Personal Data Management Policy

This policy explains how Prontto collects, uses, shares and protects personal data when you visit prontto.co, use the Prontto planner and its apps, start a design through an AI assistant, connect an assistant or the API to your account, buy a plan, talk to us, or hire Prontto Studio, our design service. It also covers the employees, job candidates, suppliers and shareholders of PRONTTO S.A.S.

It is issued under Colombia’s personal data protection law, Ley 1581 de 2012, and its regulations (Decreto 1377 de 2013, now part of Decreto 1074 de 2015). We apply it to everyone who uses Prontto, wherever they are.

In short:

• Two companies are responsible for your data: PRONTTO LLC for Prontto (the planner, accounts, plans, the website, the API and the MCP server) and PRONTTO S.A.S. for Prontto Studio and for its own staff, suppliers and shareholders. “Who is responsible for your data” explains which applies when.
• We collect what you give us (such as your account details, rooms, measurements, photographs and designs), what your use of Prontto generates (such as device and usage data), and what others give us about you (such as a professional who adds you to a quote).
• We use it to provide Prontto, bill you, support you, keep Prontto secure, improve it and develop its AI features, including training our AI models, and, as described below, to market Prontto and measure our advertising.
• We never sell your personal data. We share it with the providers that help us run Prontto, with the people and businesses you choose to work with, and when the law requires it.
• PRONTTO LLC and many of our providers are in the United States, so your data is processed outside Colombia with the safeguards described in “International transfers”.
• You can know, update, correct and delete your data, ask how we have used it and revoke your authorization by writing to legal@prontto.co. “How to exercise your rights” explains how.

When Prontto processes data on behalf of a professional or business that uses it, such as the details of that business’s own customers, the business decides how that data is used, as “When we process data for our customers” explains.

Two companies are responsible for the personal data described in this policy (each a data controller, “responsable del tratamiento”). Both can be reached at legal@prontto.co.

PRONTTO LLC, based in Miami Lakes, Florida, United States:

• Address: 7950 NW 155th Street, Suite 105, Miami Lakes, FL 33016
• Email: legal@prontto.co
• Website: https://www.prontto.co

PRONTTO LLC is responsible for the data processed in Prontto: the website prontto.co and its subdomains, the planner and its apps, accounts and plans, designs started with or without an account, the API and the MCP server, billing for plans and add-ons, support, marketing and advertising, and the product improvement recordings.

PRONTTO S.A.S., a Colombian company:

• N.I.T.: 901.473.141-8
• Address: Carrera 44 No. 88-40, Barranquilla, Colombia
• Email: legal@prontto.co
• Telephone: +57 301 770 5458

PRONTTO S.A.S. is responsible for the data of Prontto Studio clients and their projects, and for the data of its own employees, job candidates, suppliers, contractors and shareholders.

Which one applies. If you visit the website, use the planner (with or without an account, or embedded on a business’s website) or connect an AI assistant or the API, PRONTTO LLC is responsible. If you hire Prontto Studio, PRONTTO S.A.S. is responsible for your Studio project, while your Prontto account, if you have one, stays with PRONTTO LLC. If you work for, apply to, supply or hold shares in PRONTTO S.A.S., PRONTTO S.A.S. is responsible.

The two companies share personal data with each other only as these purposes require, for example when a Studio project is produced in the planner, and when one of them does work for the other it acts as its processor. In this policy, “Prontto”, “we” and “us” mean whichever of the two companies is responsible for the data concerned.

These terms have the meaning that Ley 1581 de 2012 and its regulations give them:

• Personal data: any information linked, or that can be associated, with one or more identified or identifiable natural persons.
• Data subject (titular): the natural person whose personal data is processed.
• Processing (tratamiento): any operation on personal data, such as its collection, storage, use, circulation or deletion.
• Controller (responsable del tratamiento): the person or company that decides on the database and on the processing of the data.
• Processor (encargado del tratamiento): the person or company that processes personal data on behalf of the controller.
• Authorization: the prior, express and informed consent of the data subject for the processing of their personal data.
• Sensitive data: data that affects the privacy of the data subject or whose misuse may lead to discrimination, such as data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, membership of trade unions or of social or human rights organisations, health, sex life and biometric data.
• Transfer: sending personal data to a recipient that is itself a controller, inside or outside Colombia.
• Transmission: communicating personal data to a processor, inside or outside Colombia, so that it processes the data on behalf of the controller.

