Document contents

Faro, by Navigamo

Data Controller: Navigamo S.A.S.

Last updated: August 6, 2026

Preamble

This document is the Information Processing and Personal Data Protection Policy of Navigamo S.A.S. (hereinafter, “Navigamo”, “the Data Controller” or “we”), adopted in compliance with Article 15 of the Political Constitution of Colombia, Statutory Law 1581 of 2012, Decree 1074 of 2015 (which compiled Decree 1377 of 2013) and any other provisions that amend, regulate or develop them, as well as the instructions of the Superintendence of Industry and Commerce (SIC) in its role as Data Protection Authority.

This document is the internal and external policy required by Colombian regulations. It is an instrument distinct from the Privacy Policy and Personal Data Processing Policy and from the Terms and Conditions of the service, with which it must be read jointly and harmoniously.

For Data Subjects residing in the European Union or in the European Economic Area, this policy is supplemented by the provisions of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) set out in Section 13. For Data Subjects residing in the State of California (United States), it is supplemented by the provisions of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), set out in Section 14. In the event of a conflict between the Colombian regime and these regimes, the rule applicable to each Data Subject by reason of their residence and the origin of the Processing shall prevail.

Article 1. Identification of the Data Controller

The Data Controller responsible for the Processing of the personal data collected through the surfaces of the Faro product (the website holafaro.com and the platform app.holafaro.com) is:

Company name: Navigamo S.A.S.
NIT: 902.022.728-1
Registered address: Carrera 7a No. 106-75, oficina 502, Bogotá D.C., Colombia
Data Subject service channel (rights, inquiries, complaints and data-related petitions): faro@navigamo.co
Product: Faro, by Navigamo.

Any request related to the Processing of personal data, including the exercise of the rights described in this policy, must be directed to the email faro@navigamo.co, which constitutes the official channel and the area responsible for handling petitions, inquiries and complaints regarding personal data protection.

Article 2. Definitions

For the purposes of this policy, the definitions of Law 1581 of 2012 and Decree 1074 of 2015 are adopted, among them:

Authorization: the prior, express and informed consent of the Data Subject to carry out the Processing of their personal data.
Database: an organized set of personal data that is subject to Processing.
Personal data: any information linked to, or that may be associated with, one or more determined or determinable natural persons.
Sensitive data: data that affects the Data Subject’s privacy or whose improper use may lead to their discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical convictions, membership in trade unions or social organizations, health data, sex-life data, and biometric data.
Data Processor: the natural or legal person who carries out the Processing of personal data on behalf of the Data Controller.
Data Controller: the natural or legal person who decides on the database and the Processing of the data. For the purposes of this policy, Navigamo S.A.S.
Data Subject: the natural person whose personal data is subject to Processing.
Processing: any operation on personal data, such as collection, storage, use, circulation or deletion.
International transfer and transmission: the sending of personal data to a recipient located within or outside the territory of the Republic of Colombia, in the terms of Decree 1074 of 2015.
Privacy notice: a verbal or written communication addressed to the Data Subject containing the information relating to the Processing of their personal data.

Article 3. Scope of application

This policy applies to all personal data recorded in the databases of Navigamo S.A.S. processed within the framework of the Faro product, through its two surfaces:

holafaro.com: the marketing website and the free visibility diagnostic, through which a person may measure whether artificial intelligence systems read or cite them.
app.holafaro.com: the invitation-only platform, through which Navigamo builds, on the basis of the Data Subject’s professional identity, a website that is legible and citable by artificial intelligence systems.

It applies to Data Subjects residing in Colombia and, to the extent relevant, to Data Subjects residing in the European Union, the European Economic Area and the United States, as set out in Sections 13 and 14.

Article 4. Guiding principles

Navigamo processes personal data in accordance with the principles of legality, purpose, freedom, truthfulness or quality, transparency, restricted access and circulation, security, and confidentiality, enshrined in Article 4 of Law 1581 of 2012. In particular:

It collects personal data only for the purposes previously and expressly informed to the Data Subject.
It does not process data without the Data Subject’s authorization, except in the cases exempted by law.
It guarantees the Data Subject the full and effective exercise of their rights.
It adopts the technical, human and administrative measures necessary to provide security to the records and to prevent their alteration, loss, unauthorized or fraudulent consultation, use or access.
It maintains confidentiality over the data, even after the relationship with the Data Subject has ended.

