Scope of this document. These Terms and this Privacy Policy govern RC Studio’s professional services and the AI-assisted WhatsApp Business support channel described in Section 12. They do not apply to WhatsApp Coexistence — the Coexistence for WhatsApp and WhatsApp Coexistence API modules for Odoo, the Tech Provider connection service and the licence portal — which are a separate application, use no Artificial Intelligence of any kind, and are governed by their own policy, published in the “Privacy Policy — WhatsApp Coexistence” section of this same page.

1. General information

Welcome to RC Studio, professional services in software development, automation and digital communication solutions. Our services include, among others, the development and implementation of solutions on Odoo, process automation with n8n, mobile and web application development, integration with third-party APIs, and the implementation of communication channels assisted by Artificial Intelligence systems on the WhatsApp Business Platform.

By accessing or using our services, website, applications, or messaging channels enabled by RC Studio, you accept these Terms of Service and our Privacy Policy. If you contact us through WhatsApp, the specific conditions described in Section 12 of this document also apply to you.

2. Data controller

The controller of the personal data collected through RC Studio's website, applications and messaging channels is:

Ricardo Colonia — RC Studio

Email: dev@rcstudio.dev

Website: https://rcstudio.dev

Address: Colombia.

3. Use of the services

Use of RC Studio's website, applications and messaging channels is permitted only to persons of legal age. By registering, writing to us on WhatsApp, contracting our services or using our solutions, you warrant that the information you provide is truthful, current and complete, and that you have the legal capacity to be bound by these Terms.

It is prohibited to use our services for unlawful, fraudulent or offensive purposes, for purposes that infringe intellectual or industrial property rights, that violate the rights of third parties, or that contravene applicable Colombian and international regulations. RC Studio may suspend or terminate access to its services when it detects misuse of them.

4. Services provided

RC Studio offers, among others, the following services:

•       Development, configuration, maintenance and support of solutions on Odoo (versions 17, 18 and 19, and other current versions).

•       Design and implementation of automation workflows with n8n and equivalent tools.

•       Development of mobile applications (Android, Kotlin, Flutter) and custom software.

•       Integration with third-party APIs, including messaging platforms, payment gateways, electronic invoicing services and Artificial Intelligence providers.

•       Implementation, operation and support of the WhatsApp Business communication channel with Artificial Intelligence assistance, as described in Section 12.

•       Technical consulting, support and maintenance of the infrastructure associated with the products delivered.

The specific scope, deliverables, timelines and consideration for each service will be agreed in commercial proposals, service orders or separate contracts, which shall prevail over these Terms in the event of a discrepancy on specific technical or commercial matters.

5. Collection and use of personal data

RC Studio may collect and process the following personal data:

•       Full name and, where applicable, company name and tax ID (NIT).

•       Email address.

•       Telephone number, including the WhatsApp number when you contact us through that channel.

•       Professional or business contact data (job title, company, industry).

•       The content of the messages you send us through WhatsApp, including text, images, audio (voice notes), video, documents and stickers.

•       Metadata associated with the conversations (message date and time, message and WhatsApp account identifiers, profile name displayed on WhatsApp).

•       Technical data required to provide the contracted service (access credentials to the customer's systems voluntarily provided, instance identifiers, configurations), which are processed under the confidentiality commitments described in Section 8.

•       Browsing and usage information relating to the site or the applications (cookies and equivalent technologies, pursuant to Section 11).

This data is collected for the following purposes:

•       Provision, performance and invoicing of the contracted service.

•       Management of user accounts and of the commercial relationship.

•       Customer service, technical support and responses to your enquiries, including those received through WhatsApp.

•       Sending operational and service notifications (maintenance notices, version changes, security incidents).

•       Compliance with legal, accounting and tax obligations.

•       Improvement of the user experience and of service quality.

6. Use of data for advertising and marketing

The data of registered customers may be used by RC Studio for advertising and marketing purposes on social networks and digital platforms, such as Facebook Ads, Instagram Ads, Google Ads and LinkedIn Ads, among others, solely in connection with RC Studio's own products or services. This includes, without limitation, interest-based personalised campaigns, audience segmentation and the communication of offers, launches and promotions.