What we collect depends on how you use Prontto.

Visitors to the website. Device and browser information, your IP address and the approximate location derived from it, the pages you view, how you reached us (for example, from an ad or a search) and the choices you make in the cookie notice. If you fill in a form or subscribe to news, the name, email, phone number, company and message you give us.

Designs started without an account. You can start a design without an account, including from a link or through our public MCP server used by an AI assistant (such as ChatGPT or Claude). We store the room and the brief that you or the assistant enter, such as the room type, sizes, style and preferences, together with technical identifiers of the session. These links and requests are not meant to contain your name, email or other personal details; if you include them anyway, we protect them under this policy.

Account holders. Your name, email, phone number, company, role, country, language and profile picture, and the details of your plan. Your password is handled by our authentication provider: we never see it or store it in readable form. If you sign in with Google or Microsoft, we receive your name, email and profile picture from that provider.

Your content. The rooms, measurements, designs, photographs, plans, documents, logos and catalogue information you upload or create; your prompts and messages to the assistant; renders and other outputs; quotes, presentations and comments; and the people you share with.

Payments and billing. Your billing name and address, tax identification (NIT or identity number) and tax details, the plans and add-ons you buy and your payment history. Payments are handled by payment processors (such as Stripe and, in Colombia, Wompi). We receive confirmation of each payment and limited card details, such as the card brand, the last four digits and the expiry date, but we never receive or store full card numbers.

Communications, support and booked calls. The messages you send us by email, chat or form; the details of the calls you book through our scheduling tool (such as your name, email, the time and the answers you give when booking); and the notes we take of those conversations.

Customers of professionals. When a professional or business uses Prontto to design, quote or collaborate with its own customers, it may add those customers’ names, emails, phone numbers, addresses and project details, and the customers may review, approve, sign or pay a quote in Prontto.

Leads from the planner on a business’s website. When you use the planner embedded on the website of a Business or Enterprise customer, the designs and contact details you send (such as your name, email, phone number and message) go to that business.

AI assistants, the API and the MCP server. When you connect an AI assistant or an API client to your account, we record the connection, the client, the requests it makes, the actions it takes and the content it sends and receives. Requests to our public MCP server are recorded with technical details such as the time, the client and the parameters sent.

Device, usage and log data. IP address, device and browser type, operating system, language, the pages and features you use, the actions you take in the planner, timestamps, errors, performance data and security logs.

Cookies and similar technologies. See “Cookies, analytics and advertising” below and our Cookie Policy.

Prontto Studio clients. The contact and billing details of the client and its team, the project materials they send (plans, measurements, photographs, product and brand information), their briefs, feedback and approvals, and the deliverables we produce.

Employees, candidates, suppliers and shareholders of PRONTTO S.A.S. Identification and contact details; for candidates, their CV and the notes of the selection process; for employees, the data needed for the employment relationship and for payroll, social security and tax obligations, including bank details and affiliations to health, pension, severance and occupational risk entities; for suppliers and contractors, the data in their tax registration (RUT), certificate of existence and legal representation and bank certificate; and for shareholders, the data needed for the share register, shareholder meetings and legal reporting.

We collect data directly from you, automatically as you use Prontto, and from third parties: sign-in providers, payment processors, the professional or business that adds you to Prontto, the AI assistants you connect, analytics and advertising partners (for example, which campaign brought you to us) and public sources such as company registers.

We process personal data for these purposes:

