Privacy policy

Sources, recipients and separate purposes

Data come from the individual, the business authorizing a user or recording an operation, the selected authentication provider and payment channel; technical logs also arise during service. Google sign-in uses the authorized identity scope and does not authorize reading all email or files. Where data come from a business, that business provides its required notice and Vértice assists as processor.

Account and authentication data enable access and security; commercial contacts support requested responses and promotions only with the applicable choice; subscription information and tokens validate access and billing; orders, bookings, documents and images follow business instructions; logs and anti-fraud signals support security and claims. Internal access is limited to authorized personnel and external recipients depend on the enabled feature. Legitimate interest does not replace authorization required by local law.

Businesses access only their authorized relationships and operations; a buyer account does not let every merchant read its entire history. Catalogs and content intentionally published by a business are publicly accessible under those settings. Authority disclosures need a legal basis; corporate or provider changes must preserve required safeguards and notices. Using the service does not make credentials, tokens or private information public.

Providers by function and external content

In addition to Vercel, Supabase and Hostinger, the chosen feature may use Google identity, Google Play purchases, Google Maps/Places addresses and OpenRouteService routing. An OpenStreetMap view requests tiles from its provider, which receives technical data and the displayed area. An address or coordinate goes to the service necessary for the requested feature; this does not authorize campaign use. Tax providers such as DATAICO and payment providers participate only when their specific integration is enabled and identified at purchase or setup.

Importing a catalog URL queries the indicated source and, depending on the adapter, its reading service; supply only public authorized sources without private links or credentials. External images and videos, including YouTube and its content domains, may disclose IP, technical information and playback to their provider when requested content loads. The business must have publication rights. Advertising-tracking choices remain separate from data necessary for a requested feature. Table-access QR codes are generated locally without sending their URL to an external generator.

Retention by information type

Account, permissions and business data: during service and until return or deletion is completed, subject to identified legal exceptions. Billing, transactions and acceptance evidence: for the tax, contractual or claims periods applicable to the operation and country, with restricted access after their ordinary purpose ends. Support, incidents and logs: for justified follow-up, security or claims, followed by deletion or anonymization. Ask for the specific period or criterion for your data; no universal number of years applies across 23 countries.

Cookie preference lasts at most 365 days and is renewed when its version changes; optional identifiers follow the inventory. Unresolved public Vi questions are filtered and grouped for human review, without account or business identifiers attached to a question and without automatic training. The queue removes samples inactive for more than 90 days when new samples arrive and has an independent daily purge in bounded batches; removal completes in the next available cycle and failures or backlogs are reviewed. Request review of accidentally submitted personal information.

Manual local backups keep the annex's 30-day cycle except for justified recorded exceptions. Infrastructure backups have their own contractual lifecycle: their existence does not authorize reuse of deleted data or a promise of instant removal from every backup. Deletions must be reapplied after a restore. Deletion requests distinguish the global account, a merchant relationship, entrusted data and records requiring retention; uninstalling the app does not perform these actions.

Exercising rights and complaints

Contact admin@verticedigital.tech or acceso@verticedigital.tech describing your relationship with Vértice, the right and minimum locating information. No sign-in, payment or plan upgrade is required. We may seek proportionate identity or authority evidence; a complete identity document is not the default. Where another business controls the purpose, we will identify it and forward or help direct the request without exposing others' information.

In Colombia, access inquiries are answered within ten business days with the legally permitted reasoned extension of up to five; complaints within fifteen business days with a permitted extension of up to eight. In the EEA and UK, the usual response period is one month with justified extensions allowed by law. In the US and Canada, the applicable federal, state or provincial deadlines, verification, opt-outs and appeals apply; the international section does not replace them with a Colombian deadline.

If a request is partly or fully denied, we explain the reason and available review or appeal where applicable. You may complain to the competent authority and use an authorized agent where allowed. Exercising rights does not cause retaliation. Withdrawal affects future consent-based processing; processing on another valid identified ground may continue and legally required records are not erased.

Advertising, opt-outs and sensitive data

Free-plan ads do not by themselves authorize optional tracking. On the web, Google Analytics, Google Ads attribution, Meta Pixel and AdSense activate only with the applicable category and enabled feature. Rejection preserves access allowed by the plan. Own sponsorships or contextual ads must be assessed by their actual operations: calling an ad non-personalized does not mean it uses no storage, IP or other data. UMP and Android advertising-ID choices are separate from web cookies.

We do not sell or share entrusted business data for behavioral advertising. Optional ad-network processing of our own browsing data may have a different classification under some US laws. If an activity constitutes sale, sharing or targeted advertising and applicable law covers us, its required opt-out must be available before activation. GPC is honored in this browser; where the law requires applying an opt-out to a known profile, it must apply to that profile too. Request that handling through our privacy channels.

Operational modules do not enable medical records or health files. We do not request unnecessary sensitive information, customer biometric recognition or precise location for advertising. An ordinary photo is distinct from extracting a biometric template. A future feature requiring sensitive categories, an impact assessment, specific authorization or significant automated decisions will have its own information and controls before activation.

Age, representation and protection of children

Vértice is a business service and does not offer independent accounts to people under 18. Anyone contracting, administering or creating a buyer account must be at least 18 and have any additional legal capacity required locally; business representatives must also be authorized. An adult's permission does not enable a children's account the service does not offer. PEGI 3 describes app content and does not change these conditions or constitute parental consent.

An appointment, order or child's photo recorded by an adult is different from the child's own account. The business must establish necessity, have a lawful basis and any required guardian authorizations, respect the child's best interests and rights, limit access and retention, and respond to rights requests. Uploading an image for a booking or operation does not by itself authorize publication or campaign use. Data authorization, image rights and copyright are separate matters.

We do not routinely request a full birth date or identity copy to browse a catalog. If we become aware of a prohibited account or improper collection, we will restrict the affected processing during review and delete information that has no valid retention ground. A guardian may contact admin@verticedigital.tech or acceso@verticedigital.tech; we will proportionately verify identity and authority and coordinate with the business where it is controller. Do not send complete identity documents or the child's details in an initial message.

We do not authorize sale, behavioral advertising or model training using children's data processed on behalf of a business. A child-directed flow, or one involving known direct collection from children, that requires notices, verification or parental consent—including COPPA in the United States where applicable—will not be enabled without the required safeguards. Digital-consent ages are not equivalent to contractual adulthood.