Important: the content of your WhatsApp messages (text, audio, images, video, documents) is not used for advertising or marketing purposes, nor is it shared with advertising platforms. Its processing is governed specifically by the conditions in Section 12.

You may withdraw your consent for advertising and marketing at any time by sending an email to dev@rcstudio.dev requesting the deletion or restriction of this processing, without this affecting the provision of the contracted services.

7. Rights of data subjects

Pursuant to Law 1581 of 2012, Decree 1377 of 2013 and other related regulations of the Republic of Colombia, data subjects have the right to:

•       Access, update and rectify their personal data.

•       Request proof of the authorisation granted for the processing.

•       Be informed, upon request, of the use made of their data.

•       File complaints with the Superintendence of Industry and Commerce (SIC) for breaches of the applicable regulations.

•       Withdraw the authorisation and/or request the complete deletion (right to be forgotten) of their data, including the full history of messages exchanged over WhatsApp, voice-note transcriptions, files sent and any information the system has derived from the conversation.

•       Access free of charge the personal data concerning them that has been processed.

To exercise these rights, you may send a request to dev@rcstudio.dev stating the telephone number associated with your WhatsApp account and/or the email address you registered with. Access requests will be handled within a maximum of ten (10) business days; complaints and deletion requests within a maximum of fifteen (15) business days, pursuant to articles 14 and 15 of Law 1581 of 2012. Confirmation will be sent by the same means.

8. Confidentiality of customer information

In providing software development, automation and digital solution services, RC Studio may have access to confidential customer information, including, without limitation, source code, databases, credentials, business models, end-customer lists, internal process diagrams and other strategic information.

RC Studio undertakes to:

•       Treat such information with strict confidentiality and use it exclusively to provide the contracted services.

•       Not disclose, assign, sell or communicate the customer's confidential information to third parties without prior authorisation, except at the request of a competent authority.

•       Implement reasonable technical and organisational measures to protect the confidential information.

•       Securely return or delete the confidential information at the end of the contractual relationship, when the customer so requests and provided there is no legal retention obligation.

This confidentiality obligation survives for a period of five (5) years from the termination of the contractual relationship, or for the longer period required by the nature of the information or by law.

9. Intellectual property

Unless expressly agreed otherwise in the applicable commercial proposal or contract:

•       The customer retains ownership of its information, data, content, trademarks and pre-existing materials contributed for the performance of the service.

•       Custom developments (source code, specific configurations, custom modules) delivered to the customer and actually paid for will be assigned to the customer in accordance with the terms agreed contractually.

•       RC Studio retains ownership of its tools, libraries, internal frameworks, templates, prior knowledge (know-how) and reusable generic solutions that do not constitute custom development specific to the customer.

•       Third-party modules and solutions incorporated (for example, Odoo Community, open source modules, libraries) are governed by their own licences, which will be fully respected.

10. Data retention and security

RC Studio implements reasonable technical, human and administrative measures to protect stored personal data against unauthorised access, loss or alteration, including:

•       Encryption in transit (HTTPS / TLS) for all communications.

•       Symmetric encryption at rest (AES-128 + HMAC) for stored access tokens and sensitive credentials.

•       Restricted access control to the administration panel by means of credentials and a signed session.

•       Isolation of the database and internal services within a private network.

•       Auditable logging of administrative operations.

•       Server hardening, security update management and event monitoring.

Retention periods

•       Messages and media exchanged over WhatsApp: for as long as necessary to provide the service, handle enquiries and comply with legal obligations (typically up to two (2) years), unless you request early deletion or the law requires a different period.

•       Billing data and accounting obligations: for the period required by applicable tax regulations (a minimum of five (5) years in Colombia, pursuant to the Tax Code).

•       Technical project information (repositories, backups, configurations): for the term of the contract and up to two (2) years after its termination, unless the customer requests early deletion.

Once the period has elapsed or a deletion request has been handled, the data is securely erased both from the database and from the files on disk.

11. Changes

RC Studio reserves the right to modify these Terms and Policies at any time. Changes will be notified through visible means on the website, the applications or, where appropriate, by email. Substantial changes affecting the processing of your WhatsApp messages will be notified to you through the same channel at least fifteen (15) days before they take effect.

Continued use of the services after the changes take effect will constitute tacit acceptance of them. If you do not agree with the modifications, you may request the deletion of your data and the termination of the relationship pursuant to Sections 7 and 12.

