Privacy and personal data processing policy

Last updated: October 30, 2026

This policy explains which personal data Neona Tech receives through neona.tech, what it uses it for, who it shares it with and how you can exercise your rights. It is written to be read straight through, with no fine print. The Spanish version at neona.tech/privacidad is the legally binding one; this is a courtesy translation.

1. Data controller

• Legal name: NEONATECH E-BUSINESS S.A.S. (“Neona Tech”).
• Tax ID (NIT): 902.118.619-9. Commercial registration 949.736, Barranquilla Chamber of Commerce.
• Address: Cra. 52 No. 79-19, Piso 3, Oficina 19, Barranquilla, Atlántico, Colombia.
• Phone: +57 605 322 5918.
• Email for personal-data matters: gerencia@neona.tech (also hola@neona.tech).
• Legal representative: Marco Antonio Vitola Polo.

2. Legal framework

We process personal data under Article 15 of the Colombian Constitution, Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015), Law 1266 of 2008 where applicable, and the instructions of the Superintendence of Industry and Commerce (SIC). Law 527 of 1999 applies to electronic messages.

3. What data we collect and why

• “Tell us your idea” form: name, company, email, WhatsApp number (optional), type of service and the text of the idea. Purpose: reply to the enquiry, prepare a first reading of the case and, if the person agrees, schedule a diagnosis and send a proposal.
• Email and phone: whatever the person writes or says when contacting us. Purpose: handle the request and continue the business relationship.
• “Talk to Neona” assistant and prompt improver (/beta): the text the person types in the chat or the tool. Purpose: generate the answer with artificial intelligence. We do not store conversations or link them to a person; they are only sent to the AI provider to produce the answer.
• Technical browsing data: the hosting platform (Vercel) automatically records the IP address, browser and date of each request in security logs. Purpose: security, abuse prevention and site operation.
• Client and supplier data: contact and billing data and whatever is needed to perform a contract. Purpose: perform the contract, invoice, meet accounting and tax obligations and manage service quality (including evidence for our management system aligned with ISO 9001, ISO/IEC 27001 and ISO/IEC 42001).

We do not request or process sensitive data (health, ethnic origin, beliefs, sexual orientation, biometrics) or data of minors. If a person includes them in a message, we delete them as soon as we detect them.

4. How we obtain your authorization

By sending the form, writing to us or hiring our services, the person gives prior, express and informed authorization for the processing described here, as allowed by Article 7 of Decree 1377 of 2013. In the form, the authorization is stated next to the send button. You can revoke it at any time by writing to gerencia@neona.tech, unless a legal or contractual duty requires us to keep the information.

5. Who we share data with (processors)

We do not sell or transfer personal data to third parties for commercial purposes. We use these providers, which act as data processors under their own contracts and security measures:

• Vercel Inc. (United States): hosting of the site and its server functions.
• Resend (United States): email delivery of form messages to our mailbox.
• Hostinger: corporate mailboxes where messages are received and kept.
• OpenAI (United States): processing of the text of the “Talk to Neona” assistant and the prompt improver. OpenAI does not use API requests to train its models.

We may also share data when a competent authority or the law requires it, and with advisers (accounting, legal) bound by confidentiality.

6. International transfers

Some of those providers operate in the United States, a country the Superintendence of Industry and Commerce recognizes as having an adequate level of data protection (External Circular 005 of 2017). Each provider is also contractually bound to process data only on our instructions and with appropriate security measures.

7. Artificial intelligence

• The “Talk to Neona” assistant on the home page and the prompt improver at /beta use OpenAI models with the public information on this site. Answers are AI-generated, are labeled as such and may contain errors; review them before using them. The assistant is not a person and does not replace a formal proposal.
• Do not enter third parties' personal data, confidential information, passwords or sensitive data into those tools.
• In client projects, the use of AI is agreed in each contract, with human oversight and a registry of the models used, under our management system aligned with ISO/IEC 42001.
• No decision with legal effects on a person is made in a fully automated way.

8. Cookies and browser storage

• The site does not use tracking cookies or third-party analytics or advertising tools (Google Analytics, Meta pixel, etc.).
• We store three preference items in your browser's local storage: nt_visitas (how many times you have opened the home page, for the context-panel greeting), nt_tema (light or dark theme) and nt_audiencia (whether you chose Business, Tech team or Partner). None of them leaves your browser and you can delete them by clearing the site's data.
• The context panel on the home page shows your language, device type, local time and referring page by reading them from your own browser; we do not send them to any server.
• If we add analytics or advertising cookies in the future, we will update this policy and ask for your consent before enabling them.

9. How long we keep data

• Form messages and enquiry emails: up to 24 months after the last contact, unless it becomes a business relationship.
• Client and supplier data: for the duration of the contract and afterwards for as long as Colombian accounting, tax and commercial rules require.
• Assistant conversations and prompt-improver text: we do not store them.
• Technical security logs: according to Vercel's retention periods.

10. Security

We apply encryption in transit (HTTPS), access control with two-factor authentication on our accounts, provider keys kept only on the server, backups and periodic access reviews, within our information-security management system aligned with ISO/IEC 27001, whose certification is in progress. If an incident affecting your data occurred, we would notify the SIC and the affected people as the law requires.

11. Your rights

As the data subject you have the right to:

• Know, update and correct your data.
• Request proof of the authorization given.
• Be informed about how your data has been used.
• Revoke the authorization and request deletion of the data when no legal or contractual duty requires keeping it.
• Access your personal data free of charge.
• File complaints with the Superintendence of Industry and Commerce (www.sic.gov.co) if you believe we have not handled your request.

How to exercise them: write to gerencia@neona.tech with your name, the email you contacted us from and what you need. Enquiries are answered within ten (10) business days and claims within fifteen (15) business days, counted from the day after receipt; if we need more time, we tell you the expected reply date, within the terms allowed by Law 1581 of 2012.

12. Minors

Our services are aimed at companies and people over 18. We do not knowingly collect data from minors. If a parent or guardian finds that a minor sent us data, they can request its deletion at the email above.

13. Changes to this policy

We will publish any change on this same page with its new update date. If the change is substantial and we have your email, we will let you know before it takes effect.

14. Effective date

This policy applies from October 30, 2026. Databases are kept for as long as the purposes described remain.

NEONATECH E-BUSINESS S.A.S. · Tax ID (NIT) 902.118.619-9 · Cra. 52 No. 79-19, Piso 3, Oficina 19, Barranquilla, Atlántico, Colombia · +57 605 322 5918 · gerencia@neona.tech