• Providing the planner and the plans: creating and saving designs; showing catalogues and estimated prices; producing drawings, presentations and renders; running the assistant; real-time collaboration, sharing, quotes and the planner on business websites; and connecting AI assistants, the API and the MCP server.
• Accounts and billing: creating and securing accounts; managing plans, trials, renewals and credits; processing payments and refunds; issuing invoices, including the electronic invoice the DIAN requires for customers in Colombia; and keeping accounting and tax records.
• Support: answering questions, requests and complaints, holding the calls you book, and sending service messages such as receipts, security alerts and notices of changes to our terms.
• Security and fraud prevention: authenticating users; detecting and preventing fraud, abuse, spam and security incidents; enforcing our Terms of Service; and protecting our users and Prontto.
• Analytics and product improvement: understanding how Prontto is used, measuring performance, fixing errors, testing and developing new features and catalogues, and the product improvement recordings described below.
• AI features, including training: running Prontto’s AI features and developing, training and improving its AI models and features, as “AI features and model training” explains.
• Marketing: sending news, guides, offers and invitations about Prontto by email or message when you have agreed to receive them or, where the law allows it, to customers about services similar to those they use. Every marketing email includes a way to unsubscribe, and you can opt out at any time by writing to legal@prontto.co.
• Advertising measurement: measuring which ads and campaigns bring visitors and sign-ups, and showing relevant ads, through Google Analytics, Google Ads and Meta, according to the cookie rules in “Cookies, analytics and advertising”.
• Legal obligations: meeting tax, accounting, commercial and consumer protection obligations; answering requests from competent authorities; and establishing, exercising or defending legal claims.
• Prontto Studio (PRONTTO S.A.S.): scoping, producing, reviewing and delivering Studio projects, managing the client relationship and its billing, and, only with the client’s permission, showing deliverables in our portfolio.
• Employees, candidates, suppliers and shareholders (PRONTTO S.A.S.): running selection processes; managing the employment relationship, payroll, social security, occupational health and safety and the related legal obligations; contracting and paying suppliers and contractors and carrying out the due diligence the law requires; and keeping the share register, calling and holding shareholder meetings, and reporting to authorities such as the DIAN and the Superintendencia de Sociedades.

We will not use personal data for a purpose incompatible with these without telling you first and, where the law requires it, obtaining your authorization.

Prontto’s AI features, such as the assistant and Instant Render, process the content you give them (your room, measurements, photographs, designs and prompts) to produce their results. Some of these features run on models from third-party AI providers, which process that content on our behalf to provide the feature.

Training and improvement. Prontto may use the content, designs and usage data generated in the Service to develop, train and improve its AI models and features, for example so that the assistant places pieces better, reads rooms more accurately or produces more faithful renders. Where practicable, we de-identify or aggregate the data first, removing names, contact details and other information that identifies you. The product improvement recordings are not used for this.

We never publish your designs, or show them to other users as examples, without your permission.

An Enterprise contract may agree different rules on the use of the customer’s content for training. Data that Prontto processes on behalf of a professional or business is used for training only in de-identified or aggregated form, as “When we process data for our customers” explains.

You may revoke your authorization for this purpose, as for any other, as “Deletion and revocation of authorization” explains. Revocation applies from then on and does not undo models already trained.

prontto.co and its subdomains, including the app, use cookies and similar technologies. Some are essential: they keep you signed in, remember your language, protect forms and make the site and the app work, so they are always on. Others are for analytics and advertising: Google Analytics (through Google Tag Manager), Google Ads and the Meta pixel, which help us understand how visitors use Prontto and measure our ads. We also use cookieless analytics from our hosting provider to count page visits.

How the cookie notice works:

• In the European Economic Area, the United Kingdom and Switzerland, analytics and advertising cookies stay off until you allow them in the cookie notice. Until then, Google’s tags send only limited signals without cookies, and the Meta pixel does not load.
• Everywhere else, analytics and advertising cookies run from your first visit, and you can turn them off at any time by choosing Decline in the cookie notice.
• If your browser sends a Global Privacy Control signal, advertising cookies are off by default. Analytics still measures your visit unless you choose Decline.
• Your choice is saved in a cookie on prontto.co and shared with its subdomains, such as the app, so that you are not asked again on each of them. It is kept for up to 180 days.

You can also block or delete cookies in your browser settings; if you delete the cookies of prontto.co, the notice will ask for your choice again. Google and Meta process the data their tags collect under their own privacy policies.

Our Cookie Policy gives more detail.

When you create a self-serve account, PRONTTO LLC records two short portions of your use of the Prontto app: about 20 seconds from your first visit to the app, and about 20 seconds from the first time you open the planner. A recording captures clicks, pointer and touch movements, scrolling, the layout and text shown on screen, low-resolution images of the 3D view, and the changes you make to your design.

Anything you type into a field is hidden on your device before the recording is sent, so it is never recorded.