12. Communication through WhatsApp Business and AI assistant

This section specifically governs the use of the WhatsApp Business channel operated by RC Studio. It applies only when you contact us through that medium or agree that we may contact you through it.

12.1. About the channel

RC Studio uses Meta Platforms, Inc.'s WhatsApp Business Platform (Cloud API) to manage customer service and the provision of some services. The channel complies with the WhatsApp Business Solution Terms, the WhatsApp Messaging Policy and the WhatsApp Commerce Policy published by Meta, which additionally apply to the use of the channel.

12.2. Consent (opt-in)

By starting a conversation with RC Studio on WhatsApp, by requesting to be contacted through that medium (web form, social networks, telephone call, email, event), or by replying to a template message approved by Meta, you expressly authorise RC Studio to:

•       Receive and process the messages you send us.

•       Reply to you through the same channel.

•       Process the content of your messages by means of Artificial Intelligence systems under the conditions described in this Section.

•       Retain the content of the conversation as described in Section 10.

12.3. Artificial Intelligence assistance in drafting

RC Studio operates an AI assistant for drafting and managing communication through WhatsApp Business. The replies sent to the customer are drafted and approved by RC Studio's human staff. The following processes may be supported by Artificial Intelligence systems:

•       Internal summarisation of the content of your messages, so that the operator can respond faster and with better context.

•       Improvement of the tone, wording, spelling and clarity of the drafts written by the operator before they are sent to the customer.

•       Speech-to-text transcription of the voice notes you send us, including language detection.

•       Suggestion of frequent replies based on the history of similar conversations.

•       Operational memory: a structured record of specific data you share with us (for example: your email address, the devices you use, installed software, Odoo version, contact preferences) so that we do not have to ask you for them again in later conversations.

Every message that goes out to the customer is manually reviewed and approved by a member of the RC Studio team before being sent. The AI does not send messages autonomously, other than automated acknowledgement messages (for example, the welcome greeting confirming that we received your message), which are sent within the 24-hour window allowed by WhatsApp and are always identifiable as operational service messages.

12.4. AI sub-processors

For the functions described in Section 12.3, the content of the messages may be processed by the following AI providers engaged by RC Studio, which act as sub-processors under our instructions and under data processing agreements:

 

Provider	Purpose	Home country
Anthropic, PBC	Summarisation and drafting improvement (Claude)	USA
OpenAI, OpCo, LLC	Summarisation, drafting improvement and audio transcription (Whisper)	USA
Google LLC	Summarisation and drafting improvement (Gemini), where used	USA
Soniox, Inc.	Audio transcription	USA

 

RC Studio may update this list. The current version will always be available on request at the contact email address.

Explicit commitment: these providers work under commercial contracts that prohibit the use of the content of your messages to train, develop or improve their AI models. Nor does RC Studio use such content to train its own models or transfer it to third parties for purposes other than providing the service.

Since some sub-processors are based outside Colombia, you expressly authorise the international transfer of your personal data to those countries, under the terms of article 26 of Law 1581 of 2012 and subject to the contractual safeguards described.

12.5. Compliance with Meta / WhatsApp policies

RC Studio undertakes to operate the WhatsApp Business channel in compliance with:

•       The 24-hour customer service window: outside that period, messages will be sent only through templates (HSM) previously approved by Meta for transactional or service purposes.

•       The prohibition on using the channel to send content in categories restricted by WhatsApp's Commerce Policy (weapons, controlled substances, real-money gambling, adult products, multi-level marketing schemes, predatory loans, among others).

•       The prohibition on using service data to build or enrich advertising profiles of individual WhatsApp users.

•       The obligation to honour opt-out requests immediately (see Section 12.6).

12.6. Opt-out / How to stop receiving messages

You can ask us to stop contacting you on WhatsApp at any time:

•       By replying in the conversation with any of these words: "STOP", "BAJA", "NO MOLESTAR" or "CANCELAR SUSCRIPCIÓN".

•       By writing to us at dev@rcstudio.dev stating the associated telephone number.

Following your request, we will remove your number from the WhatsApp flows within no more than forty-eight (48) hours and will not contact you again through that medium unless you restart a conversation or there is a legal or contractual communication obligation.

