Privacy Policy

Data Controller: Navigamo S.A.S. Product: Faro (holafaro.com and app.holafaro.com) Last updated: August 6, 2026

This Privacy and Personal Data Processing Policy (hereinafter, the “Policy”) explains how Navigamo S.A.S. collects, uses, shares, transfers, retains, and protects the personal data of the persons who use Faro, and sets out their rights and how to exercise them. It is written in plain language so that any person may understand it, without any surrender of legal rigor.

Faro has two surfaces:

• holafaro.com: the Faro website and the visibility diagnostic, which measures whether artificial intelligence systems read and cite you. The diagnostic is available at no cost, included within the scope of the website.
• app.holafaro.com: the Faro platform, accessible by invitation, where Faro converts your professional identity into a website that is legible and citable by artificial intelligence systems.

By using either surface, you represent that you have read and understood this Policy. We ask you to read it carefully before providing your data.

1. Identification of the Data Controller

The Data Controller of your personal data is:

• Corporate name: Navigamo S.A.S.
• NIT: 902.022.728-1
• Domicile: Carrera 7a No. 106-75, oficina 502, Bogotá D.C., Colombia
• Contact channel for privacy, rights, and petitions, complaints, and claims (PQR): faro@navigamo.co

Hereinafter, “Navigamo”, “Faro”, “we”, or “the Data Controller” refer to Navigamo S.A.S.

1.1 Scope and applicable legislation

Faro is operated from Colombia and is governed, as its basis, by Law 1581 of 2012, Decree 1377 of 2013, and the other rules of the Colombian personal data protection regime (Habeas Data), under the supervision of the Superintendence of Industry and Commerce (SIC).

Additionally, when you access Faro from the European Economic Union or the United Kingdom, we apply the safeguards of the General Data Protection Regulation (Regulation (EU) 2016/679, “RGPD” or “GDPR”). When you are a resident of the United States of America, and in particular of the State of California, we recognize the rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, “CCPA/CPRA”). The specific sections for each regime are expressly identified further below (Sections 8, 9, and 10).

2. Definitions

For the purposes of this Policy:

• Data Subject: the natural person whose personal data is the object of Processing. Under the GDPR this corresponds to the “data subject”; under the CCPA/CPRA, to the “consumer”.
• Personal data: any information linked to, or that may be associated with, one or more determined or determinable natural persons.
• Sensitive data: data that affects the Data Subject’s privacy or whose improper use may generate discrimination (for example, health, racial or ethnic origin, sexual orientation, political opinions, religious or philosophical convictions, biometric data, trade union membership). Under the GDPR this corresponds to the “special categories of data”.
• Processing: any operation on personal data, such as collection, storage, use, circulation, transmission, transfer, or deletion.
• Data Processor: the party that processes personal data on behalf of the Data Controller (for example, our technology providers). Under the GDPR, “processor”.
• Authorization: the prior, express, and informed consent of the Data Subject to process their data.
• International transfer and transmission: the sending of personal data to a recipient located outside the Data Subject’s country of origin.

3. What data we collect and from which sources

We collect only the data necessary for the purposes described in Section 4. The data comes from three sources: that which you provide to us directly, that which is generated automatically when you use Faro, and that which is derived from processing the information you contribute.

3.1 On holafaro.com (visibility diagnostic)

Data you provide in the diagnostic form:

• Name of the person or brand to be measured (mandatory).
• Professional category or subject, that is, what you do (mandatory).
• Country (mandatory) and city (optional).
• Email address (mandatory, with verification by a six-digit code).
• Declared brand or company (optional).
• Own domain or website (optional).
• Profiles or accounts declared as web addresses (LinkedIn, Instagram, X, YouTube, TikTok, or others), which we use as verification anchors (optional).
• Up to five competitors declared by you, which may be the names of third parties (optional).

Data collected automatically when the diagnostic runs:

• Your IP address, which we record to prevent abuse of the service and to apply usage limits.
• A normalized version of your email (in lowercase and without aliases), which we use as a key so as not to repeat a diagnostic that was recently run with the same email.
• A temporary six-digit verification code, to confirm that the email is real before executing the diagnostic.