We don’t make these recordings if you chose Decline in our cookie notice, or if you use Prontto from the European Economic Area, the United Kingdom or Switzerland.

We use these recordings only to understand how people use Prontto and to improve it. PRONTTO LLC stores them on the infrastructure it uses to run Prontto; only the Prontto team can view them; they are not sold or shared with third parties; and they are deleted automatically 30 days after they are made.

You can ask us to delete your recordings at any time by writing to legal@prontto.co, or through any of the channels listed under “How to exercise your rights”.

Professionals and businesses use Prontto to work with their own customers. In these cases Prontto processes personal data on their behalf, as a processor (encargado del tratamiento), and the professional or business is the controller:

• Customers of professionals: the data that a professional on a Pro, Business or Enterprise plan adds about its customers, and the data those customers enter when they review, approve, sign or pay a quote.
• Leads from the embedded planner: the designs and contact details that visitors send through the planner embedded on a Business or Enterprise customer’s website.
• Workspace content: the content that team members create in a Business or Enterprise workspace, which the organisation that holds the plan controls.

The professional or business decides why and how that data is used. As our Terms of Service require, it must have the authorization or other lawful basis the law requires and must inform its customers and visitors. We process that data only to provide the Service to the professional or business and according to its instructions, keep it confidential and secure, do not use it for our own marketing, and use it to improve Prontto or train AI models only in de-identified or aggregated form.

If you are one of those customers or visitors and want to exercise your rights, contact the professional or business first. If you write to us, we will pass your request on to it and help it answer. If you create your own Prontto account, PRONTTO LLC is the controller of your account data.

We do not sell personal data. We share it only as follows:

• Service providers (processors) that help us run Prontto, under terms that require them to process the data only on our instructions and to protect it. By category: hosting and infrastructure (servers, content delivery and file storage); database; authentication and sign-in; payments; email and messaging; analytics and advertising; AI model providers that run parts of the assistant and Instant Render; scheduling of calls; and support and productivity tools.
• The professional or business you work with. When you use the planner on a business’s website, receive or accept a quote, or join a workspace, the data you send goes to that professional or business, which uses it under its own privacy policy.
• The people you choose: those you share a design with, invite to collaborate or send a link to.
• Makers and catalogue owners, when you ask. If you request a quote, a contact or an order from a maker or from the owner of a catalogue, we send it your request and the details it needs to answer.
• Between PRONTTO LLC and PRONTTO S.A.S., as “Who is responsible for your data” explains.
• Advertising partners. Google and Meta receive data through their tags according to your cookie choices, and act under their own policies for it.
• Legal requirements: when the law, a court order or a competent authority requires it, or when it is needed to establish, exercise or defend legal claims or to protect the rights, safety and property of our users, Prontto or others.
• Business transfers: if Prontto takes part in a merger, acquisition, financing, reorganisation or sale of assets, personal data may pass to the acquirer or the resulting company, which must respect this policy. We will tell you if that happens.

We may also share aggregated or de-identified information that does not identify anyone, such as usage statistics.

PRONTTO LLC is in the United States, and many of our providers are in the United States and other countries. Your personal data is therefore transferred or transmitted to countries other than the one where you live, which may have different data protection rules.

For data collected in Colombia, we do this on the bases that article 26 of Ley 1581 de 2012 and its regulations allow:

• Most of these destinations, including the United States, are on the list of countries that the Superintendencia de Industria y Comercio (SIC) considers to provide an adequate level of protection.
• Where a destination is not on that list, the transfer is necessary to perform the contract between you and Prontto, such as providing the Service you signed up for, or you have given your express authorization for it by accepting this policy.
• Transmissions to processors abroad are covered by data transmission contracts or data processing terms with the content required by article 25 of Decreto 1377 de 2013 (now in Decreto 1074 de 2015), which oblige the processor to process the data only on our behalf, under this policy, and to keep it secure.

Wherever your data is processed, this policy continues to protect it and you keep the same rights.