12.7. Deletion request / Right to be forgotten

Pursuant to Section 7, you may request the complete deletion of your WhatsApp history, including messages, transcriptions, summaries, files sent, aliases and facts memorised by the system. The request is handled within a maximum of fifteen (15) business days, with email confirmation of the deleted counts (number of messages, files and records).

Deletion is irreversible and covers the database as well as the files stored on disk and the backups that can technically be accessed within their rotation cycle. Only the data we are required by law to keep will be retained (for example, accounting records), and exclusively for that purpose.

12.8. Limitations and liability

•       WhatsApp is operated by Meta Platforms, Inc. RC Studio is not responsible for interruptions, failures or restrictions of the WhatsApp service, nor for changes Meta makes to its policies or its API.

•       RC Studio does not guarantee specific response times on WhatsApp unless an express Service Level Agreement (SLA) has been agreed by contract.

•       In conversations where the AI assists the operator, RC Studio retains ultimate responsibility for the content sent to the customer, without this implying recognition of the AI as an "autonomous controller" of the processing.

•       The AI assistant may make mistakes in suggesting replies or in transcriptions. Relevant operational and commercial decisions (contractual changes, financial commitments, technical instructions with production impact) will always be confirmed in writing through the human operator.

12.9. Minors

Pursuant to Section 3, use of RC Studio's WhatsApp Business channel is restricted to persons of legal age. If you contact us while being a minor, we will suspend the conversation upon detecting this and will request the involvement of your parent or legal guardian before continuing. In that case, the personal data collected during the contact will be securely deleted, unless its retention is required by law.

13. Links to other websites

Although this portal may be linked to other pages, this does not imply, either directly or indirectly, approval, association, sponsorship, endorsement or affiliation by RC Studio with regard to those pages, unless specifically stated in this document.

You should carefully review the legal notices and other terms of use of the websites you access through links on this site. Your engagement with other external portals or websites is at your own risk.

14. Use of cookies

RC Studio's website and applications may use cookies or other similar technologies to improve the user experience, personalise content, analyse traffic and, where applicable, deliver targeted advertising about our own services. You can configure your browser to reject the use of cookies, although this may affect the functionality of the site.

15. Governing law and jurisdiction

These Terms of Service are governed by the laws of the Republic of Colombia. Any dispute arising from their interpretation, performance or fulfilment will first be addressed through direct settlement within thirty (30) calendar days. Failing agreement, the parties submit to the jurisdiction of the competent courts of the Republic of Colombia, without prejudice to the consumer's right to turn to the competent administrative authorities.

16. Contact

For any request, enquiry or complaint relating to these Terms of Service, the processing of personal data or the use of the WhatsApp Business channel, you can reach us at:

Email: dev@rcstudio.dev

Website: https://rcstudio.dev

1. What this policy covers

This Privacy Policy governs the processing of personal data in the following RC Studio products and services only, referred to together as "WhatsApp Coexistence":

•       Coexistence for WhatsApp — module for Odoo Enterprise, versions 17, 18 and 19.

•       WhatsApp Coexistence API — module for Odoo Community, versions 17, 18 and 19.

•       Tech Provider connection service — the connection between the customer's WhatsApp Business number and Meta, operated by RC Studio with its Meta-approved application.

•       Licence portal — https://coexistence.rcstudio.dev: account registration, purchase, issuance, renewal and revocation of licences, and customer self-service.

This policy does not cover other RC Studio services. In particular, it does not apply to RC Studio's own WhatsApp support channel or to its AI-assisted messaging services, which are a separate application, are contracted separately, and are governed by their own policy published at https://rcstudio.dev/privacy.

WhatsApp Coexistence uses no Artificial Intelligence of any kind. No content from our customers' conversations, or from their end customers' conversations, is sent to Artificial Intelligence providers, nor used to train models of any kind.

2. Data controller

Ricardo Colonia — RC Studio

Email: dev@rcstudio.dev

Website: https://rcstudio.dev

Licence portal: https://coexistence.rcstudio.dev

Registered in: Colombia.

This policy is governed by Law 1581 of 2012 and Decree 1377 of 2013 of the Republic of Colombia. Regulation (EU) 2016/679 (GDPR) additionally applies when processing the data of individuals located in the European Economic Area, which may occur because our modules are distributed globally through the Odoo Apps Store.

