Personal Data Processing Policy

Version: 2026-10-25

Last updated: October 25, 2026

This English version is a courtesy translation. The Spanish version is the governing text; if there is any difference between them, the Spanish version prevails.

This policy explains how Clochi collects, uses, stores and protects the personal data of the people who use the service, in compliance with Colombian Law 1581 of 2012, Decree 1377 of 2013 (compiled in Single Regulatory Decree 1074 of 2015) and other Colombian personal data protection rules.

1. Data controller

  • Controller: Daniel Angarita Chinome, an individual (persona natural) who operates Clochi.
  • Domicile: Medellín, Antioquia, Colombia.
  • Address: Barrio Santa María de los Ángeles, Medellín, Antioquia, Colombia.
  • Email: hola@clochi.co
  • Phone / WhatsApp: +57 320 345 8825

This is the official channel for any question, complaint or request about your personal data.

2. What Clochi is

Clochi is an online service for restaurants. It lets them create a digital menu, a public restaurant page (at clochi.co/restaurant-name) and a QR code. Restaurants manage their information from the panel at app.clochi.co. Diners who visit a public page do not create Clochi accounts.

3. Who this policy applies to and what data we process

3.1 Restaurant owners and team members (panel users)

  • Account data: name, email, password (stored only in encrypted form, as a hash; never in plain text), phone or WhatsApp (optional), profile image (optional) and preferred language.
  • Google sign-in data: if you choose to sign in with Google, we receive your name, email and profile image from your Google account. We do not receive your Google password.
  • Usage and technical data: IP address, device and browser type, sign-in date and time, and technical session logs.
  • Acceptance record: the date and version of the Terms and of this Policy you accepted when creating your account.

3.2 Diners visiting a public page

We do not ask for or store diners' personal data in accounts. We only process the technical access data needed to display the page (for example, IP address, browser and date and time of the visit), which may remain in our hosting providers' technical logs.

If a diner taps the WhatsApp reservation button, the restaurant's own WhatsApp opens directly. That conversation happens between the diner and the restaurant, outside Clochi; Clochi does not receive or store those messages.

3.3 Information the restaurant chooses to publish

The restaurant decides what business information it publishes on its page: for example, trade name, address, map, opening hours, WhatsApp number, social media, photos and videos. That information is public by design: anyone with the link or the QR code can see it. If you include personal data in it (for example, a personal mobile number), you do so by your own decision and under your responsibility.

4. What we use the data for (purposes)

  1. Creating and managing your account and letting you sign in.
  2. Providing the service: creating and displaying the restaurant's digital menu, public page and QR code.
  3. Sending transactional emails: email verification, password recovery, team invitations and notices about your account or the service.
  4. Security and fraud prevention: protecting accounts and detecting unauthorized access or abusive use of the service.
  5. Support: answering your questions and requests.
  6. Improving the service: understanding, in general terms, how Clochi is used in order to fix bugs and improve features.
  7. Keeping you informed: telling you about new Clochi features and plans. This purpose is optional: you can ask us at any time to stop sending these messages by writing to hola@clochi.co. Doing so does not affect your use of the service.

We do not sell your personal data or use it for third-party advertising.

5. Cookies

Clochi only uses technical cookies needed for the service to work: the session cookies that keep you signed in to the panel and the cookie that remembers your language (NEXT_LOCALE). We do not currently use analytics or advertising cookies. If this changes, we will update this policy before doing so.

6. How we process and protect data

We process data only for the purposes in this policy and for as long as needed. We apply reasonable security measures, including:

  • Encrypted connections (HTTPS) between your browser and Clochi.
  • Passwords stored as a hash, never in plain text.
  • Access to each restaurant's information limited to its team members.
  • Infrastructure access limited to the controller and protected with credentials.
  • Use of infrastructure providers with recognized security practices.

No system is completely secure. If a security incident affects your data, we will inform you and report it to the Superintendence of Industry and Commerce (SIC) when the law requires it.

7. Processors and international data transfer

To provide the service we use providers that process data on our behalf (processors). Their servers are in the United States, so there is an international transmission of data:

  • Vercel Inc. (United States): hosting of the application and public pages.
  • Supabase Inc. (United States, AWS infrastructure in region us-west-2): database and file storage, such as photos and videos.
  • Resend (United States): sending transactional emails.
  • Google LLC (United States): Google sign-in, only if you choose that option.

These providers may only use the data to provide their service to us and must protect it under their own terms and policies. By accepting this policy you authorize this international transmission.

We do not share your data with other third parties, except when a competent authority requires it under the law.

8. Your rights as data subject

As the owner of your personal data you have the right to:

  1. Know, update and correct your data.
  2. Request proof of the authorization you gave us to process it.
  3. Be informed, upon request, about how we have used it.
  4. Revoke the authorization and request deletion of your data when the principles, rights and guarantees of the law are not respected, or when there is no legal or contractual duty to keep it.
  5. File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law, after first submitting your inquiry or claim to us.
  6. Access your personal data free of charge.

You can update several of your details directly from your account in the panel.

9. How to submit inquiries and claims

Write to hola@clochi.co and include:

  • Your full name and your Clochi account email.
  • What you want: inquiry, update, correction, deletion, revocation or another request.
  • A clear description of the facts and, if applicable, any supporting documents.
  • A way to reply to you.

We may ask for additional information to verify your identity before replying.

  • Inquiries: we reply within a maximum of 10 business days from receipt. If we cannot reply within that period, we will tell you why and give a new date, no more than 5 additional business days later.
  • Claims (correction, update, deletion or non-compliance): we reply within a maximum of 15 business days from the day after receipt. If we cannot reply within that period, we will tell you why and give a new date, no more than 8 additional business days later. If the claim is incomplete, we will ask you to complete it within the following 5 business days; if two months pass without you completing it, we will consider it withdrawn.

10. Sensitive data and minors

Clochi does not request sensitive data (for example, health, racial or ethnic origin, political orientation, religious beliefs or biometric data). Please do not include it in the content you upload.

The service is intended for adults acting on behalf of a business. We do not knowingly process data of children or adolescents.

11. Authorization

When you create your account, either with email and password or with Google, you tick a box accepting the Terms and Conditions and this Policy. By doing so you give us your prior, express and informed authorization to process your data under this policy. We store the date and the accepted version as proof of that authorization.

12. Database and policy validity

  • Your data is kept while you have an active account and while it is needed for the purposes described. When you delete your account or request deletion, we delete it from our active systems; backups are deleted in their normal cycles, unless the law requires us to keep some data longer.
  • The database will remain in force while Clochi provides the service.
  • This policy is effective from October 25, 2026.

13. Changes to this policy

We may update this policy. If we make significant changes, we will notify you by email or in the panel before they take effect, and we will update the version and date at the top of this document. If the change affects the purposes of processing, we will ask for your authorization again when the law requires it.