01SECTION 01
Data Controller and Guiding Privacy Principles
CELAEST operates as Data Controller under Colombian Law 1581 of 2012, with complete alignment with GDPR and CCPA international standards.
CELAEST (hereinafter, "the Platform"), operated commercially from the Republic of Colombia with international scope, acts as Data Controller for personal and corporate data collected via its web applications and APIs.
Our operations strictly comply with Statutory Law 1581 of 2012, Regulatory Decree 1377 of 2013, and concordant Colombian data protection regulations (Habeas Data), alongside compatibility with the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
Data Protection Officer (DPO): For regulatory inquiries or exercising statutory rights, contact privacidad@celaest.com.
02SECTION 02
Categories of Data Collected
We collect solely account data, OAuth profile details, transient ephemeral AI workloads, and security device fingerprints.
We collect the following categories of information strictly adhering to necessity and data minimization principles:
Critical Payment Note: CELAEST DOES NOT store full credit or debit card numbers or CVV verification codes. All financial instruments are processed directly by PCI-DSS Level 1 certified gateways.
- —Account and Profile Data: Name, corporate email address, username, and password securely hashed using bcrypt cryptographic algorithms.
- —OAuth Authentication Data: When signing in via Google or GitHub, we collect solely name, email, and profile avatar. CELAEST never accesses private repositories, contacts, or external source code.
- —AI Workloads and Code (Prompts and Parameters): Source code and prompts submitted for AI Mesh inference or sandbox validation, processed transiently in active RAM.
- —Security Data and Device Fingerprinting: IP addresses, user-agents, and technical device fingerprints collected for cybersecurity, fraud prevention, multi-account abuse detection, and electronic evidentiary proof under Law 527 of 1999.
03SECTION 03
Primary and Secondary Processing Purposes
Primary purposes deliver services and establish legal agreements. Secondary purposes cover aggregated anonymous telemetry.
We process personal and corporate data under distinct, transparent purposes:
Data subjects may revoke consent for secondary purposes at any time without impacting contracted core services.
- —Primary Purposes (Indispensable): Account management; AI Mesh model inferencing; script execution in sandboxes; invoice processing and subscriptions; customer support; contractual evidentiary proof and fraud mitigation.
- —Secondary Purposes: Producing aggregated, anonymous performance metrics to optimize network routing and CDN latency.
04SECTION 04
Strict Binding Commitment to Zero-Training in AI
Customer prompts, proprietary source code, and enterprise files are NEVER used to train or fine-tune public AI models.
CELAEST maintains an unyielding policy of Workload Confidentiality: no prompt, corporate file, or code fragment routed through our AI Mesh is ever utilized to train, fine-tune, or reinforce public foundational models of OpenAI, Anthropic, Google Vertex, or third parties.
Unlike mass-market consumer tools, our integrations operate exclusively across commercial B2B APIs with binding Zero-Training commitments, processing workloads ephemerally in active memory.
05SECTION 05
Cookies, JWT Session Tokens, and Local Storage Technologies
JWT tokens for secure authentication and localStorage for UI state. Zero third-party advertising trackers.
JSON Web Tokens (JWT): We utilize JWT tokens to govern session authentication securely, featuring limited expiration windows and automated invalidation upon logout.
Local Storage (localStorage): We employ browser local storage solely to store interface themes (dark/light mode) and temporary editor scratchpad states to prevent code loss.
Web Analytics and Zero Ad-Tracking Policy: We employ Google Analytics 4 (GA4) with IP anonymization to evaluate technical performance and aggregated usage. We do not deploy third-party advertising cookies or trade corporate behavioral data with ad brokers.
06SECTION 06
Infrastructure Subprocessors and International Data Transfers
Global partners audited under SOC 2 and ISO 27001 pursuant to Article 26 of Law 1581 of 2012.
To guarantee high availability, edge security, and ultra-low latency, we partner with world-class subprocessors bound by Data Processing Addenda (DPA):
Pursuant to Article 26 of Law 1581 of 2012, accepting this Privacy Policy constitutes express authorization for international data transfers necessary for platform operation.
- —Cloudflare, Inc. (Perimeter defense, WAF firewalls, DDoS mitigation, and TLS 1.3 certificates).
- —Vercel, Inc. (Edge serverless hosting and global CDN distribution).
- —Anthropic PBC / OpenAI LLC / Google Vertex AI (B2B commercial AI inference under non-training agreements).
- —Isolated Sandbox Environments (Ephemeral code execution and script validation without data persistence).
- —PCI-DSS Level 1 Payment Processors (Stripe and certified digital payment settlement partners).
07SECTION 07
Data Subject Rights and Formal Habeas Data Procedure
Statutory rights to access, update, suppress, and revoke data. Formal 10-day (+5) statutory timeline and SIC recourse.
Pursuant to Article 8 of Colombian Law 1581 of 2012 and concordant regulations, Customer possesses statutory rights to: 1) Access, update, and rectify personal data; 2) Request proof of consent; 3) Be informed of data usage; 4) File complaints before the Colombian Superintendency of Industry and Commerce (SIC); 5) Revoke authorization or request suppression where legally permissible.
Formal Inquiries and Claims: Requests must be submitted in writing to privacidad@celaest.com detailing name, corporate identity, request description, and notification address. CELAEST will formally resolve submissions within ten (10) business days; if extension is necessary, notification will precede with up to five (5) additional business days granted by Article 15 of Law 1581.
08SECTION 08
Information Security, Isolation, and Strong Encryption
TLS 1.3 in transit, AES-256 at rest, isolated sandboxes, and bcrypt salted password hashing.
We implement defense-in-depth protocols: all external and inter-service communications are encrypted via TLS 1.3 with Perfect Forward Secrecy. Passwords are encrypted utilizing salted cryptographic hashes (bcrypt), rendering plaintext recovery impossible.
Workload Isolation: Script execution takes place within ephemeral, isolated sandboxes, completely separated from core platform infrastructure.
09SECTION 09
Data Retention Schedules and Protection of Minors
Active accounts retained; 30 days for suppression; 5 years for tax records under statutory mandate; 12 months for security fingerprinting.
Account data is retained while commercial relationships remain active. Following verified deletion requests, records are irreversibly purged within thirty (30) calendar days, barring statutory archival duties.
Billing records are preserved for a mandatory minimum of five (5) years pursuant to Colombian tax and commercial legislation (Tax Statute and Code of Commerce). Technical device fingerprints are preserved for up to twelve (12) months for cybersecurity and fraud auditability.
Protection of Minors: CELAEST services are directed exclusively to corporations and persons over eighteen (18) years of age. We do not knowingly collect personal data from minors.