3. Where the software runs, and what that means

The WhatsApp Coexistence modules run inside the customer's own Odoo instance, on the customer's own server and under the customer's own domain. RC Studio does not host that instance, has no access to its database and cannot query it.

The conversations, contacts, templates and documents the module records live exclusively in the customer's system, under the customer's control and responsibility.

The customer may use the modules with RC Studio's connection service, with their own Meta application, or with a third-party Tech Provider's. The modules do not depend on RC Studio's service to work. When the customer uses their own Meta application, no data transits RC Studio's infrastructure and this policy applies to them only in respect of the module purchase.

4. Our role: when we are a controller and when we are a processor

This distinction determines which rights each person may exercise, and against whom.

RC Studio acts as a CONTROLLER of its own customers' data: the company that contracts the service, the person who creates the account in the portal, the billing data and the technical records generated by use of the service.

RC Studio acts as a PROCESSOR of the personal data of our customer's end customers, that is, the people who write over WhatsApp to the connected number. For that data our customer is the controller: they determine the purposes of processing, and RC Studio processes only what is strictly necessary to provide the connection service, following their instructions and without using that data for any purpose of its own.

If you wrote over WhatsApp to a company that uses our services and wish to exercise your rights over that conversation, you must contact that company, which is the controller. If you write to us, we will help you identify them and forward your request.

5. What data we process

5.1. Account and commercial relationship data

•       Full name and, where applicable, company name and tax identification number.

•       Email address, and the date and time it was verified.

•       Portal password, stored only as a cryptographic hash. No one at RC Studio can read or recover it.

•       Contact telephone number.

•       Professional or work contact details (role, company, sector).

•       The URL of the customer's Odoo instance, required to register delivery of inbound messages and to provide support.

•       Profile data obtained from Google when Google Sign-In is used, as described in Section 7.

5.2. Licences

Of the licence key, RC Studio keeps only its SHA-256 cryptographic digest and the first visible characters, enough to identify it in the panel. The key in clear text is displayed once, at the moment it is issued, and is not stored in any system. If the customer loses it, it cannot be recovered: it is revoked and a new one is issued. The creation date, last-use date and, where applicable, revocation date are also recorded.

5.3. WhatsApp number connection

When the customer connects a number using RC Studio's Tech Provider service, the following are stored:

•       The identifiers of the WhatsApp Business Account (WABA), of the number (phone number id) and of the business portfolio.

•       The display number and verified name, as returned by Meta.

•       An encrypted copy of the customer's business token, kept solely in order to re-subscribe message delivery if the customer's Odoo URL changes, and to trigger the initial synchronisation that Meta permits only once per connection.

•       The message delivery URL of the customer's Odoo and its verify token.

•       A signing secret unique to each customer, stored encrypted, with which RC Studio re-signs deliveries so that the customer's Odoo can validate them.

The number and the WABA remain the customer's property and stay in the customer's Meta business portfolio. A Tech Provider acts as a bridge between the customer's WABA and Meta's services; it never takes ownership of the number, the account or the conversations.

5.4. Technical and audit records

For every call RC Studio makes to Meta on the customer's behalf, we record the action performed, the identifier of the affected number or WABA, the response code, the error detail where applicable, the quota usage reported by Meta, and the IP address the request originated from. These records allow us to diagnose incidents and to evidence what happened and when. The web server also keeps standard access logs.

5.5. Purposes

•       Provision, performance and invoicing of the contracted service.

•       Creating and managing the user account, verifying the email address and preventing fraudulent use.

•       Issuing, validating and revoking licences.

•       Establishing and maintaining the connection of the number with Meta.

•       Customer care and technical support.

•       Sending operational and service notifications (billing notices, maintenance, version changes, security incidents).

•       Platform security and traceability of operations.

•       Compliance with legal, accounting and tax obligations.

6. How WhatsApp messages travel

This section describes precisely what RC Studio's infrastructure does, and does not do, with the content of conversations.

6.1. Messages the customer sends do not pass through RC Studio. The business token lives in the customer's own database, so their Odoo talks straight to Meta. RC Studio's service does not even expose a message-sending endpoint.

