Last updated: June 7, 2026.

This policy develops the fundamental right of Habeas Data (article 15 of the Political Constitution of Colombia) and freedom of information (article 20), Ley Estatutaria 1581 de 2012 (declared constitutional by Sentencia C-748 de 2011) and Decreto 1377 de 2013.

Legal framework: Ley 1581 de 2012, Decreto 1377 de 2013 and complementary rules (Colombia); GDPR (European Union), CCPA/CPRA (California, U.S.) and the LGPD — Lei nº 13.709/2018 (Brazil), for users subject to those rules.

You may revoke your authorization and request the deletion of your data when the processing does not respect constitutional and legal principles, rights and guarantees (art. 8, lit. e, Ley 1581 de 2012), except where there is a legal or contractual duty of retention.

Notice: this document is general information and does not constitute legal advice.

The data controller is LUXISOFT, operator of LUXIPANEL, identified with NIT [____] and domiciled at [address], Colombia. Privacy contact: [privacy email / support channel]. NOTE: the controller's identification (NIT/registration, domicile and contact) is a placeholder that must be completed before publishing to production; its absence breaches art. 13, lit. a of Decreto 1377 de 2013 and art. 17 of Ley 1581 de 2012.

LUXISOFT acts in a dual role depending on the type of data:

• As Data Controller (controller; art. 3, lit. e, Ley 1581 de 2012): with respect to account, identity, authentication, payment, usage, support, blog and marketplace data, which we process for our own purposes that we define.
• As Data Processor (processor; art. 3, lit. d, Ley 1581 de 2012): with respect to the server credentials (SSH) and the data we access in the customer's infrastructure on their instruction. In this relationship, the customer is the Controller and LUXISOFT processes that data solely in accordance with their documented instructions, without determining its own purposes.

For users subject to the GDPR, this processing relationship is governed by a Data Processing Agreement (DPA) in accordance with article 28 of the GDPR, which forms an integral part of these terms and includes: the subject matter, duration, nature and purpose of the processing; types of data and categories of data subjects; the commitment to process the data only under the customer's documented instructions; confidentiality of personnel; the security measures of article 32 (detailed in the Security section); the sub-processor regime; assistance in the exercise of data subjects' rights and in breach notification; and the deletion or return of the data at the end of the service. You may request the full version of the DPA through the support channels.

Point of contact and DPO: you may direct any query about your data through the indicated channels. If the nature or volume of the processing so requires, we will appoint a Data Protection Officer (DPO) (GDPR art. 37) and, where applicable, a representative in the European Union (GDPR art. 27), publishing their contact details in this policy. You may exercise your rights through the channels in section 9.

Depending on your interaction with the platform, we may process:

• Account and identity data: email, name, photo, language/locale, Google identifier, company, country and phone/WhatsApp (optional).
• Authentication: Google/Firebase identity tokens and metadata of passkeys (WebAuthn) and recovery codes.
• Payment metadata: references, statuses, amounts and dates of transactions processed by Wompi. We do not store card data.
• Server credentials: SSH user, port, IP, private keys and passphrases, stored encrypted with AES-256-GCM and never in plain text.
• Technical usage data: connection logs, balance consumption, audit events, IP addresses and device data.
• Interactions with the AI assistant: the text of the queries and responses processed to provide support.
• User content: blog articles, marketplace modules, support tickets and attachments.

We process each category of data with a specific lawful basis (GDPR art. 6.1):

• Performance of the contract [art. 6.1.b]: creating and maintaining the account, authentication, balance management and purchases, SSH connection to your servers, support, marketplace payouts.
• Consent [art. 6.1.a]: signing in with Google, commercial communications and non-essential cookies. Revocable at any time without retroactive effect.
• Legal obligation [art. 6.1.c]: tax/accounting retention, attending to authority requirements, KYC verifications.
• Legitimate interest [art. 6.1.f]: platform security, fraud prevention and service improvement, following a documented balancing against your rights. You may object to these processing activities in accordance with art. 21 of the GDPR.

LUXISOFT processes your data in accordance with the principles of article 4 of Ley 1581 de 2012 (legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security and confidentiality) and complies with the duties of article 17 (as Controller) and article 18 (as Processor of the customer's credentials).