Article 5. Categories of personal data subject to Processing

Navigamo processes the following categories of personal data, according to the surface through which the Data Subject interacts with the product.

5.1. On holafaro.com (free visibility diagnostic)

Data provided by the Data Subject when requesting the diagnostic:

Name of the person or brand to be measured (mandatory).
Professional category or topic, that is, what the Data Subject does (mandatory).
Country (mandatory) and city (optional).
Email address (mandatory, subject to verification by means of a six-digit code).
Declared brand or company (optional).
Own domain or website (optional).
Declared networks and profiles, such as LinkedIn, Instagram, X, YouTube or TikTok, provided as URL addresses (optional).
Up to five declared competitors, which may correspond to the names of third parties (optional).

Data collected automatically by the server during the diagnostic:

The visitor’s IP address, recorded for the purposes of security and prevention of service abuse.
Normalized email address, used as an identity key to avoid duplicate runs.
Six-digit email verification code, of limited validity.

Derived data generated and retained about the Data Subject:

The Faro Index (scale from 0 to 100) and its dimensions.
The responses of the various artificial intelligence models regarding the Data Subject’s name or brand.
The Data Subject’s search landscape in search engines (presence, entity card, ratings if the search engine displays them, and visible competitors).

5.2. On app.holafaro.com (invitation-only platform)

Access to the platform is by invitation, with authentication by means of a magic link or one-time code sent to the email (without a password). The following categories are processed:

Profile data: first name, last name, telephone, city, country, position, social networks, personal website, the Data Subject’s company data (company name, website and networks), competitors, keywords, declared objective and expectations.
Professional facts provided: position, education, milestones, dates, company and projects, each with its verification status and its visibility (private or public).
Assets: profile photo, logos and documents that the Data Subject decides to upload, stored privately and delivered solely by means of temporary links.
Material or documentary corpus: documents that the Data Subject uploads (for example, résumé, biographies or articles, in PDF, Word, plain text or similar format), from which the system extracts and retains their content as text.
Transcript of the identity-building interview: a text conversation (not voice) between the Data Subject and the system, retained as part of the corpus.
Metrics connected by the Data Subject: if the Data Subject connects their Google account (read-only), their data series from Google Search Console and Google Analytics 4 (clicks, impressions, position, users, sessions and equivalent metrics) are retrieved and retained. The Google refresh token is stored encrypted.
Payment data: email, contracted plan, amount, currency and transaction reference. The card data is tokenized in the Data Subject’s browser against the payment provider and is neither known nor stored by Navigamo.
Published website: the content (HTML and llms.txt file) that the Data Subject decides to make public at a product URL.

On the marketing website, analytics and measurement technologies are used (Google Analytics 4, Google Ads, Meta Pixel and Microsoft Clarity, the latter with session recording and heat maps) that collect cookie or device identifiers, IP address, navigation behavior and conversion events. On the platform, Microsoft Clarity is used to record only navigation (routes visited, clicks, scrolling and browser errors), for the purpose of diagnosing failures of use, without capturing the content of the screens. The Processing of this data is governed by the product’s cookie policy and, where the applicable rule so requires, by the visitor’s prior consent.

Article 6. Purposes of the Processing

Navigamo processes personal data for the following specific purposes:

To carry out the free visibility diagnostic, by querying artificial intelligence models and search engines to measure the Data Subject’s presence and citation and to produce the Faro Index and its report.
To verify the email address before carrying out the diagnostic, for the purposes of security, fraud or abuse prevention, and control of service costs.
To deliver and retain the diagnostic report at a stable address and to resend it by email to the Data Subject.
To avoid duplicate runs of the diagnostic by means of deduplication by identity.
To guarantee the security, integrity and availability of the service (abuse control by IP address, usage caps and containment mechanisms).
To conduct commercial and marketing management: administer the waiting list, handle offer requests, and send commercial or follow-up communications when there is a legal basis to do so. The periodic monitoring of the Index is activated solely upon the Data Subject’s double confirmation.
To carry out the onboarding and the building of the Data Subject’s identity on the platform, on the basis of the profile, the interview, the material provided and the declared facts.
To compose the website and extract the identity by means of artificial intelligence, by sending the Data Subject’s material and conversations to providers of artificial intelligence models for processing.
To measure the Data Subject’s results by retrieving, with their consent, their Google Search Console and Google Analytics 4 metrics.
To manage billing, the plan and the Data Subject’s access, including suspension and reactivation of the service.
To publish the Data Subject’s website at a public URL, with the content that the Data Subject themselves has decided to make public.
To carry out product and marketing analytics on the marketing website, and to record navigation on the platform without capturing the content of the screens, in accordance with the cookie policy and the applicable consent.
To comply with legal, accounting and accountability obligations, including the retention of the records required by law.
To attend to the rights of Data Subjects and to respond to inquiries and complaints.

Navigamo shall not process personal data for purposes other than those informed herein without first obtaining a new authorization from the Data Subject, unless the law authorizes or requires it.

Article 7. Sending of data to third-party artificial intelligence models

The Data Subject acknowledges and accepts that the nature of the Faro service entails the sending of their data to artificial intelligence models operated by third parties.

In the diagnostic, in order to measure how artificial intelligence reads or cites the Data Subject, the system builds queries that include their name or brand, their professional topic and their location, and sends them to the interfaces of several third-party artificial intelligence model providers located in the United States, as well as to a search engine ranking data provider (U.S.). The responses of those models regarding the Data Subject are retained as part of their report. The named list of sub-processors is available upon written request at faro@navigamo.co.

On the platform, the Data Subject’s material and conversations are sent to a third-party artificial intelligence model provider to extract their identity map and compose their website.

This sending is inherent and necessary to the service: it is not possible to measure whether artificial intelligence cites the Data Subject, nor to compose a website legible by artificial intelligence, without transmitting their data to those models. These providers are located outside Colombia, mainly in the United States, and therefore this Processing entails an international transfer of data in the terms of Section 12. The specific authorization for this Processing is collected in accordance with Article 11.

Article 8. Publication of the Data Subject’s website

The central purpose of the platform service is to build and publish a website of the Data Subject that is legible and citable by artificial intelligence systems. The Data Subject acknowledges and accepts that:

Publication entails making public the personal data that the Data Subject has marked as public (for example, their name, biography, position and professional facts).
Publication occurs solely through an explicit act of the Data Subject, who controls which data is made public and confirms its publication.
Once published, the content may be read, indexed and cited by search engines, by third parties and by artificial intelligence systems, which is precisely the intended purpose of the service.
The subsequent withdrawal of the website stops its publication by Navigamo, but does not guarantee the deletion of copies, caches or citations that third parties or artificial intelligence systems may already have taken from the content while it was public.

The specific authorization for publication is collected in accordance with Article 11.

Article 9. Sensitive data and third-party data

9.1. Sensitive data

By design, Faro does not request or require sensitive data within the meaning of Article 5 of Law 1581 of 2012 (health data, racial or ethnic origin, sexual orientation, political opinions, religious or philosophical convictions, biometric data, trade union affiliation, among others).

Nevertheless, since the material that the Data Subject uploads and their responses in the interview are free text, the Data Subject could include sensitive data on their own initiative. Navigamo warns the Data Subject that they should not provide sensitive data unless they consciously decide to make it part of their public professional presence. In accordance with Article 6 of Law 1581 of 2012, the Processing of sensitive data is prohibited, except where the Data Subject has granted their explicit authorization, among other legal exceptions. The Data Subject is not obligated to authorize the Processing of sensitive data.

The profile photo constitutes an image of the Data Subject; Navigamo does not carry out biometric Processing or facial recognition on it.

9.2. Third-party data provided by the Data Subject

When the Data Subject provides third-party data (for example, competitors’ names, their company’s data, or when they request the diagnostic on another person’s name), they declare and warrant that they have the power, consent or legal basis to provide that data and to authorize its Processing for the purposes of this policy. The Data Subject shall hold Navigamo harmless against third-party claims arising from the breach of this obligation.