6.2. Inbound messages do transit RC Studio's server, and that is a security decision. Meta signs every delivery with the app secret, which under this model belongs to RC Studio and is not in the customer's database. If Meta delivered straight to the customer's Odoo, they would have no way to validate that signature, and a public endpoint without validation would let anyone inject fake messages into their system. The chain is:

Meta → RC Studio (validates the signature with the real secret) → the customer's Odoo (validates with a secret exclusively theirs).

6.3. No content is stored at that step. The message body is forwarded byte for byte, without being inspected or copied. All that is recorded is the timestamp of the last delivery and, when delivery fails, the error message the customer's Odoo returned, truncated and overwritten on the next delivery.

6.4. The customer can remove that transit entirely. The modules work exactly the same using the customer's own Meta application: in that mode Meta delivers directly to their Odoo and RC Studio neither intervenes nor observes anything.

6.5. RC Studio does not read, store, analyse or disclose end customers' conversations, and does not use their content for any purpose of its own. In particular, that content is not used for advertising, marketing, profiling, commercial statistics, or to train or improve Artificial Intelligence models, whether our own or third parties'. This is also required by the Meta Platform Terms.

7. Customer account and Google Sign-In

The licence portal allows an account to be created with an email address and password, or through Google Sign-In.

7.1. Registration with email. A valid email address is required and must be verified through a link sent to that address before licences can be issued. The password is stored only as a cryptographic hash.

7.2. Google Sign-In. If the user chooses it, RC Studio receives from Google only their email address, name, profile picture and the internal identifier Google assigns to the account. No access is requested to the user's email, contacts, calendar or files.

RC Studio's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. That information is used solely to create and authenticate the account; it is not sold, not shared with third parties for advertising purposes, and not used to train Artificial Intelligence models. The user may revoke access at any time from their Google account security settings.

7.3. Account deletion. The data subject may request deletion of their account by writing to dev@rcstudio.dev from the associated address. On deletion, their licences are revoked, their numbers are disconnected and the associated data is erased, except where the law requires retention under Section 11.

8. Payments and billing

Depending on the payment method chosen, RC Studio processes the following information:

•       PayPal: the subscription is managed entirely on PayPal's platform. RC Studio receives and stores the subscription identifier and the payment status.

•       Mercado Pago: as above, with the corresponding subscription identifier.

•       Bank transfer: RC Studio keeps the receipt sent by the customer and the record of the payment.

•       Module purchase on the Odoo Apps Store: the transaction is processed by Odoo S.A. under its own terms. RC Studio receives from Odoo the buyer data needed for invoicing and support.

RC Studio does not receive, view or store card numbers, security codes or banking credentials.

9. Providers and third parties we share data with

Provider	Purpose	Country
Meta Platforms, Inc.	The WhatsApp Business platform. Without it there is no service	USA
Google LLC	Google Sign-In, only if the user chooses it	USA
PayPal	Processing the subscription in US dollars	USA
Mercado Pago (MercadoLibre)	Processing the subscription in Colombian pesos	Colombia
Odoo S.A.	Sale of the modules through the Odoo Apps Store	Belgium
[Hosting provider]	Server running the portal and the connection service	[Country]
[Transactional email provider]	Sending email verification and service notices	[Country]

Each provider processes the data under its own policies and solely for the stated purpose. Beyond those listed in this table there is no other recipient. RC Studio does not sell personal data under any circumstances, and uses no Artificial Intelligence providers in this service.

10. Commercial communications

RC Studio may use the account's contact details — name, email address and company — to inform the customer about new versions, features and RC Studio's own products, and may use them on digital advertising platforms to target campaigns about its own services.

This processing never reaches the content of WhatsApp conversations, nor the data of the customer's end customers, in accordance with Section 6.5.

The data subject may object to this processing at any time by writing to dev@rcstudio.dev, without this affecting the provision of the contracted services or the validity of their licence.

11. Data retention

•       Message content: not retained. It only transits, as described in Section 6.

•       Encrypted business token and number connection data: for as long as the number remains connected. On disconnection, or on deletion of the customer's account, RC Studio's application subscription is removed from the WABA and the whole record is deleted, encrypted token included.

•       Account, licences and billing data: for the duration of the relationship and for five (5) years afterwards, under Colombian accounting and tax obligations.