We process the data to: operate the portal, panels and applications; authenticate users; manage the data balance, purchases and receipts; securely connect to the customer's servers via SSH; provide support and operate the AI assistant; manage the blog and the marketplace (including payouts); strengthen security and prevent fraud; comply with legal obligations; and send transactional and, with your consent, commercial communications.

Some processing may involve sensitive data within the meaning of article 5 of Ley 1581 de 2012 and of the special categories of article 9 of the GDPR:

• Biometric data (passkeys/WebAuthn): biometric verification (fingerprint or face) is performed locally on your device; LUXIPANEL does not receive or store your biometrics, only a cryptographic public key that does not allow them to be reconstructed. You may use non-biometric authentication methods.
• AI assistant content: if you voluntarily include sensitive information (e.g. health data) in the chat, it will be processed solely to answer your query. We recommend that you do not share unnecessary sensitive data.

In accordance with article 6 of Ley 1581 de 2012, Decreto 1377 de 2013 and article 9 of the GDPR, the processing of sensitive data requires your explicit authorization and you are not obliged to grant it; no service is conditioned on your providing sensitive data.

We do not sell your personal data. We only share it with processors/sub-processors strictly necessary to operate the service, or where there is a legal obligation or a requirement from a competent authority. Main sub-processors:

• Google / Firebase — authentication and identity infrastructure.
• Wompi — payment processing (card data handled in its own environment).
• Cloudflare — CDN, object storage (R2) and network protection.
• AI provider (OpenAI-compatible model) — processing of assistant queries.
• Meta (Facebook/Instagram) — optional syndication of blog posts.

Each sub-processor processes the data under its own processing terms and security measures.

Some sub-processors operate outside Colombia and the European Economic Area (mainly in the United States and other regions where Google/Firebase, Cloudflare, the AI provider and Meta operate). Colombian law distinguishes:

• International transmission (art. 25, Decreto 1377 de 2013): sending data to a processor that handles it on behalf of and according to LUXISOFT's instructions (Google/Firebase, Wompi, Cloudflare, AI provider). With each of them we sign a transmission contract with protection and confidentiality clauses.
• International transfer (art. 26, Ley 1581 de 2012): only carried out to countries with an adequate level of protection according to the Circular Externa 005 de 2017 de la SIC (among them the United States and the European Union Member States), or under its exceptions, in particular where the transfer is necessary for the performance of the contract between the data subject and LUXISOFT (art. 26, lit. e) or where there is your express and unequivocal authorization (lit. a).

For users subject to the GDPR, the safeguards of Chapter V of the Regulation additionally apply:

• Adequacy decision — EU-US Data Privacy Framework (DPF): where the U.S. sub-processor is certified under the DPF, the transfer relies on the European Commission's adequacy decision (GDPR art. 45). We maintain the Standard Contractual Clauses as a backup mechanism given the pending appeal regarding the DPF.
• Standard Contractual Clauses (SCC): for destinations without an adequacy decision, we sign the SCC approved by the European Commission (GDPR art. 46.2.c), supplemented with additional technical and organizational measures following a transfer impact assessment (TIA) where appropriate.

You may request information about the mechanism applicable to a specific sub-processor and a copy of the safeguards through the support channels.

We retain data for as long as necessary for the stated purposes and to comply with legal, tax, accounting, contractual or security obligations. Identity tokens are processed in transit and are not kept beyond what is needed to maintain the session. Verified deletion requests are handled within thirty (30) days, except for information we are required to retain.

Tokens are kept as consumption credit and never expire. The associated transaction and consumption records are retained under the applicable legal periods.

