Privacy Policy and Personal Data Processing

Current version: 2026-07-12. Effective date: July 12, 2026.

This Privacy Policy and Personal Data Processing document sets out the guidelines applicable to the collection, storage, use, circulation, retention, updating and deletion of information processed through JoinComu.

Its purpose is to clearly inform data subjects about the use of their personal data, the purposes of processing, the measures adopted to protect information and the mechanisms available to exercise their rights.

This policy is adopted in compliance with the Constitución Política de Colombia, Ley 1581 de 2012, Decreto 1074 de 2015 and all other provisions that modify, complement or regulate the Colombian personal data protection regime.

1. Scope

This policy applies to the processing of information carried out through JoinComu, including directory browsing, community submission, opening external links through the exit route, reports and communications sent through contact channels.

2. Identification of the responsible person

3. Essential definitions

For purposes of this policy, personal data means any information associated or associable with a natural person. Processing means any operation on that data, such as collection, storage, use, retention, updating or deletion. Data subject means the person to whom the information refers.

4. Information subject to processing

A community's public information may include name, description, platform, type, category, country, language, content classification, status and slug.

Private or technical information may include the real invitation link, the terms and privacy version and acceptance date, the anti-abuse identifier stored as a hash, user-agent when collected, report reason and comment, and click referrer or user-agent when stored.

The real invitation link is kept private on the server. There are no user accounts, the publisher's email is not collected, and age, identification document or date of birth is not stored.

The application is not inserting IP addresses into the reviewed tables. Infrastructure providers may process technical logs needed for security and operation. There is no active analytics or active behavioral advertising.

5. Processing purposes

• Publish, classify and display communities.
• Prevent abuse, spam and duplicates.
• Protect private links and measure link openings.
• Process reports and maintain operational security.
• Answer inquiries, comply with legal obligations and retain evidence of acceptance.

6. Applicable principles

Processing is guided by the principles of legality, purpose, freedom, truthfulness, transparency, restricted access, security and confidentiality, according to the Colombian data protection regime.

7. Authorization and proof of consent

Data must be provided freely and on an informed basis. JoinComu does not request sensitive data as an ordinary condition of service. For new publications, versioned evidence of acceptance of the terms and privacy policy is retained and linked to the submitted community.

8. Rights of data subjects

As a data subject, you may know, access, update, rectify, request proof of authorization, know the use given to your data, revoke authorization when appropriate, request deletion when appropriate, file inquiries and complaints, and go before the Superintendencia de Industria y Comercio after exhausting the internal process.

9. Handling inquiries and complaints

The privacy channel is privacidad@joincomu.com. Include reasonable identification of the requester, a description of the request, contact details for the response and elements that make it possible to locate the information. JoinComu may carry out reasonable identity verification without requiring unnecessary documents.

Inquiries will be answered within a maximum of 10 business days, with a legal extension of up to 5 business days. Complaints will be answered within a maximum of 15 business days from the day after complete receipt, with a legal extension of up to 8 business days.

10. Retention and deletion

No automatic periods that the code does not implement are invented. Data is retained for the reasonable time needed for its purposes. Publications and links may remain while they are active; reports and technical records may be retained for security, fraud prevention, disputes and legal obligations.

When information is no longer necessary, it will be deleted, anonymized or blocked as appropriate and in accordance with applicable technical and legal possibilities.

11. Processors and technology providers

Confirmed providers are Supabase for database and infrastructure, Cloudflare for domain, DNS and security, and Google Workspace for email and communications. Unconfirmed providers are not described.

12. International transfers or transmissions

Some providers may process information outside Colombia according to their services, configurations and applicable obligations. Exact server locations are not asserted without available evidence.

13. Information security

JoinComu uses access controls, separation of private links, RLS, sensitive server-side operations, link validation, email authentication and anti-abuse controls. No measure guarantees absolute security.

14. Information of minors

JoinComu is not designed to deliberately collect personal data from children. Data from minors must not be submitted without authorization and an appropriate legal basis. This is not equivalent to restricting the viewing of general content when the law permits access.

15. Modifications and effectiveness

Substantial changes to this policy will be communicated before they are implemented when appropriate. Before enabling new providers, analytics, advertising or email collection, this policy must be updated.