Article 10. Rights of the Data Subject

In accordance with Article 8 of Law 1581 of 2012, the Data Subject of the personal data has the following rights:

To know, update and rectify their personal data before the Data Controller. This right may be exercised, among others, with respect to data that is partial, inaccurate, incomplete, fragmented, misleading, or whose Processing is expressly prohibited or has not been authorized.
To request proof of the authorization granted to the Data Controller, except where the law provides that the authorization is not necessary.
To be informed by the Data Controller, upon request, regarding the use that has been made of their personal data.
To file complaints before the Superintendence of Industry and Commerce for infringements of Law 1581 of 2012 and other rules that amend, add to or supplement it, once the inquiry or complaint procedure before the Data Controller has been exhausted.
To revoke the authorization and request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the Processing. Revocation or deletion shall proceed when the Superintendence of Industry and Commerce has determined that, in the Processing, the Data Controller has engaged in conduct contrary to the law and the Constitution, or when there is no legal or contractual duty imposing on the Data Subject the obligation to remain in the database.
To access free of charge their personal data that has been subject to Processing.

Additionally, the platform makes available to the Data Subject:

Portability: the Data Subject may export the data that belongs to them and is portable, in a structured, machine-readable format.
Deletion: the Data Subject may request and execute the erasure of their data, in the terms of Article 15.

These rights are exercised through the email faro@navigamo.co, or by means of the functions enabled in the platform for that purpose.

Article 11. Authorization of the Data Subject

11.1. Nature and form of the authorization

Except in the cases exempted by law, the Processing of personal data requires the prior, express and informed authorization of the Data Subject. Navigamo obtains the authorization by any of the means that allow for its subsequent consultation, among them:

In writing.
Verbally.
By means of unequivocal conduct of the Data Subject that allows one to reasonably conclude that they granted their authorization, such as actively checking a box accepting this policy before submitting a form, or deliberately continuing with a process after having been informed.

In no case shall the silence of the Data Subject be equated with unequivocal conduct. The authorization is requested before collecting the data, having previously made the privacy notice and this policy available to the Data Subject.

11.2. Content of the authorization

By granting their authorization, the Data Subject declares that:

They have been informed of the identity of the Data Controller and of its service channel.
They know the purposes of the Processing described in Article 6.
They know the optional nature of answering questions about sensitive data or about minors.
They know their rights as a Data Subject and the mechanisms to exercise them.
They authorize the Processing of their personal data in the terms of this policy.

11.3. Specific authorizations

In addition to the general authorization, Navigamo collects specific, separate and informed authorizations for the following Processing operations, which the Data Subject may grant or not grant independently:

Authorization for the sending of data to third-party artificial intelligence models (Article 7). The Data Subject authorizes that their name or brand, their topic and their location, and on the platform their material and conversations, be sent to providers of artificial intelligence models located outside Colombia in order to provide the service. This authorization is a necessary condition for the provision of the diagnostic and the composition of the website.
Authorization for the publication of the website (Article 8). The Data Subject authorizes that the data they themselves mark as public be published at a public URL for the purpose of being read, indexed and cited by search engines, third parties and artificial intelligence systems, and declares that they understand the limits of the reversibility of such publication.
Authorization for the Processing of sensitive data, where the Data Subject decides to provide it voluntarily (Article 9). This authorization is explicit and optional; the Data Subject is not obligated to grant it.
Authorization for commercial and marketing communications, including the periodic monitoring of the Index, subject to double confirmation.
Authorization for the connection of their Google metrics, which is granted by means of the Google consent flow (OAuth) when connecting their account.

11.4. Proof of the authorization

Navigamo retains proof of the authorization granted by the Data Subject by means of technical mechanisms that allow for its subsequent consultation, and shall make such proof available to the Data Subject when the latter so requests.

Article 12. International transfer and transmission of data

For the provision of the service, Navigamo uses technology providers (Data Processors and sub-processors) located outside Colombia, mainly in the United States. This entails international transfers and transmissions of data.

