Privacy policy

At Katio we respect the privacy of everyone who uses our platform. This policy describes what information we collect, the purposes for which we process it, who we share it with, and what rights you have as a data subject.

This policy is governed by Statutory Law 1581 of 2012, Implementing Decree 1377 of 2013 and other applicable regulations of the Republic of Colombia on the protection of personal data.

1. Data controller

The controller responsible for processing the personal data collected through the platform is:

• Trade name: Katio
• Email: info@katio.co
• Address: Bogotá D.C., Colombia

For any request relating to your personal data, you may contact us at the email address above.

2. Data we collect

Depending on the user's role (accountant or client) and the selected account mode, we may collect:

2.1. Identification and contact data

• Full name or company name.
• National ID number (cédula) or tax ID (NIT).
• Email address.
• Phone number.
• Person type (individual or legal entity).
• Profile picture, when you authenticate through an external provider (Google).

2.2. Accounting and financial information

• Accounting files in Excel format (.xlsx, .xls).
• Accounting documents and supporting files (invoices, receipts, tax returns).
• Tax information: returns, withholdings, tax obligations.
• Financial position information: assets, liabilities, entries and general ledger.
• Tax calendar and associated events.

2.3. Platform usage data

• Sign-in and activity logs.
• Messages exchanged through the chat with your accountant or client.
• Technical information about your device and browser (session cookies, IP address).

3. Purposes of processing

We process your personal data for the following purposes:

• To create, maintain and administer your account within the platform.
• To link accountants and clients in an accounting management relationship.
• To process accounting files using artificial intelligence in order to extract and organize accounting information.
• To show you financial, tax and calendar indicators and reports derived from your information.
• To enable communication between accountant and client through the built-in chat.
• To provide technical support and handle enquiries, complaints or claims.
• To send functional notifications related to the service (for example, processed files, expired plan, tax events).
• To comply with applicable legal, contractual and regulatory obligations.
• To improve service quality through aggregated and anonymized statistical analysis.

We do not use your personal data for advertising purposes, and we do not sell it to third parties.

4. Financial and sensitive data

The accounting and tax information that you or your accountant upload to the platform may be considered private financial information. To process it, we apply reinforced security measures (encryption in transit and at rest, role-based access control, and row-level security policies in the database) and restrict access to:

• The data subject themselves.
• The accountant linked to the client, where such a relationship exists.
• Authorized Katio personnel, only where strictly necessary to provide the service or to respond to an express support request.

5. Data processors

In order to provide the service we may transfer or grant access to your data to third-party processors operating under confidentiality and information security agreements. We currently work with:

• Supabase — database and file storage, authentication.
• Vercel — hosting of the web platform.
• OpenAI — artificial intelligence processing of accounting files and the tax assistant.
• Google — optional authentication with Google accounts.
• n8n — internal orchestration of the processing workflow.

Some of these providers may operate outside Colombia. In those cases we ensure that the recipient meets data protection standards equivalent to those set out in Colombian law, in accordance with article 26 of Law 1581 of 2012.

6. Data subject rights

As the subject of your personal data, you have the right to:

• Access, update and rectify your data.
• Request proof of the authorization granted for processing.
• Be informed, upon request, about how your data has been used.
• Withdraw your authorization and/or request deletion of the data, unless a legal or contractual duty to retain it applies.
• Access your processed personal data free of charge.
• File complaints with the Superintendence of Industry and Commerce (SIC) for breaches of the personal data protection regime.

7. How to exercise your rights

You may exercise your rights by sending a request to info@katio.co stating:

• Your full name and contact details.
• Identity document.
• A clear description of the facts giving rise to the request.
• The right you wish to exercise (access, update, deletion, withdrawal, etc.).

Enquiries will be answered within a maximum of ten (10) business days; claims within a maximum of fifteen (15) business days, in accordance with articles 14 and 15 of Law 1581 of 2012.

In addition, from your account you can update most of your data in Settings and delete your account at any time from the danger zone on that same screen.

8. Information security

We implement reasonable technical, organizational and administrative measures to protect your data against unauthorized access, loss, alteration or improper disclosure. Among others:

• Encryption of traffic in transit via HTTPS/TLS.
• Encrypted storage at rest.
• Role-based access control and row-level security (RLS) policies in the database.
• Generation of temporary signed URLs to download private files.
• Activity logging and periodic security reviews.

No security measure is infallible. Should we detect an incident that compromises your data, we will notify the affected data subjects and the Superintendence of Industry and Commerce under the terms set out by law.

9. Data retention

We will retain your data for as long as your account is active and for any additional period necessary to comply with legal or contractual obligations (for example, retention of accounting information). Once those periods have elapsed, the data will be deleted or anonymized.

10. Cookies and similar technologies

We use strictly necessary cookies to keep your session active and to make the service work correctly. Optionally, and only in production, we also integrate Google Analytics to understand aggregate use of the platform. We do not use advertising cookies or cross-site tracking cookies.

11. Minors

The platform is intended exclusively for adults. We do not knowingly collect personal data from persons under 18 years of age. If you believe a minor has provided data without authorization, please contact us so we can proceed with its deletion.

12. Changes to this policy

We may update this policy where necessary due to regulatory, technical or service changes. The version in force will always be published on this page, indicating the date of last update. If the changes are material, we will notify you by email or through a visible notice within the platform.

13. Supervisory authority

The Colombian authority for the protection of personal data is the Superintendence of Industry and Commerce (SIC). If you believe your rights have not been addressed, you may file a complaint with this entity at sic.gov.co.

14. Contact

For any question relating to this policy or to the processing of your personal data, write to us at info@katio.co.