Data derived from processing your information:

• Your Faro Index (a score from 0 to 100) and its dimensions (presence, recognition, fidelity, consistency, and citation).
• The responses of the various artificial intelligence systems about your name or brand (whether they mention it, in what position, with what sentiment, and with what accuracy).
• The search map obtained from the search engines (whether you appear when your name is searched, whether you have an entity card or knowledge panel, ratings shown by the search engine, and visible competitors).

3.2 On app.holafaro.com (invitation-only platform)

Access to the platform is by invitation, and authentication is performed by an access link or a one-time code sent to your email, without a password. Your email address is the base identifier of the account.

Profile that you complete: first name, last name, telephone, city, country, position, accounts and profiles, personal website, your company data where applicable (company name, website, and accounts), competitors, keywords, your declared objective, and your expectations.

Facts that you contribute or verify: position, education, milestones, dates, company, and projects, each with its verification status and its visibility (private or public).

Assets that you upload: profile photo, logos, and other documents or files. They are stored in private storage and are delivered only through short-lived temporary links.

Material or corpus that you contribute: documents that you upload (PDF, Word, text), such as your resume, biographies, or articles. The system extracts the text from those documents and retains it as input to build your identity.

Identity interview: a text conversation (not voice) between you and the system. The transcript is retained and feeds the construction of your professional identity.

Metrics that you choose to connect: if you connect your Google account, with express Authorization and in read-only mode, the platform retrieves and stores the series of your Google Search Console metrics (clicks, impressions, position) and Google Analytics 4 metrics (users, sessions, views), together with the email of the connected Google account. The access credential to that account is stored encrypted.

Payment data: upon contracting a plan, we store your email, the plan, the amount, the currency, the reference, and the payment status. Your card number never reaches Faro’s servers: it is encrypted and tokenized directly in your browser against the payment provider. For recurring charges, only a payment-source identifier delivered by the provider is retained, not the card number.

Your published site: when you authorize it, the platform publishes your website with the data you decided to make public. See Section 6.

3.3 Navigation analytics (holafaro.com and app.holafaro.com)

On the holafaro.com website we use analytics and measurement tools that set cookies or device identifiers and record your interaction with the site: Google Analytics 4, Google Ads, Meta Pixel, and Microsoft Clarity. Microsoft Clarity, in particular, may record the browsing session (movements, clicks, and scrolling) and generate heatmaps. These tools collect cookie or device identifiers, IP address, browsing behavior, and conversion events. On the platform app.holafaro.com we use Microsoft Clarity to record only navigation (routes visited, clicks, scrolling, and browser errors), for the purpose of diagnosing failures of use; there the content of the screens is not captured: neither what you type, nor the text you read, nor your documents nor your images. The detail and the handling of consent for these technologies are explained in our Cookies Policy (see Section 12).

4. Purposes of the Processing and legal basis

We process your data for the following purposes. For each one we indicate the basis that legitimizes the Processing under Colombian law and, where applicable, its correspondence with the GDPR.

We do not use your data for automated decisions with legal effects or that significantly affect you in an equivalent manner. The Faro Index and the report are an informational measurement, not a decision that restricts your rights.

5. With whom we share your data: processors and international transfers

To provide the service, Faro relies on technology providers that act as Data Processors, that is, that process your data on behalf of Navigamo and following our instructions. Most of these providers are located in the United States of America, so their use entails an international transfer of data from Colombia (and from the European Union or the United Kingdom, when you access from there).

5.1 List of processors and recipients

The artificial intelligence model providers that actually receive your data depend on the operational configuration in force. The named list of sub-processors is available upon written request at faro@navigamo.co.

5.2 Basis and safeguards of the international transfer

The international transfers of your data are carried out under the following bases, according to your jurisdiction:

• Colombia (Law 1581 of 2012, Decree 1377 of 2013): the transfers are supported by the Data Subject’s Authorization, informed in this Policy, and by the contractual requirement on each processor to provide levels of personal data protection equivalent to those imposed by Colombian law. The transfers necessary for the performance of the contract between the Data Subject and Navigamo, and those required in the interest of the Data Subject, conform to the exceptions provided by law.
• European Union and United Kingdom (GDPR): when we transfer data outside the European Economic Area or the United Kingdom, we do so on the basis of the Standard Contractual Clauses approved by the European Commission (and their United Kingdom equivalents) executed with each processor, or on recognized adequacy mechanisms, together with additional technical and organizational measures where appropriate.
• United States: the data is processed in accordance with the contracts executed with each provider, which require security measures and use limitations.