The main Data Processors and sub-processors, with their role, are:

Vercel (United States): hosting and execution of the two surfaces of the product.
Supabase (United States): database, authentication and file storage.
Resend (United States): sending of transactional email.
Search engine ranking data provider (United States): querying of the Data Subject’s search landscape.
Third-party artificial intelligence model providers (United States): artificial intelligence models that process the diagnostic queries and, on the platform, the composition and identity extraction. The named list of sub-processors is available upon written request at faro@navigamo.co.
Google (United States): connection of the Data Subject’s metrics (Search Console and Analytics), subject to prior authorization by means of OAuth.
Google Analytics 4, Google Ads, Meta and Microsoft Clarity (United States): analytics and measurement of the marketing website. Microsoft Clarity, in addition, records navigation on the platform, without the content of the screens.
Wompi (Colombia): payment processing.

Navigamo adopts reasonable contractual and security measures so that these providers process the data in accordance with the authorized purposes and with adequate protection standards. The Data Subject, by accepting this policy and granting the specific authorizations of Article 11, authorizes these international transfers and transmissions where they are necessary to provide the service, without prejudice to the additional guarantees that the applicable regulations may require.

Where the Data Subject is a resident of the European Union or the European Economic Area, or where the Processing is subject to Regulation (EU) 2016/679, the following provisions additionally apply:

Legal bases (Article 6 GDPR): the Processing is based, as the case may be, on the consent of the Data Subject, on the performance of a contract to which the Data Subject is a party, on the compliance with legal obligations of Navigamo, or on the legitimate interest of Navigamo where the rights of the Data Subject do not prevail.
Additional rights: in addition to the rights of Article 10, the Data Subject has the right of access, rectification, erasure (“right to be forgotten”), restriction of Processing, data portability, objection to Processing (including Processing for the purposes of direct marketing), and not to be subject to decisions based solely on automated Processing that produce legal effects.
Withdrawal of consent: where the Processing is based on consent, the Data Subject may withdraw it at any time, without affecting the lawfulness of the prior Processing.
International transfers: transfers outside the European Economic Area are covered by the mechanisms provided in Chapter V of the GDPR (for example, standard contractual clauses or another valid mechanism).
Complaint before a supervisory authority: the Data Subject may lodge a complaint before the data protection authority of their country of residence.

The channel for the exercise of these rights is faro@navigamo.co.

Article 14. Provisions for Data Subjects in California, United States (CCPA/CPRA)

Where the Data Subject is a consumer residing in the State of California, the following provisions of the California Consumer Privacy Act, as amended by the California Privacy Rights Act, additionally apply:

Right to know: the consumer may request information about the categories and specific elements of personal data collected, the sources, the purposes and the categories of third parties with whom it is shared.
Right to delete: the consumer may request the deletion of their personal data, subject to the applicable legal exceptions.
Right to correct inaccurate personal data.
Right to limit the use of sensitive personal information.
Right not to be discriminated against for exercising their rights.
Sale or sharing of data: Navigamo does not sell the Data Subject’s personal data in exchange for monetary consideration. To the extent that the use of analytics and advertising technologies may be considered a “sale” or a “share” under the CCPA/CPRA, the consumer has the right to opt out (“Do Not Sell or Share My Personal Information”) through the channel faro@navigamo.co and the mechanisms available in the product.

The channel for the exercise of these rights is faro@navigamo.co.

Article 15. Procedure for inquiries and complaints

The Data Subject, their successors, their representative or attorney-in-fact, or those who have been stipulated in their favor, may exercise their rights by means of the following procedures. The channel for all of them is the email faro@navigamo.co.

15.1. Inquiries

The Data Subject may inquire about the personal information held in the databases of Navigamo. The inquiry shall be addressed within a maximum term of ten (10) business days counted from the date of its receipt. Where it is not possible to address it within said term, the interested party shall be informed, stating the reasons for the delay and indicating the date on which it will be addressed, which in no case may exceed five (5) business days following the expiration of the first term.

