masterweb.ai Privacy Policy

Version 1.0, effective October 2, 2026

This Privacy Policy explains how TECNOLOGIA MASTERWEB SAS (NIT 900.947.569-8), operating the Masterweb AI brand, located at Carrera 64 No. 24-47, Bogota 111321, Colombia ("we", "us", "our"), collects, uses, shares and protects personal information. It applies to our website masterweb.ai, our chat assistant, and the services we provide to businesses that buy from us ("Customers"). The people who visit our Customers' websites are called "Visitors".

We currently operate from Colombia, so Colombian data protection law also applies to us (Section 13). A United States company of our group may take over the service in the future. If that happens, we will notify Customers in advance and update this Privacy Policy.

1. Our two roles

1.1 When we decide how data is used (controller). For information about our own website visitors, prospects and Customers (for example, the person who signs up and the contacts at a Customer's business), we decide how the information is used. This Privacy Policy describes that use.

1.2 When we act for a Customer (processor). When a Customer uses our services on its own website, we process its Visitors' information, such as chatbot conversations and form submissions, on behalf of that Customer and only under its instructions. The Customer is responsible for that information and its own privacy notice applies to it. Our Data Processing Addendum ("DPA") with the Customer governs that processing. If you are a Visitor of a Customer's website, please contact that business with questions or requests. We will help the business respond.

2. Information we collect

2.1 Information you give us.

• Contact details: name, email address, phone number, job title.
• Business details: business name, website address, industry, goals, audience, colors and other information you share so we can build or improve your site.
• Account and verification details: account email and the one-time codes we send to verify it.
• Order and billing details: the plan you chose, invoices, payment status and billing address. When you pay through an online payment processor, the processor collects your card or bank details directly. We do not store full card numbers.
• Website access: if you keep your own server, the SSH or WordPress access you give us so we can do the work.
• Communications: emails, support requests and your messages in our chat.

2.2 Information collected automatically. When you visit masterweb.ai or use our chat, we and our service providers collect device and usage information, such as IP address, browser type, device type, pages viewed, referring page, approximate location derived from the IP address, and the date and time of your visit. We collect this through server logs, cookies and similar technologies (Section 6).

2.3 Chat conversations. Our chat assistant is an AI assistant, and it tells you so at the start of the conversation. Conversations are recorded. We store the messages you send and the replies you receive, together with the time and technical information about the session.

2.4 Information from other sources.

• Your public website: when you give us your website address, we run an automated check of that site (for example speed, security headers and the technology it uses) and may read its public pages.
• Payment processors: confirmation that a payment succeeded or failed.
• Acceptance records: when you accept our Terms, we record the versions accepted, the consent text, the price and term shown, the time (UTC), your IP address and your browser's user agent.

3. How we use information

We use personal information to:

• answer your questions and talk with you in our chat;
• verify your email address and protect accounts;
• study your current website and prepare designs and proposals;
• provide, host, maintain, secure and support the services you buy;
• bill you, process payments, send payment reminders and manage suspensions and renewals;
• send service, security and billing messages, including usage alerts at 80% and 100% of your chatbot allowance;
• send advertising from the Masterweb group brands, only with your separate consent and with an easy way to opt out (Section 7);
• measure and improve our website, chat and services;
• prevent spam, fraud and abuse, including through anti-bot checks;
• keep records of contracts and consents, comply with law, and enforce our Terms.

4. Artificial intelligence and service providers

4.1 AI providers. Our chat assistant and our Customers' chatbots use third-party large language model (LLM) providers to understand messages and generate replies. We send them the conversation and the business information needed to answer. We use these providers through business services under contracts that limit their use of the data to providing the service to us.

4.2 No model training on your data. We do not use your personal information, our Customers' data or their Visitors' conversations to train AI models, and we do not allow our AI providers to use that data to train their models. If we ever want to do so, we will tell you first and ask for your consent, or for the Customer's instructions where we act as a processor.

4.3 Categories of service providers (subprocessors). We share information with service providers that work for us, only as needed for their service and under confidentiality and security obligations. The categories are:

The current list of service providers is available on request at [email protected].