We do not sell your personal data. We share data solely with the listed processors, for the purposes of this Policy, and with the competent authorities when there is a legal duty to do so.

6. Publication of your site and its public nature

One of the platform’s core services is to publish a website of yours, at a public address, with the explicit purpose of its being read, indexed, and cited by search engines and by artificial intelligence systems. That site is accompanied by an llms.txt file designed for artificial intelligence systems to read it.

You must understand and consent to the following before publishing:

• Publishing makes public the data you marked as public (for example, name, biography, position, and facts). You control what is published: each fact has a private or public visibility that you define explicitly, with confirmation.
• Once public, the content may be indexed by search engines and read, copied, and cited by third parties and by artificial intelligence systems. That is the intended purpose of the service.
• Withdrawing or unpublishing your site stops its dissemination from Faro, but does not guarantee the deletion of the copies, caches, or citations that third parties or artificial intelligence systems may already have taken of the content while it was public.

If you do not wish for a piece of data to be public, do not mark it as public and do not include it in the published site.

7. Processing with artificial intelligence

Faro cannot measure “whether artificial intelligence reads or cites you” without consulting artificial intelligence itself. For that reason, in order to provide the service:

• In the diagnostic (holafaro.com): we build prompts that include your name or brand, your subject, and your location, and we send them to third-party artificial intelligence model providers located in the United States, and we consult the search map through a search engine ranking data provider. The responses of those systems about you are retained as part of your report.
• On the platform (app.holafaro.com): your material, your interview, and your facts are sent to a third-party artificial intelligence model provider to extract your identity map and compose your site.

This Processing entails an international transfer to the providers indicated in Section 5, principally in the United States, and is inherent and necessary for the service. The detail on the use of artificial intelligence is expanded in our Artificial Intelligence Use Notice (see the reference in Section 15).

8. Sensitive data, third-party data, and minors

8.1 Sensitive data

Faro does not request or require sensitive data (such as health, racial or ethnic origin, sexual orientation, political opinions, religious or philosophical convictions, biometric data, or trade union membership). We do not perform biometric recognition; the profile photo is treated as an image, not as biometric data.

However, the material you upload and what you write in the interview are free text, so you could include sensitive data by your own decision. We ask you not to contribute sensitive data unless you decide to make it part of your public professional presence consciously. If you include sensitive data, we understand that you expressly authorize its Processing for the purposes of this Policy, and you may withdraw it at any time. You are responsible for the truthfulness and relevance of what you contribute.

8.2 Third-party data

When you contribute the names of third parties (for example, competitors) or run the diagnostic on the name of another person, you represent that you have a legitimate basis to do so and that, when the law so requires, you have the Authorization of that person. You must inform those third parties about the Processing and about this Policy. Navigamo processes such data on your behalf and as part of the requested service.

8.3 Minors

Faro is directed at persons of legal age and is neither designed nor intended for minors. We do not knowingly collect data from minors. If we detect that we have processed the data of a minor without the corresponding Authorization, we will proceed to delete it. If you believe that a minor provided us with data, write to us at faro@navigamo.co.

9. Data retention period

We retain your personal data for the time necessary to fulfill the purposes of this Policy and, thereafter, for the periods required by the legal, accounting, and rights-defense obligations applicable to Navigamo. The general criteria are:

• The data of your account and your identity on the platform are retained while your account is active and while the service relationship exists.
• The diagnostic data and its report are retained to allow you to consult them again and for purposes of service improvement and control.
• The contact data of interested persons who do not contract are retained while a legitimate commercial purpose exists or until you withdraw your Authorization.
• The technical security records (such as the IP log) and verification codes are retained for the time necessary for their security purpose, after which they are deleted or anonymized.
• The accounting and billing records are retained for the periods set by law.

When the data ceases to be necessary, we securely delete or anonymize it. For accounting accountability, upon deleting an account we may retain a minimal record of the operation; see the final note in Section 11.

The specific retention periods for each category of data are detailed internally and may be further specified in updates to this Policy.

10. Your rights and how to exercise them

You are the data subject of your data and may exercise your rights at any time by writing to faro@navigamo.co. We will respond within the legal periods. To address your request we may ask you to prove your identity.