15.2. Complaints

The Data Subject who considers that the information contained in a database must be subject to correction, updating or deletion, or who observes an alleged breach of the duties contained in the law, may file a complaint, which shall be processed under the following rules:

The complaint is formulated by means of a request addressed to Navigamo, with the identification of the Data Subject, the description of the facts giving rise to the complaint, the contact address and the documents to be relied upon.
If the complaint proves to be incomplete, the interested party shall be required within the five (5) business days following its receipt to remedy the deficiencies. Once two (2) months have elapsed from the date of the requirement without the applicant submitting the required information, it shall be understood that they have withdrawn the complaint.
If Navigamo is not competent to resolve it, it shall forward the matter to whomever it corresponds within a maximum term of two (2) business days and shall inform the interested party of the situation.
Once the complete complaint has been received, a legend reading “complaint in process” and the reason therefor shall be included in the database, within a term no greater than two (2) business days. Said legend shall be maintained until the complaint is decided.
The maximum term to address the complaint shall be fifteen (15) business days counted from the day following the date of its receipt. Where it is not possible to address it within said term, the interested party shall be informed of the reasons for the delay and the date on which it will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term.

15.3. Prerequisite for admissibility

The Data Subject may file a complaint before the Superintendence of Industry and Commerce only once they have exhausted the inquiry or complaint procedure directly before Navigamo.

Article 16. Processing of minors’ data

The Faro service is not directed to minors and Navigamo does not deliberately collect the personal data of minors.

In accordance with Article 7 of Law 1581 of 2012 and constitutional case law, the Processing of the personal data of children and adolescents is proscribed, except where it concerns data of a public nature and where such Processing complies with the parameters of respect for the best interests of the minor and their fundamental rights. In the permitted cases, the Processing shall require the prior authorization of the minor’s legal representative, obtained after having informed them about the purposes of the Processing, and the opinion of the minor shall be heard, taking into account their maturity, autonomy and capacity to understand the matter.

By accepting this policy, the Data Subject declares that they are of legal age in accordance with the law of their jurisdiction. If Navigamo becomes aware that it has collected the data of a minor without the authorization of their legal representative, it shall proceed to delete it. Any legal representative who becomes aware that a minor has provided data may request its deletion through the email faro@navigamo.co.

Article 17. Information security

Navigamo adopts reasonable technical, human and administrative measures to protect personal data against its alteration, loss, unauthorized or fraudulent consultation, use or access. Among the measures implemented are: access control by user (row-level isolation in the database), the private storage of files with delivery by means of temporary links, the encryption of access tokens to third-party services, the minimization of data in the public views of the report, and the verification of the email before carrying out the diagnostic.

No security measure is infallible. Navigamo does not guarantee the absolute security of the information, but undertakes to act with due diligence and to attend to any incident in accordance with the law.

Article 18. Retention of information

Navigamo retains personal data for as long as necessary to fulfill the purposes of the Processing and the applicable legal, accounting and contractual obligations. Once said purposes have been fulfilled and the legal retention periods have expired, the data shall be deleted or anonymized.

The Data Subject may request the deletion of their data in accordance with Article 15 and, on the platform, execute the erasure of their data by means of the functions enabled. Navigamo warns that, due to accountability and accounting obligations, certain minimum records may be retained after the erasure solely for the time and to the extent required by applicable law.

Article 19. Term of the policy, of the databases and of the authorization

Term of the policy: this policy is in force as of the date of its publication indicated in the header and shall remain in force for as long as Navigamo develops the Faro product. Any substantial modification shall be communicated to the Data Subject through the available channels before it enters into force.
Term of the databases: the databases administered by Navigamo shall remain in force for as long as is reasonable and necessary to fulfill the purposes of the Processing and the legal obligations, and until the Data Subject requests the deletion of their data and there is no legal or contractual duty to retain it.
Term of the authorization: the authorization granted by the Data Subject shall remain in force for as long as a relationship with the product exists and it is not revoked by the Data Subject. The Data Subject may revoke the authorization and request the deletion of their data at any time, in the terms of Articles 10 and 15 and with the legal reservations provided therein.

Article 20. Modifications

Navigamo reserves the right to modify this policy at any time. Modifications shall be published on the surfaces of the product with the updating of the date in the header. Where the modification substantially affects the Processing or requires a new authorization, Navigamo shall request it from the Data Subject before applying it.

Article 21. Applicable law and supervisory authority

This policy is governed by the laws of the Republic of Colombia, in particular by Law 1581 of 2012, Decree 1074 of 2015 and the rules that amend or develop them. The competent supervisory authority in Colombia is the Superintendence of Industry and Commerce. For Data Subjects subject to the GDPR or the CCPA/CPRA, Sections 13 and 14 and the authorities referred to therein additionally apply.