We keep personal data only as long as the purposes for which it was collected require, and then for the time the law requires or allows. In particular:

• Account data and content: while your account is open. When you close it, we delete or anonymise your content and account data within a reasonable time, except what we must keep for the reasons below. Copies in backups are deleted as the backups expire.
• Designs started without an account: while they are needed for you to continue and save the design. Designs never saved to an account are deleted periodically.
• Billing, invoices and accounting records: for the period tax and commercial law requires, which in Colombia is generally ten (10) years.
• Product improvement recordings: deleted automatically 30 days after they are made.
• Your cookie choice: up to 180 days. Other cookies: for the periods the Cookie Policy and the cookie notice set out.
• Security and system logs: for a limited period, and longer when they are needed to investigate an incident.
• Marketing: until you unsubscribe or ask us to stop. We then keep only your email on a suppression list, so that we do not write to you again.
• Data processed for a professional or business: as it instructs, and while its plan is active.
• Prontto Studio clients, suppliers, contractors and shareholders (PRONTTO S.A.S.): during the commercial, contractual or corporate relationship and for ten (10) more years.
• Employees (PRONTTO S.A.S.): during the employment relationship and for twenty (20) more years.
• Candidates who are not hired (PRONTTO S.A.S.): for the time needed to complete the selection process and, if they authorize it, to consider them for future openings.

In every case, data may be kept longer while it is needed to comply with a legal obligation, answer an authority or defend a legal claim.

As a data subject, article 8 of Ley 1581 de 2012 gives you the right to:

1. Know, update and rectify your personal data, including data that is partial, inaccurate, incomplete, fragmented or misleading, or whose processing is prohibited or has not been authorized.
2. Request proof of the authorization you gave, except where the law does not require authorization (article 10 of Ley 1581 de 2012).
3. Be informed, on request, of how your personal data has been used.
4. File complaints with the Superintendencia de Industria y Comercio (SIC) for breaches of the law, after first submitting your consultation or claim to us.
5. Revoke your authorization and/or request the deletion of your data, as “Deletion and revocation of authorization” explains.
6. Access your personal data free of charge, at least once every calendar month and whenever this policy changes substantially in a way that leads to new consultations.

These rights may be exercised by you, by your successors (causahabientes), by your representative or attorney, or by someone acting on your behalf by stipulation in your favour.

If you are outside Colombia, you also have the rights your local law gives you, such as the rights of access, correction, deletion, portability, objection and restriction in the European Union or the United Kingdom, or the right to opt out of targeted advertising in some states of the United States. We handle those requests through the same channels and procedure, within the time limits your law sets where they are shorter.

We will not treat you differently for exercising your rights.

You can submit consultations, requests and claims to know, update, rectify or delete your data or to revoke your authorization through any of these channels:

You can address a request to PRONTTO LLC or PRONTTO S.A.S. through any of these channels; if it concerns the other company, we will pass it on. Requests received outside business hours are treated as received on the next business day.

Your request, in writing on paper or electronically, should include:

• the full name of the data subject and, where applicable, of their representative or attorney;
• the type and number of the applicant’s identity document;
• the email or postal address where you will receive the answer, and a telephone number;
• what you are asking for and the reasons for it;
• a copy of the identity document of the data subject and, where applicable, of their representative or attorney;
• where applicable, the document that proves the representation;
• the signature of the applicant or representative, where applicable.

We may ask for additional information to verify your identity before answering. When you write from the email address of your Prontto account about that account, we may accept that email as evidence of your identity.

You or your successors can consult the personal data we hold about you. We will answer within ten (10) business days from the day after we receive the consultation. If we cannot answer within that term, we will tell you why before it ends and give you a new date, which will be no more than five (5) business days after the first term expires.

If you or your successors consider that information in our databases should be corrected, updated or deleted, or notice an alleged breach of any of the duties in Ley 1581 de 2012, you can submit a claim through the channels above.

• If the claim is incomplete, we will ask you, within five (5) days of receiving it, to correct it. If two (2) months pass from that request without you providing the missing information, we will consider that you have abandoned the claim.
• If we are not competent to resolve the claim, we will pass it on to whoever is within two (2) business days and tell you.
• Within two (2) business days of receiving a complete claim, we will add to the database the legend “reclamo en trámite” (claim in process) and the reason for the claim. It will remain until the claim is decided.
• We will resolve the claim within fifteen (15) business days from the day after we receive it. If we cannot do so within that term, we will tell you why and the date on which we will resolve it, which will be no more than eight (8) business days after the first term expires.