Your rights depend on the regulations applicable to you:

• Data owners in Colombia (Ley 1581 de 2012, art. 8): to know, access, update and rectify your data; to request deletion and revoke authorization where appropriate; to submit inquiries and claims to the controller and, once the procedure is exhausted, to the SIC.
• Data subjects under the GDPR (arts. 15-22): access, rectification, erasure ("right to be forgotten"), restriction of processing, portability, objection (including objection to legitimate interest, art. 21) and not to be subject to automated decisions with significant legal effects.
• California residents (CCPA/CPRA): you have the right to know, access, delete and correct your information; to opt out of the "sale" or "sharing" of your personal information; and to limit the use of your Sensitive Personal Information (SPI) to the permitted purposes. We do not sell personal information. The optional syndication of content to Meta (Facebook/Instagram) only takes place upon your activation; if this were to imply a "sharing" for cross-context behavioral advertising, we offer the "Do not sell or share my personal information" control on the platform.
• Data owners in Brazil (LGPD — Lei nº 13.709/2018, arts. 17-22): confirmation, access, correction, anonymization, portability, deletion and revocation of consent, with the possibility of complaining to the Autoridade Nacional de Proteção de Dados (ANPD).

You can exercise your rights by sending a request through LUXIPANEL's official support channels, identifying yourself and using the same registered email.

Inquiries (art. 14, Ley 1581 de 2012): we will attend to your inquiry about the data we hold about you within a maximum of ten (10) business days. If this is not possible, we will inform you of the reasons and the new date, which will not exceed five (5) business days following the expiry of the first period.

Claims (art. 15, Ley 1581 de 2012): claims (correction, update, deletion or revocation of authorization) will be addressed within a maximum of fifteen (15) business days counted from the day following their receipt, extendable by eight (8) business days. If the claim is incomplete, we will ask you to remedy it within the following five (5) days; while it is being resolved, the database will bear the legend "claim in process".

International timelines: for GDPR users we will respond without undue delay and at the latest within one (1) month, extendable by two further months in complex cases, informing you of the extension (art. 12.3). For California residents (CCPA/CPRA) we will respond within 45 days, extendable by an additional 45 days. If the request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse, giving reasons.

You can revoke LUXIPANEL's access to your Google Account at myaccount.google.com/permissions.

In accordance with article 16 of Ley 1581 de 2012, you may only file a complaint with the Superintendencia de Industria y Comercio (SIC) (www.sic.gov.co) once you have exhausted the inquiry or claim procedure with LUXISOFT. EEA users may turn to their data protection authority.

When you use the AI assistant, the text of your query (and the necessary context, such as the conversation history and the metadata of your account required for the tool) is sent to an OpenAI-compatible model provider for the sole purpose of generating the response and providing support. This data is not used for advertising. LUXISOFT has agreed with the model provider that interactions are processed solely to provide the service and are not used to train its models or for advertising. Avoid sharing unnecessary sensitive data in the chat.

Special category data: the AI assistant and the support/KYC forms are not designed to process sensitive data (GDPR art. 9; Ley 1581 de 2012, arts. 5-6). We ask you not to enter health, biometric, ideological, religious, sexual orientation or other special category information. If you choose to do so, we process it solely on the basis of your explicit consent and only to the extent necessary to attend to your request, and we may delete it at your request.

LUXISOFT applies technical, administrative and organizational measures to protect the confidentiality, integrity and availability of the information. Main mechanisms:

• Encryption in transit: HTTPS/TLS 1.2 or higher on all communications.
• Encryption at rest: SSH credentials (keys and passphrases) are encrypted with AES-256-GCM before being persisted; Google/Firebase infrastructure encrypts at rest with AES-256.
• Strict mTLS and IP allowlist in the service-to-service communication between the panel and the license authority.
• Explicit TOFU of SSH host fingerprints and SSRF blocking when resolving destinations.
• Robust authentication: OAuth 2.0/OpenID Connect with cryptographic token validation, passkeys (WebAuthn/FIDO2), 2FA and recovery codes.
• Access control and least privilege for authorized personnel, with confidentiality.
• Minimization, immutable audit logging and secrets are never recorded in the logs.
• Fraud prevention and validation of payment webhooks (Wompi).

No system is 100% secure; if you believe your account or your data have been compromised, contact us immediately through the official channels.

