browser to tell a person from a program.

3.5 Security of our tools

• Data: for each attempt to sign in to our internal tools we keep the date, the email that was typed, whether the attempt succeeded, the IP address and the browser. Never the password.
• Purposes: detecting and stopping unauthorised access to our customers' information.

4. Consent

We process your data with your prior, express and informed consent, given when you submit a form, activate a licence, write to us, or continue a call after being informed of the processing, or through unequivocal conduct. Consent is not required in the cases listed in article 10 of Law 1581 of 2012. We keep proof of consent.

We do not process sensitive data unless you volunteer it; you are not required to. Our services are not directed at minors.

5. Processors and international transfers

We rely on providers that process data on our behalf, whose processing terms require them to protect it and use it only for the purpose we engage them for. Several are outside Colombia, which involves an international transfer of data that you authorise by accepting this policy:

With these providers the basis for the transfer is the service contract and its data-processing terms; with you, the consent you give us. The list is kept up to date: if we add a provider that processes personal data, we add it here.

We do not sell personal data or share it with third parties for their own marketing.

Your phone number. We do not share or sell your mobile phone number, or the consent you gave us to message or call you, with third parties or affiliates for marketing or promotional purposes. It is received only by the messaging and telephony providers that carry the communication (Twilio and Meta), and only for that.

6. Your rights

• To know, update and correct your data.
• To request proof of the consent you gave.
• To be told how your data has been used.
• To withdraw consent and request deletion, where no legal or contractual duty requires us to keep it.
• To access your data free of charge.
• To file a complaint with Colombia's Superintendence of Industry and Commerce (SIC) after completing the request process with us.

To stop receiving WhatsApp or SMS messages, reply STOP. On a call, you can ask at any time to speak to a person or not to be called again.

7. How to make a request

Write to admin@phoenixcode.ai with your name, identification, contact details, a description of your request and, for complaints, any supporting documents. Requests are handled by the management of PhoenixCode. You can also call +1 (786) 946-1444.

Requests may be made by the data subject, their successors, or their representative or attorney, on proof of that capacity. They are free of charge.

• Enquiries are answered within ten (10) business days of receipt, extendable by up to five (5) business days with notice of the reason.
• Complaints (correction, update, deletion or breach) are resolved within fifteen (15) business days from the day after receipt, extendable by up to eight (8) business days with notice. If a complaint is incomplete we will ask you to complete it within five (5) days; if two (2) months pass without your completing it, it is treated as withdrawn.
• Withdrawal and deletion: you can ask for either through the same channel. We act on it unless a legal or contractual duty requires us to keep the data, in which case we explain why.

8. Retention, life of our databases and security

We keep data only for as long as is reasonable and necessary for the purposes above. Once the purpose is fulfilled we delete it, unless a legal or contractual duty requires us to keep it.

What is deleted, automatically or at your request, may remain for up to 35 more days in backups, which are overwritten on their own and are not used for anything else.

Life of our databases: our databases remain in force while PhoenixCode carries on its business and the purposes the data was collected for subsist, within the periods in the table above.

Security: we apply reasonable technical, human and organisational measures: encryption in transit, access to conversations and customer data restricted by user and role, a record of sign-in attempts with lockout on repeated failures, and backups.

Incidents: if a security incident compromises personal data, we will report it to Colombia's Superintendence of Industry and Commerce as the law requires and tell the affected people when it puts them at risk.

9. Changes

We will publish any material change on this page before applying it, with the new effective date, and tell you through the channel we normally use with you (email or message) when we have your contact details. If a change affects the purposes you consented to, we will ask for your consent again.