Privacy Policy

Thallo Digital is the data controller (responsable del tratamiento) for the personal data described here. Our details are at the foot of this page, and privacy requests reach a person at contact@thallodigital.com.

This policy is issued under Law 1581 of 2012 and Decree 1377 of 2013 of the Republic of Colombia, which govern the protection of personal data (habeas data).

We only collect what a specific purpose needs. In practice that is three things.

• When you contact us — your name, email address, company and whatever you write in your message. You choose what to put in it.
• When you run the free visibility scan — the brand name, website domain and category you enter. These are business details, not personal ones. If you choose to unlock the full report, we also receive the email address you give us.
• When you become a client — the contact and billing details needed to run and invoice the engagement, plus whatever access you grant us to do the work.

We do not ask for, and have no use for, sensitive personal data as Law 1581 defines it. Please do not send it to us. We do not knowingly collect data from children.

The scanner has to know that one visitor is not running it a hundred times a day. It does that without keeping your address: the address is combined with a secret salt and hashed, and only the hash is written to the database. The hash cannot be reversed into an address, so the table cannot be used to work out who ran a scan — only that two scans came from the same visitor.

This website uses Google Analytics 4, and nothing else. It is how we know which pages are read and which are ignored. It sets cookies in your browser (named _ga and _ga_…) that give your browser an identifier so two visits can be recognised as the same one, and it records:

• The pages you open, in what order, and how long you stay.
• An approximate location — country, and usually city — worked out from your IP address. Google does not store the address itself.
• Your device, browser and language, and the link or search that brought you here.

Two of Google’s settings are deliberately off: Google Signals and ad personalisation. That means the data cannot be used to build advertising audiences, to follow you across other websites, or to match you to a Google account. We run no tag manager and no advertising pixel, we do not sell or rent data to anyone, and we never will.

None of it happens until you say so. On your first visit the site asks, and until you answer, no request is made to Google and no cookie is set — the tag is not on the page at all. Decline and it never loads. Nothing on this site stops working without it.

Your answer is kept in your own browser, in localStorage, under thallo:analytics-consent. It is the only thing this site stores there, it never reaches us, and it is what stops you being asked again on every page. You can change it here, whenever you like:

Independently of any of this, Google publishes a browser add-on that opts you out of Analytics on every site that uses it, at tools.google.com/dlpage/gaoptout, and any browser setting or extension that blocks these cookies works too.

Our blog runs on WordPress at the /blog/ path. It does not use Google Analytics, and may set functional cookies of its own — for example if you leave a comment or log in. Those serve the blog’s own operation and are not used for tracking.

• Your authorisation — given when you submit a form or an email address to unlock a report, and separately when you accept analytics in the banner. You can withdraw either at any time; the analytics one is the button in clause 4.
• To perform a contract — running, supporting and invoicing an engagement you have with us.
• Our legitimate interest in operating the site securely, including the abuse limits described in clause 3.
• Legal obligations — accounting and tax records we are required to keep.

We share personal data only with the providers that make the service work, and only with what they need:

• AI model providers — the scan sends its category questions to third-party models through OpenRouter (which routes to providers such as OpenAI, Anthropic and Google) and to Perplexity. The questions contain the brand, domain and category being scanned. Your email address is never sent to them.
• Hosting — our website, blog and scan database are hosted by our hosting provider, which stores the data on our behalf.
• Payment processing — card payments are handled by Stripe under its own privacy policy. We never receive or store your full card number.
• Authorities — where a law or a court order requires it.

Some of these providers operate outside Colombia, so using this site involves an international transfer of data to countries whose rules may differ. We only use providers that commit contractually to protecting the data to a standard comparable with Law 1581.

• Scan working data — the questions, the answers and the hashed visitor identifier — is deleted automatically after the retention period set in the tool, which is 14 days by default.
• An email address given to unlock a report is kept until you ask us to delete it, or until it is clear you are no longer interested in hearing from us.
• Client records are kept for the life of the engagement and afterwards for as long as accounting and tax law requires.
• Emails you send us are kept while they are useful to the conversation, and deleted when they are not.

Under Law 1581 of 2012, at any time and free of charge, you may:

• Know what personal data of yours we hold, and where it came from.
• Update or correct anything that is wrong, incomplete or out of date.
• Delete it, where there is no legal obligation for us to keep it.
• Withdraw the authorisation you gave us, which we act on unless the law requires otherwise.
• Ask for proof of the authorisation you gave.
• Complain to the Superintendencia de Industria y Comercio (SIC) if you believe we have not respected these rights.

Write to contact@thallodigital.com and we will answer within the periods the law sets: 10 business days for a query, 15 business days for a complaint, extendable once where we tell you why. We may ask you to confirm your identity first, so that nobody else can act on your data.

Data is transmitted over encrypted connections and access to it is limited to the people who need it. API keys and secrets are held on the server and are never exposed to the browser. No system is perfectly secure, but if a breach affects your personal data we will notify you and the SIC as the law requires.

We update this policy when what we do with data changes. The date at the top shows when this version was issued; material changes are announced on this page before they take effect.