10.1 Rights under Law 1581 of 2012 (Colombia)

• To know, update, and rectify your data with Navigamo.
• To request proof of the Authorization granted, except where the law does not require it.
• To be informed about the use given to your data.
• To file complaints before the Superintendence of Industry and Commerce for infractions of the law.
• To revoke the Authorization and request the deletion of the data when there is no legal or contractual duty to retain it.
• To access, free of charge, your personal data.

10.2 Rights under the GDPR (European Union and United Kingdom)

If you access from the European Union or the United Kingdom, you additionally have the right to:

• Access to your data and to a copy of it.
• Rectification of inaccurate or incomplete data.
• Erasure or the “right to be forgotten”, in the terms of the GDPR.
• Restriction of Processing in the cases provided.
• Portability of the data you provided to us, in a structured and commonly used format.
• Objection to Processing based on legitimate interest and to direct marketing.
• To withdraw consent at any time, without this affecting the lawfulness of the prior Processing.
• Not to be subject to decisions based solely on automated processing with legal or significant effects.
• To lodge a complaint before the supervisory authority of your country.

Faro already makes available to you, on the platform, tools to export your data (portability) and to delete your data (erasure).

10.3 Rights under the CCPA/CPRA (United States, California)

If you are a California resident, you additionally have the right to:

• To know which categories of personal data we collect, for what purposes, from which sources, and with whom we share them.
• To access the specific personal data we have collected about you.
• To delete the personal data we collected, with the legal exceptions.
• To correct inaccurate personal data.
• To opt out of the “sale” or “sharing” of personal data for behavior-based advertising. Navigamo does not sell your personal data in the traditional sense of the term; if in the future any of our analytics technologies were to entail a “sharing” under the CCPA/CPRA, you may exercise this right.
• To limit the use of sensitive personal information, in the event it were to apply.
• Not to be discriminated against for exercising your rights.

You may exercise these rights, or do so through an authorized agent, by writing to faro@navigamo.co.

11. Information security

We apply reasonable technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure. Among others:

• Per-user access control: the profile, facts, and assets tables apply row-level security, so that each user accesses only their own. The internal operations tables are accessible only by the service.
• Private file storage: the photos and documents you upload are stored in private storage and delivered only through short-lived temporary links; they are not public by default.
• Encryption of third-party credentials: the access credential to your Google account, when you connect it, is stored encrypted.
• Card data does not reach our servers: your card number is tokenized in your browser against the payment provider.
• Minimization: in the public view of the diagnostic report we do not expose your email address.
• Passwordless authentication: access to the platform is performed by an access link or a one-time code sent to your email.

No security measure is infallible. In the event of an incident affecting your data, we will act in accordance with the applicable law and, where appropriate, will inform you and notify the competent authority.

Note on deletion and accountability: when you delete your account, we delete your personal data; for accounting control of the operation we may retain a minimal record that the deletion occurred. This record is subject to the principle of minimization and to the applicable accounting duties.

12. Cookies and similar technologies

The holafaro.com website and the app.holafaro.com platform use cookies and similar technologies to function, to measure their traffic and use, and to improve the experience. Some are essential and others are analytics and marketing (Google Analytics 4, Google Ads, Meta Pixel, and Microsoft Clarity, the latter with session recording). The detail of each cookie, its purpose, its duration, and the way to accept, reject, or manage your consent for them is explained in our Cookies Policy, which forms an integral part of this Policy.

13. Third-party links and services

Faro may contain links to third-party sites and services (for example, your accounts or the site published by you). This Policy does not cover the Processing carried out by those third parties; we recommend that you review their own privacy policies.

14. Changes to this Policy

We may update this Policy to reflect changes in the service, in providers, or in the law. We will publish the version in force on holafaro.com and on app.holafaro.com, with its “Last updated” date. When the change is substantial and the law so requires, we will inform you of it or request a new Authorization from you. Continued use of the service after publication implies that you are aware of the version in force.

15. Related documents

This Policy is complemented by the following documents, which form part of Faro’s privacy framework:

• Cookies Policy (use of cookies and analytics and session recording technologies).
• Artificial Intelligence Use Notice (detail of the sending of data to third-party artificial intelligence systems).
• Terms and Conditions of the service.

16. Effective term

This Policy governs as of its “Last updated” date indicated in the heading and remains in force for as long as Navigamo processes personal data within the framework of Faro.

For any inquiry, request, or claim related to your personal data, write to us at faro@navigamo.co.