Privacy Policy

1. Information We Collect

SmartPH collects the following personal information when you use our platform:

• Full name, ID number, and contact information (email, phone).
• Information about the residential unit you belong to.
• Access data: IP address, device, browser, and operating system.
• Activity logs within the platform (audit).
• Photos of visitors, vehicles, packages, facial recognition selfies and intercom audio recordings.
• Biometric data (fingerprint, facial recognition) when enabled by the user.
• GPS location during security rounds (security personnel only).
• Conversations with the AI assistant Sophi (chat, WhatsApp and voice).

2. Use of Information

We use your information to:

• Manage your account and authentication on the platform.
• Facilitate the administration of your residential community (billing, reservations, announcements, PQRS, etc.).
• Send relevant notifications related to your unit or community.
• Generate statistical and audit reports for community administration.
• Improve platform security and functionality through error analysis (Sentry) and usage metrics.
• Process voice commands through Amazon Alexa for home automation.
• Train and improve AI models to personalize user experience.

3. Storage and Security

Your data is stored on secure servers with AES-256 encryption at rest and TLS 1.3 in transit. We implement Row Level Security (RLS) on 100% of tables, JWT validation with auto-refresh, brute-force protection (lockout after 3 attempts) and complete action auditing. Storage buckets operate with signed URLs and limited expiration.

4. Data Sharing

We do not sell or share your personal information with third parties, except in the following cases:

• With your residential community's administration, within the scope of its management.
• With technology providers acting as data processors, under contract and only to provide the service (the full list, with their country and purpose, is in section 10).
• When required by competent authorities in accordance with the legislation of Colombia.

5. Data Subject Rights

In accordance with Colombian Law 1581 of 2012 and Decree 1377 of 2013, you have the right to:

• Know, update, and rectify your personal data.
• Request proof of the authorization granted.
• Be informed about how your data is used.
• Revoke authorization and/or request deletion of your data.
• File complaints with the Superintendence of Industry and Commerce.

6. Cookies and Similar Technologies

We use local browser storage to maintain your active session and theme preferences. We do not use tracking cookies or third-party advertising.

7. Data Retention

We retain your information as long as your account is active or necessary to provide services. Audit records are kept for the period determined by the community administration, in accordance with applicable regulations.

8. Contact

To exercise your rights or make inquiries about this policy, you can contact your residential community's administration through the platform, or write to us at [email protected].

9. Modifications

We reserve the right to update this policy. Any changes will be published on this page with the date of last update.

10. International Data Transfer

To provide the service, SmartPH relies on the following providers, which act as data processors: they process the data on our behalf and only for the stated purpose. Those operating outside Colombia involve an international transmission or transfer of data:

• Supabase (USA, on Amazon Web Services infrastructure): database, authentication, files and server functions. It receives all the platform's data.
• Google LLC (USA): Gemini, the assistant's artificial intelligence (conversations, audio transcription, reading documents and images) and the facial verification used by biometrics; synthetic voice; and Firebase Cloud Messaging for push notifications. Under the paid service terms, Google does not use this data to train or improve its models; it may keep it temporarily only to detect abuse.
• OpenAI (USA): backup artificial intelligence and synthetic voice; it only receives a request when the main service does not respond.
• Meta Platforms (USA): WhatsApp Business, for WhatsApp messages and notices.
• Twilio (USA): voice calls, virtual intercom and text messages (SMS).
• ElevenLabs (USA): the assistant's voice in calls and audio messages, and speech recognition.
• Resend (USA): sending email.
• Sentry (USA): application error monitoring (technical identifiers and diagnostic data).
• Cloudflare (USA): hosting of the web application, delivery of app updates, network security, incoming email and storage of backup copies.
• Apple (USA): push notifications on iPhone (APNs).
• Amazon (USA): voice commands through Alexa, only if you link your account.
• Payment gateways ePayco, Wompi and Puntored (Colombia) and Mercado Pago: they process online payments when the complex enables them.
• Siigo (Colombia): electronic invoicing of the SmartPH license to the complexes (data of the complex and its contact).

SmartPH requires each provider to meet data protection obligations no lower than those in this policy. You can ask for more information or exercise your rights at the data protection email in section 8.

11. Push Notifications and Device Data

To deliver push notifications (visitor alerts, packages, authorizations, announcements, intercom, citofony, SOS calls, Sophi messages, etc.) we process the following device data:

• Unique device token issued by Apple Push Notification service (APNs), Firebase Cloud Messaging (FCM) or the browser (Web Push VAPID).
• Device type, operating system and platform (iOS, Android, Web) to route the notification to the correct channel.
• User, community and unit identifiers associated with the token, to ensure you only receive alerts relevant to your role and residence.
• Token activity timestamps (last used) to clean up devices inactive for more than 60 days.
• Notification preferences (active channels, pauses, opt-out by category such as Sophi Tips) stored to respect your choices.
• Delivery and read status of each notification, for operational auditing and service improvement purposes.

APNs (Apple), FCM (Google) and web push providers may process these identifiers according to their own privacy policies. You can disable notifications at any time from your device settings or from the preferences panel inside the application; this will remove the associated token from our systems in the next cleanup cycle.

12. Data from your Google account (SmartPH Correos)

If you connect your Google account to SmartPH Correos, SmartPH's email assistant, we request only these permissions:

• Send email on your behalf (gmail.send): the assistant replies from your own address, in the same conversation. With Gmail we do not access your mailbox: you forward your emails to the address we give you, and you can stop forwarding at any time. The assistant reads what it receives and replies only to messages that meet the rules set by the administrator (allowed or blocked senders, subjects, type of message and business hours), or leaves a draft for a person to approve. Automated emails, newsletters and system notices are discarded without being recorded.
• See your email address (userinfo.email): to know which account you connected.
• View and edit events on your calendars (calendar.events): to schedule the appointments your customers request.
• Google Sheets (spreadsheets): to add a row to the sheet you choose when a customer leaves an order or a request.

What we do with that data:

• We use it only to provide these features to the business that connected the account.
• We do not sell it, we do not use it for advertising, and we do not use it to train general-purpose AI models.
• To provide these features, the information may be processed by our hosting and artificial intelligence providers, which handle it on our behalf and only for that purpose. We do not share it with anyone else, unless required by law.
• No one on our team reads it, unless you authorize it to give you support, it is needed for security, or it is required by law.
• The access permission is stored encrypted. You can disconnect the account from the dashboard at any time, or remove access at https://myaccount.google.com/permissions. When you disconnect it, we delete the stored permission.

SmartPH's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.