Privacy Statement

1. Controller and contact channel

Data controller: AntiFraude CyberSecurity & Privacy Services LLC, operating in Miami (Florida, United States) and Bogotá D.C. (Colombia).

Dedicated channel for privacy questions, complaints, data changes and withdrawal of authorization: privacidad@antifraude.io.

2. Data we process

• Data you give us in the contact form: name, company, email, phone (optional), topic, message and the record of your authorization (date, time and language).
• Technical connection data: IP address, date and time, requested page and browser type, processed by our server and Cloudflare to deliver and protect the site. Our logs do not store URL parameters.
• Approximate country of the connection, inferred by Cloudflare from the IP address and used only during the visit to show the right language. We do not store it.
• Cookies, as described in section 5, and only with your consent when they are not strictly necessary.

We do not request sensitive data or data about minors. Please do not include sensitive information, credentials or incident evidence in your message; if needed, we will receive it through a secure channel agreed with you.

3. Purposes

• To answer your request, contact you and, if you ask, prepare a service proposal.
• To protect the site, prevent fraud, spam and abuse, and keep the service available.
• To show the site in the most suitable language and, if you accept, remember the language you chose.
• To comply with legal obligations and requests from competent authorities.

We do not sell or share (as defined by the CCPA) your personal data, we do not use it for targeted advertising, we do not build commercial profiles and we do not make decisions based solely on automated processing that produce legal effects on you.

4. Authorization and legal bases

United States: we collect only the data reasonably necessary and proportionate for the purposes described in this Statement, disclosed at the time of collection.

Colombia: we process contact form data with your prior, express and informed authorization, which you give by checking the acceptance box before sending the message. We keep proof of that authorization. You can withdraw it at any time by writing to privacidad@antifraude.io.

European Union and Brazil: the legal bases are your consent and steps taken at your request before a contract (GDPR art. 6(1)(a) and 6(1)(b); LGPD art. 7, I and V), legitimate interest for site security and automatic language selection (GDPR art. 6(1)(f); LGPD art. 7, IX) and compliance with legal obligations.

5. Cookies and similar technologies

We use as few cookies as possible and none for advertising, social media or third-party analytics. On your first visit you can accept all, reject the non-essential ones or choose by category, and you can change your choice at any time from "Cookie settings" in the footer of every page. If your browser sends the Global Privacy Control (GPC) signal, we treat it as a rejection of non-essential cookies and as an opt-out of sale or sharing.

Cookie settings

6. Who we share data with

• Microsoft Corporation (Microsoft 365), provider of our corporate email, where contact form messages are received.
• Cloudflare, Inc., the delivery and security network that protects the site.
• Our web server hosting provider.
• Public authorities, only when required by law or a court order.

These providers act as processors (service providers under the CCPA) and are contractually bound to protect the information and use it only to provide their service to us.

7. International transfers

Your data is processed mainly in the United States and Colombia and may be hosted in other countries where our providers operate. Transfers from Colombia follow article 26 of Law 1581 of 2012, with your express authorization and with providers that offer adequate protection. For data from the European Union or Brazil we rely on standard contractual clauses and our providers’ data processing agreements.

8. Retention

• Contact form messages: as long as needed to handle your request and, if no business relationship follows, up to 24 months. If a contract is signed, for its term and the applicable legal periods.
• Server technical logs: up to 90 days, unless needed to investigate a security incident.
• Cookies: for the period shown in the table in section 5.

Our databases remain in effect while the purposes described exist. Afterwards, data is securely deleted or anonymized.

9. Security

We apply technical, human and administrative safeguards consistent with our cybersecurity practice: encryption in transit (TLS 1.2 or higher), content security policies, data minimization, access control and isolated services running with least privilege. If an incident affects your data, we will notify you and the authorities within legal time frames, including the relevant U.S. state authorities and Colombia’s Superintendence of Industry and Commerce.

10. Notice for U.S. residents

This section applies to California residents (CCPA/CPRA) and, as relevant, to residents of other states with privacy laws (for example Virginia, Colorado, Connecticut, Texas, Oregon and Florida).

• Categories of personal information collected in the last 12 months: identifiers (name, email, phone, IP address); professional information (company); internet activity information (pages visited, browser type); and approximate country-level location. We do not collect sensitive personal information.
• Sources: directly from you and from your browser when you visit the site.
• Purposes: those described in section 3. Retention periods: those in section 8.
• We do not sell or share personal information, including that of consumers under 16, and we do not use it for cross-context behavioral advertising. We honor the Global Privacy Control signal.
• Your rights: to know and access the information collected, correct it, delete it, obtain a portable copy, limit the use of sensitive information and not be discriminated against for exercising these rights.
• How to exercise them: write to privacidad@antifraude.io. We will verify your identity using information we already hold and respond within 45 days, extendable once by 45 more days with notice. You may use an authorized agent with your written permission. If we deny your request, you may appeal by writing to the same address; we will respond within the time frames of your state’s law.

11. Rights of data subjects in Colombia

Under article 8 of Law 1581 of 2012, you have the right to:

• Know, update and correct (change) your personal data.
• Request proof of the authorization you granted.
• Be informed of how your data has been used.
• File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law, after completing the inquiry or claim process with us.
• Withdraw your authorization and request deletion of your data when there is no legal or contractual duty to keep it.
• Access your personal data free of charge.

12. How to change your data or withdraw your authorization

Write to privacidad@antifraude.io with your full name, the email you used to contact us, the specific request (inquiry, change or update, deletion, withdrawal of authorization, proof of authorization) and any supporting documents. We may ask for additional information to verify your identity.

Inquiries: answered within 10 business days of receipt, extendable by 5 business days with an explanation.

Claims, changes, deletion and withdrawal: answered within 15 business days, extendable by 8 business days. If the request is incomplete, we will ask you to complete it within 5 days; if 2 months pass without a reply, the request will be considered abandoned. While it is being handled, the information will be flagged as "claim in progress".

Withdrawing your authorization does not affect the lawfulness of processing carried out before the withdrawal. Withdrawal and deletion do not apply when there is a legal or contractual duty to keep the data.

13. European Union, Brazil and other countries

If you are in the European Union, the European Economic Area or Brazil, you also have the rights to restriction of processing, portability and objection, and you may lodge a complaint with the supervisory authority of your country or with Brazil’s National Data Protection Authority (ANPD). We handle these requests through privacidad@antifraude.io within one month (GDPR) or 15 days (LGPD).

14. Minors

Our services are aimed at companies and professionals. We do not knowingly collect data from people under 18; if we find that we have, we will delete it.

15. Changes to this Statement

We may update this Statement to reflect legal changes or changes to our services. We will publish the new version on this page with its effective date and, if a material change requires new authorization, we will ask for it.