Privacy policy

1. Data controller

The controller is L2E innovation SAS (Colombia), operator of RadarIA. For any privacy matter write to [email protected].

2. Data we collect

Account data: email address and password (stored only as a cryptographic hash; never in plain text).

Service configuration data: brand, product and competitor names, measurement country and language, and the associated prompts (buyer questions). These are normally business data, not personal data.

Billing data: contracted plan and subscription status. Payment data (card, PSE, Nequi) is processed directly by Wompi or Paddle; RadarIA never sees or stores card numbers.

Minimal technical data: session and language cookies (see section 5) and standard server logs.

3. What we use it for

To authenticate your account, run the measurements you configure, compute metrics and recommendations, bill you according to your plan, and communicate with you about the service (billing notices, changes to the terms, support).

We do not use your data for advertising and we do not sell it to third parties.

4. Who we share it with

AI model providers (OpenAI, Perplexity, Google, Anthropic): they receive the measurement prompts, which include product and competitor names. We do not send them your email or your account data.

Payment processors: Wompi (Bancolombia) for payments in Colombia and Paddle as Merchant of Record for international payments. Each one handles your payment data under its own privacy policy.

Infrastructure: the service is served through Cloudflare (network and security). There are no other processors with access to personal data.

Authorities: only where a legal obligation requires it.

5. Cookies

We use only two first-party, functional cookies: radar_session (to keep you logged in) and radar_locale (to remember your language). We do not use advertising or third-party tracking cookies, which is why we show no cookie banner.

6. Google data (Google Analytics 4 integration)

If you connect your Google Analytics 4 property to RadarIA, we request READ-ONLY access (analytics.readonly scope) through Google's OAuth consent. We use that access solely to read aggregated session metrics from your property (date, session source and number of sessions referred by AI assistants) and show them in your dashboard next to your Share of Voice.

We do not read, store or process personal data of your site's visitors; only daily aggregates. The access token is stored encrypted (AES-256) and you can disconnect the integration at any time from your brand view — when you do, we delete the token and the stored traffic data. You can also revoke access from your Google account.

The use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we do not transfer this data to third parties, we do not use it for advertising and no human reads it except with your explicit consent, for security reasons or to comply with the law.

7. Retention and security

We keep your data for as long as your account exists. If you delete it or ask us to, we erase your personal data within a maximum of 30 days, except for what we must keep by legal obligation (for example, billing records).

We apply reasonable security measures: hashed passwords, encrypted connections (HTTPS), restricted database access and backups.

8. Your rights

You may access, correct, update or delete your data, and withdraw your authorization, under the Colombian habeas data regime (Law 1581 of 2012). If you are in Brazil, the equivalent LGPD rights apply; if you are in the European Union, the GDPR ones.

To exercise them write to [email protected]; we respond within the applicable legal deadlines.

9. Changes to this policy

If we change this policy substantially we will announce it in the application or by email. The date of the last update appears at the top.