5. How we share information

5.1 Within the Masterweb group. We may share personal information among the brands of our group, Masterweb Solutions, Masterweb AI, Thryp and Senty, for management, service delivery, support, billing and analytics. The group brands use it only for those purposes. They use it to send you advertising only if you gave the separate, optional consent described in Section 7.2. Visitors' information that we process for a Customer is used only to provide the service to that Customer (Section 1.2).

5.2 Processors only. Other third parties receive personal information only as our processors, such as the hosting, AI and email providers described in Section 4, under a written contract, and only to provide their service to us.

5.3 Limited other cases. We also disclose personal information:

• to the Customer, when we process its Visitors' information for it;
• when required by law, a court order or a lawful government request, or to protect the rights, property or safety of us, our Customers or others;
• in connection with a merger, acquisition or sale of assets, subject to this Privacy Policy;
• at your direction.

5.4 No sale or rental. We never sell or rent personal information to third parties. We use analytics and advertising measurement tools on our own website (Section 6). If a state privacy law treats that use as "sharing" or "targeted advertising" and applies to us, we will offer the opt-out that the law requires.

6. Cookies and analytics

We use cookies, local storage and similar technologies to keep the chat conversation open while you browse, remember your device after you verify your email, protect against abuse, and measure how visitors use our website and whether our ads work. We use analytics and tag management tools (for example, web analytics and advertising conversion tags). You can block or delete cookies in your browser settings. Some parts of the site, such as the chat, may not work properly without them. Where a law that applies to us requires it, we will provide a cookie or tracking opt-out.

7. Emails and text messages

7.1 Transactional emails. We send emails needed to provide the service, such as verification codes, order confirmations, invoices, payment notices, renewal reminders and usage alerts. You cannot opt out of these while you have an account, because they are part of the service.

7.2 Advertising from the Masterweb group brands (optional). We send advertising and offers from Masterweb Solutions, Masterweb AI, Thryp and Senty by email only if you check a separate, optional box (the "marketing consent" in the Consent texts appendix). That box is not pre-checked, is separate from accepting the Terms and this Privacy Policy, and is never a condition of buying. Accepting the Terms does not mean you agree to receive advertising. You can revoke your consent at any time by clicking the unsubscribe link in any email, by replying STOP, or by writing to [email protected]. Our marketing emails follow the CAN-SPAM Act: they have accurate sender information, a clear subject, our physical address, and an unsubscribe link. We honor opt-out requests within 10 business days.

7.3 Text messages and WhatsApp (future). We do not currently send text (SMS) or WhatsApp messages. If we start, each channel will need its own separate consent: email consent does not cover SMS, and SMS consent does not cover WhatsApp. For marketing messages that consent will be prior express written consent, given through its own unchecked box (see the Consent texts appendix), and never a condition of buying. You will be able to stop them at any time by replying STOP, using the opt-out in the message, or writing to [email protected]. We will follow the Telephone Consumer Protection Act and the Florida Telephone Solicitation Act.

8. How long we keep information

9. Security and data breaches

We use reasonable administrative, technical and physical measures to protect personal information. They include encrypted connections (HTTPS), access limited to people who need it, verification codes to access accounts, regular backups, security updates, and monitoring for abuse. No system is completely secure, so we cannot guarantee absolute security.

If a data breach affects your personal information, we will notify you as required by law. Under Florida law (Fla. Stat. 501.171), that notice is given no later than 30 days after we determine that a breach occurred, unless a law enforcement agency asks us to wait, and we notify the Florida Department of Legal Affairs when 500 or more Florida residents are affected. When we act as a processor, we notify the affected Customer so it can meet its own obligations, as described in the DPA.

10. Your choices and rights

You can:

• ask to see the personal information we hold about you;
• ask us to correct it;
• ask us to delete it, subject to records we must keep by law or for our contracts;
• ask for an export of your website and data (Customers);
• unsubscribe from marketing emails at any time.

To make a request, email [email protected]. We will verify your identity before acting on the request, and we will answer within 45 days.

State privacy laws. Some states give residents additional rights, such as the right to know, delete, correct, and opt out of the sale or sharing of personal information. Based on our current size, the comprehensive privacy laws of California and Florida do not apply to us today. When any such law applies, we will honor the rights it gives you, and we will not discriminate against you for using them.