We maintain a security incident management procedure. In the event of a personal data security breach we act as follows:

• When we act as Controller: we will notify the competent supervisory authority without undue delay and, where feasible, within a maximum of 72 hours from becoming aware of the breach, unless it is unlikely to result in a risk to the rights of data subjects (GDPR art. 33). If the breach may result in a high risk to your rights and freedoms, we will communicate it to you directly and without undue delay (GDPR art. 34).
• When we act as Processor (e.g. with respect to your credentials or SSH infrastructure): we will notify you as the customer-Controller without undue delay after becoming aware of the breach, providing the information necessary for you to comply with your own notification obligations (GDPR art. 33.2).

The notification will describe, to the extent available: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken or proposed. For users in Colombia, the reporting of incidents to the Superintendencia de Industria y Comercio in accordance with Ley 1581 de 2012 will also apply.

We use technical cookies (essential for operation and the session) and, where applicable, analytics cookies to improve the experience. You can manage non-essential cookies from your browser or from the controls available on the platform.

LUXIPANEL is intended exclusively for adults with legal capacity. In accordance with article 7 of Ley 1581 de 2012, article 12 of Decreto 1377 de 2013 and Sentencia C-748 de 2011, the processing of data of children and adolescents is restricted and only proceeds in view of their best interests and with the authorization of their legal representative. We do not knowingly collect data of minors; if we detect such data without valid authorization, we will proceed to its deletion in accordance with the regulations.

We may update this policy to reflect regulatory, operational or technical changes. We will publish the version in force with its update date and inform of material changes through the available channels.

For inquiries about personal data use the LUXIPANEL support channels. If you are not satisfied with the response, the supervisory authority in Colombia is the Superintendencia de Industria y Comercio (SIC) (www.sic.gov.co). EEA users may turn to their data protection authority, and those in California to the avenues provided by the CCPA/CPRA.

LUXIPANEL offers the “Sign in with Google” option as an authentication method to access the portal and manage licenses, subscriptions and payments, implemented via Google OAuth 2.0 through Firebase Authentication.

The associated Google Cloud / Firebase project is: luxisoft (project ID), project number 456853307907, operated by LUXISOFT. The scopes requested are strictly limited to the basic, non-sensitive identity scopes: openid, email and profile. We do NOT request restricted or sensitive scopes (Gmail, Drive, Calendar, Contacts, YouTube).

When you sign in with your Google Account, LUXIPANEL and Firebase Authentication access the following specific Google user data:

• Email address — unique identifier of your account.
• Email verification status.
• Basic profile information: full name and display name.
• Profile picture URL.
• Language and regional settings (locale), when Google provides them.
• Unique Google Account identifier (Google sub / user ID).
• OAuth/OpenID identity tokens — short-lived, processed in transit and not retained beyond what is necessary.

LUXIPANEL does NOT request, access or store restricted or sensitive Google scopes through end-user sign-in.

The data in section 19 is used exclusively to: create and authenticate your account; manage licenses, subscriptions, registered servers and payment history; visually identify you in the portal; personalize the language; strengthen security and prevent fraud; persist the account in Firebase and in the LUXIPANEL database; and send transactional and support communications.

LUXIPANEL complies with the Google API Services User Data Policy, including Limited Use: we do NOT sell the data, do NOT use it for advertising purposes, do NOT use it to train AI models, and do NOT transfer it to third parties for purposes unrelated to the operation of the service. It is only shared with the strictly necessary sub-processors (Google Firebase / Google Cloud).

We retain Google user data for as long as your account remains active or you have licenses/subscriptions in force, and for the additional time necessary to comply with legal, accounting or tax obligations. You can revoke access at https://myaccount.google.com/permissions. To request the deletion of your account and associated data, write through the support channels using the same registered email; we will delete the personal data from Firebase and from the database within a period of thirty (30) days, except for information we are required to retain by law.

Optionally and at the customer's initiative, LUXIPANEL offers an integration with Google Cloud that allows listing GCP projects and discovering Compute Engine instances (VPS). This integration does NOT use end-user sign-in, but rather a service account that the customer provides voluntarily. The scope is strictly read-only (https://www.googleapis.com/auth/cloud-platform.read-only) and is limited to the Cloud Resource Manager API and the Compute Engine API. LUXIPANEL does not modify the customer's resources with this credential; the keys are stored encrypted and the customer can revoke them at any time from the Google Cloud console.