This policy explains what personal data La Guayaba LLC processes when providing UltraGIS, why, on what basis and how you can exercise your rights. It applies Law 1581 of 2012 and Decree 1377 of 2013 (Colombia), the Lei Geral de Proteção de Dados (Brazil), the Federal Law on Protection of Personal Data Held by Private Parties (Mexico) and, where relevant, the principles of the General Data Protection Regulation (EU).
1. Data controller
La Guayaba LLC, organized in State of incorporation, USA, with its registered office at Registered address. Privacy contact: privacy@ultragis.io.
La Guayaba is the controller of user account data, billing contacts and site visitors. It is the processor of subscriber and lead data each customer uploads to its company; in that case the customer is the controller and the DPA applies.
2. Data we process
- Account: name, email, role, language, company, password hashed with Argon2id and, if you enable it, the two-step verification secret.
- Company signup: legal name, subdomain, country and the administrator who creates it, with the version and date they accepted the terms and this policy.
- Billing: plan, cycle, invoices and the Stripe customer ID. We do not store the card number: Stripe handles it.
- Usage and security: IP address, browser, sign-ins, remembered devices and audit records.
- Field: GPS location of photos and reports the user captures in the field app.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing and supporting the service | Performance of the contract |
| Security, fraud prevention and auditing | Legitimate interest and legal obligation |
| Charging and invoicing | Performance of the contract and legal obligation |
| Service notices by email | Performance of the contract |
| Marketing news | Consent, revocable at any time |
In Colombia, accepting this policy at signup is the prior, express and informed authorization required by Law 1581 of 2012.
4. Subscriber and lead data
Subscriber and lead data is encrypted, masked according to the user's role and every access is recorded in an immutable audit log. We only process it following the customer's instructions and never use it for our own purposes or send it to the AI assistant.
6. International transfers
Some subprocessors are in the United States and data is hosted in Hosting region. Transfers are made with adequate safeguards (contractual clauses and equivalent security measures), in line with article 26 of Law 1581, article 33 of the LGPD and the LFPDPPP.
7. Retention
We keep data while the company is active. When the trial or subscription ends, it remains read-only for 60 days with a full export; after three warning emails, it is purged. Unverified signup requests are deleted after 7 days. Security logs are kept 30 days hot and 12 months archived; invoices, as long as the law requires.
8. Your rights
You can access, update, correct and delete your data, withdraw authorization, request portability, object to processing and file complaints with the authority: the Superintendencia de Industria y Comercio (Colombia), the ANPD (Brazil), the INAI or its successor authority (Mexico) or your local authority. In Mexico you can exercise ARCO rights.
Write to privacy@ultragis.io from your account email. We answer queries within 10 business days and claims within 15 business days (Law 1581), or within the shorter period set by the applicable law. If a customer uploaded your data (for example, you are an ISP's subscriber), send the request to that customer; we will help forward it.
9. Security
We apply encryption in transit and at rest, per-company isolation, optional two-step verification, auditing and backups. Details are in Security. If an incident affects your data, we will notify you without undue delay and the authority when the law requires it.
11. Minors
UltraGIS is a business service and is not directed to people under 18. If a customer uploads data of minors as subscribers, it must have the authorization of their legal representative.
12. Changes to this policy
We will publish any change here with its version and date; if it is substantial, we will notify you by email before it applies and, where the law requires it, ask for your authorization again.