Colombian law. Because we are a Colombian company, you also have the rights described in Section 13.

11. Children

Our services are for businesses and are not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us and we will delete it. Customers must not use our chatbot to collect information from children under 13.

12. Where we process information

We are based in Colombia and serve Customers in the United States. We and our service providers (hosting, AI and email) process personal information in the United States and Colombia. Wherever information is processed, we protect it as described in this Privacy Policy. Section 13.7 describes these international transfers under Colombian law.

13. Colombian data protection law (Ley 1581 de 2012 and Decreto 1377 de 2013)

This section is our personal data processing policy under Colombian Law 1581 of 2012, Decree 1377 of 2013 and related rules (now compiled in Decree 1074 of 2015).

13.1 Data controller (Responsable del Tratamiento). TECNOLOGIA MASTERWEB SAS, NIT 900.947.569-8, operating the Masterweb AI brand. Address: Carrera 64 No. 24-47, Bogota 111321, Colombia. Email: [email protected]. When we process Visitors' information for a Customer, the Customer is the controller and we act as its processor (Encargado del Tratamiento) under the DPA.

13.2 Purposes. We process personal data for the purposes listed in Section 3, for sharing within the Masterweb group described in Section 5.1, and, only with your separate consent, for advertising from the group brands (Section 7.2).

13.3 Authorization. We ask for your prior, express and informed authorization through the required acceptance box (Consent texts appendix, checkbox 1). Advertising needs a separate, optional authorization (checkbox 2). We keep proof of each authorization. We do not ask for sensitive data, and you are never required to answer questions about it. We do not collect data from children.

13.4 Your rights as a data subject. You have the right to:

• know (conocer) the personal data we hold about you and how we use it;
• update (actualizar) your data;
• rectify (rectificar) data that is inaccurate, incomplete or misleading;
• delete (suprimir) your data when it is no longer needed or is processed against the law;
• revoke (revocar) your authorization;
• ask for proof of the authorization you gave us;
• access your data free of charge;
• file a complaint with the Superintendencia de Industria y Comercio (SIC), the Colombian data protection authority (www.sic.gov.co), after first using our consultation or claim procedure.

Deletion or revocation does not apply while you have a legal or contractual duty that requires us to keep the data (for example, billing records or an active service contract).

13.5 How to exercise your rights. Write to [email protected] with your name, how to contact you, and your request. Our customer support area is responsible for answering. We answer consultations (questions about your data) within 10 business days, extendable once by 5 business days with notice. We answer claims (requests to correct, update or delete data, or to revoke authorization) within 15 business days, extendable once by 8 business days with notice. If a claim is incomplete, we ask you to complete it within 5 business days; if you do not complete it within 2 months, we consider it withdrawn.

13.6 Validity. Our databases remain in force for as long as needed for the purposes above and the retention periods in Section 8.

13.7 International transfers and transmissions. By giving the authorization in checkbox 1, you authorize us to transmit your personal data to our processors located in the United States (hosting, AI and email providers), so they can provide their services to us under contract. Those processors must protect the data and process it only under our instructions. Data of Customers and their contacts located in the United States is also processed in Colombia by our team to provide the service.

14. Changes to this Privacy Policy

We may update this Privacy Policy. We will post the new version with a new version number and effective date. If the changes are material, we will notify Customers by email before they take effect.

15. Contact

TECNOLOGIA MASTERWEB SAS (NIT 900.947.569-8), operating the Masterweb AI brand Carrera 64 No. 24-47, Bogota 111321, Colombia Email: [email protected]

---

Appendix: Consent texts

These are the exact texts of the boxes shown at checkout, on our website and in our chat. Rules for every box:

• each box is shown separately, is never pre-checked, and is a real control (not text the user types);
• the words "Terms of Service" and "Privacy Policy" are visible links placed next to the box;
• checkbox 1 is required to buy; checkbox 2 and the future SMS and WhatsApp boxes are optional and never required to buy;
• for each box we record the version of the text, the exact text shown, the date and time (UTC), the IP address and the browser's user agent.