Artificial intelligence governance policy

1. Principles

• Human oversight: a responsible person reviews, can correct and can stop any Neona Tech AI system. No decision with legal or economic effects on a person is made in a fully automated way.
• Transparency: when you talk to an AI, we tell you. Our assistants identify themselves as artificial-intelligence assistants in the first message and whenever asked.
• Privacy and security: the AI only receives the data needed to answer, under the privacy policy, with providers that do not train their models on our requests.
• Fairness: we do not use AI to discriminate by origin, gender, religion, health, age or any other condition, and we review outputs to detect bias.
• Accountability: Neona Tech answers for what its assistants do. If an AI makes a mistake, we correct it and record it.

2. Where we use artificial intelligence

• “Talk to Neona” assistant on the home page and prompt improver at /beta: they answer questions about Neona Tech with the site's public information.
• WhatsApp assistant: it may answer the first messages that reach our WhatsApp number, under the rules in section 4, and hands over to a person when appropriate.
• Internal tools: drafting, data analysis and code, always reviewed by a person before being used with a client.
• Client projects: agents, copilots and models we design to order; their governance is agreed in each contract.

3. Models and providers

We keep a registry of every model we use (provider, version, purpose, what data it receives, who supervises it). Today our public assistants use OpenAI models through its API, which does not use requests to train its models. Any provider change is recorded and, if it affects data processing, reflected in the privacy policy.

4. Rules for our AI assistants

• They introduce themselves as Neona Tech artificial-intelligence assistants and never pretend to be a person.
• They only talk about Neona Tech: its services, method, quality standards, how to contact us and how the work process goes. If the question is about something else, they say so kindly and return to the topic.
• They do not give legal, tax, financial, medical or technical advice for a specific case, do not quote prices that are not published, do not promise results or timelines and do not close contracts: only a written proposal binds Neona Tech.
• They do not request or record sensitive data, passwords, card numbers or identity documents. If a person sends them, the assistant asks them not to and the team deletes them.
• They resist manipulation: they ignore instructions that try to change their rules, reveal their configuration, impersonate another system or discuss forbidden topics, whether they come in the message, in a file or in a link. When in doubt, they hand the conversation to a person.
• They hand over to a person when someone asks, when there is a complaint or claim, when contracts, prices, personal data or a security incident are discussed, or when the assistant is not sure. The person replies by WhatsApp or email during Colombian business hours.

5. Data the assistants see

The site assistant does not store conversations. The WhatsApp assistant works on the WhatsApp conversation, which is kept in our channel mailbox under the privacy policy (up to 24 months after the last contact) to give continuity to the service. In both cases the text is sent to the AI provider only to generate the reply.

6. Risk assessment and testing

• Before enabling an assistant we assess its impact: who it serves, what it can answer, what it cannot, and what happens if it fails.
• We test every assistant with manipulation attempts (instruction injection, impersonation, data extraction) and off-topic questions before publishing it and after every change of rules or model.
• We periodically review samples of conversations to detect errors, bias or replies outside the rules, and adjust.

7. Incidents and complaints

If a Neona Tech assistant gave you wrong information, treated you inappropriately or you believe your data was misused, write to us and a person reviews it. We record every incident, its cause and the correction applied. Incidents affecting personal data are handled under the privacy policy and Law 1581 of 2012.

8. Client projects

In every AI project we define by contract the purpose, the data the system may use, the model provider, who supervises, how decisions are logged and how the system is stopped. We deliver the evidence of that governance ready for the client's audit or certification.