Once you have completed this consultation or claim procedure with us, you may file a complaint with the Superintendencia de Industria y Comercio (www.sic.gov.co).

You may at any time ask us to delete your personal data or revoke your authorization, in whole or only for certain purposes (for example, marketing or AI training), by submitting a claim as described above.

We will not be able to delete data or stop processing it when you have a legal or contractual duty to remain in the database, or when:

• deleting it would hinder judicial or administrative proceedings related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions;
• the data is needed to protect your legally protected interests, to carry out an action in the public interest, or to comply with an obligation you have legally acquired.

If processing the data is necessary to provide a service you are using, deleting it or revoking your authorization may mean that we can no longer provide that service, and we will tell you. Revocation does not affect processing carried out before it. If we do not delete the data or stop the processing when we should, the SIC may order it.

We ask for your authorization no later than when we collect your data, and we keep evidence of it so that it can be consulted later:

• When you create an account, you accept our Terms of Service and this policy. We record the date, the time, the version accepted and the account.
• When you send a form, book a call or subscribe to news, you authorize the processing through the notice on that form.
• For analytics and advertising cookies, through the cookie notice, as described above. We keep a record of your choice.
• For Prontto Studio, suppliers, contractors, employees and candidates, in the contract, order form or written authorization they sign.

As article 7 of Decreto 1377 de 2013 provides, authorization may be given in writing, orally or through unequivocal conduct that allows us to conclude reasonably that it was given, such as continuing to use the planner after being informed of this policy.

Authorization is not required for data of a public nature, data requested by a public or administrative authority in the exercise of its functions or by court order, medical or health emergencies, processing authorized by law for historical, statistical or scientific purposes, or data related to the Civil Registry of persons (article 10 of Ley 1581 de 2012).

Prontto and Prontto Studio are not intended for people under eighteen (18), and we do not knowingly collect their data. If we learn that we have collected a minor’s data without the required authorization, we will delete it.

When processing the data of children or adolescents is unavoidable, for example the children of an employee of PRONTTO S.A.S. who are beneficiaries of social security, we do so only as article 7 of Ley 1581 de 2012 and article 12 of Decreto 1377 de 2013 allow: in a way that responds to and respects their best interests and fundamental rights, with the authorization of their legal representative, and taking into account the minor’s opinion according to their maturity.

We do not ask for sensitive data to use Prontto, and we ask you not to include it in your designs, uploads, prompts or messages. Photographs of rooms should not show people.

If we ever need sensitive data, for example an employee’s health data for occupational health and safety obligations, we will tell you which data is sensitive and what it is for, that you are not obliged to provide it, and we will ask for your express authorization, as article 6 of Ley 1581 de 2012 and article 6 of Decreto 1377 de 2013 require. No activity will be conditional on your providing sensitive data.

We apply technical, human and administrative measures to protect personal data against loss, unauthorized access or use, alteration and disclosure. Among them: encryption of data in transit, access controls limited to the people who need the data for their work, sign-in handled by a specialised authentication provider, activity and security logs, backups, the selection of providers with adequate security, and confidentiality obligations for our team and our providers.

No system is completely secure. If a security incident affects your personal data, we will act to contain it, inform the SIC as the law requires and tell you when it may affect you. Keep your password and sign-in methods safe and tell us at once at legal@prontto.co if you think your account has been compromised.

We may update this policy when Prontto, its providers or the law change. The date at the top of this page shows when the current version took effect.

When a change is substantial, in particular when it concerns the identity of the controller or the purposes of the processing, we will publish the new text on https://www.prontto.co at least ten (10) business days before it takes effect and tell account holders by email or in the app. If a change to the purposes requires a new authorization, we will ask for it before applying it to you. Other changes take effect when they are published.

This policy was issued on 26 January 2024, and the current version is effective from 10 November 2026.

• 26 January 2024: first version.
• 10 November 2026: the section Product improvement recordings was added.
• 10 November 2026: full update. The policy now covers the Prontto planner, its plans, AI features, API and MCP server; names PRONTTO LLC and PRONTTO S.A.S. as controllers and says when each applies; and updates their addresses.

The databases covered by this policy will remain in force for as long as the purposes described in it require.