•       Connection service audit records: twenty-four (24) months.

•       Web server access logs: ninety (90) days.

•       Connection assistant sessions: fifteen (15) minutes.

Once the period has elapsed or a deletion request has been honoured, the data is securely erased from both the database and the files on disk.

12. Security

•       Encryption in transit (HTTPS / TLS) for all communications.

•       Symmetric encryption at rest (AES-128 + HMAC) over stored tokens and secrets, with the encryption key held outside the database.

•       Licence keys stored only as SHA-256 digests, and passwords only as hashes.

•       Validation of Meta's HMAC-SHA256 signature on every inbound delivery before forwarding, and re-signing with a secret unique to each customer.

•       The Meta app secret is held exclusively in the server configuration: it does not reside in the database, is never returned by any API and is never written to any log.

•       Restricted access to the administration panel through credentials and a signed session, with an auditable record of operations.

•       Database and internal services isolated on a private network.

•       Server hardening, security update management and event monitoring.

No system is infallible. In the event of a personal data breach that poses a risk to data subjects' rights, RC Studio will notify those affected and the competent authority within the legally required deadlines.

13. International data transfers

The providers listed in Section 9 are established outside Colombia. By accepting this policy, the data subject expressly authorises the international transfer of their personal data to those countries, under article 26 of Colombian Law 1581 of 2012.

These transfers are further supported by the necessity of performing the contract requested by the data subject and by the standard contractual clauses and other safeguards those providers incorporate into their terms of service.

RC Studio's connection service runs on infrastructure hosted in [data centre country], and transactional email is sent through [email provider].

14. Rights of data subjects

Under Colombian Law 1581 of 2012, Decree 1377 of 2013 and related rules, data subjects have the right to:

•       Know, update and rectify their personal data.

•       Request proof of the authorisation granted for processing.

•       Be informed, upon request, of the use made of their data.

•       Lodge complaints with the Superintendency of Industry and Commerce.

•       Revoke authorisation and/or request erasure of their data, where no legal or contractual duty prevents it.

•       Access their personal data free of charge.

Where the GDPR applies, data subjects located in the European Economic Area additionally have the rights of access, rectification, erasure, restriction of processing, portability and objection, and may lodge a complaint with their national supervisory authority.

How to exercise these rights: by writing to dev@rcstudio.dev from the address associated with the account, stating the specific request. RC Studio will respond within the following deadlines:

•       Enquiries (Law 1581): ten (10) business days, extendable by five (5) more.

•       Complaints (Law 1581): fifteen (15) business days, extendable by eight (8) more.

•       GDPR requests: one (1) month, extendable by two (2) more where complexity justifies it.

15. Confidentiality

When providing technical support, RC Studio may access confidential customer information, including configurations, technical logs and, if the customer voluntarily provides them, credentials to their systems. RC Studio undertakes to treat such information in strict confidence, to use it solely to resolve the reported incident, not to disclose it to third parties except at the request of a competent authority, and to securely delete it once the request has been handled.

This obligation survives for five (5) years from termination of the contractual relationship.

16. Intellectual property and licence of use

•       The customer retains ownership of their information, data, content and WhatsApp number.

•       RC Studio retains ownership of the modules and of the connection service, over which it grants the customer a licence of use under the applicable purchase terms.

•       The connection service licence is non-transferable and granted for the customer's own use; it does not authorise resale or assignment to third parties without express authorisation.

17. Minors

WhatsApp Coexistence is a product aimed at businesses and its use is restricted to adults. RC Studio does not knowingly collect personal data from minors. If such data is found to have been collected, it is securely deleted.

18. Changes to this policy

RC Studio may amend this policy to reflect changes in the service or in applicable law. The version in force will always be published at this address, with its update date. Changes that substantially affect the processing of personal data will be notified by email at least fifteen (15) days before they take effect.

19. Governing law and jurisdiction

This policy is governed by the laws of the Republic of Colombia. Any dispute shall first be addressed through direct settlement within thirty (30) calendar days. Failing agreement, the parties submit to the jurisdiction of the competent courts of the Republic of Colombia, without prejudice to the consumer's right to approach the competent administrative authorities.

20. Contact

Email: dev@rcstudio.dev

Website: https://rcstudio.dev

Licence portal: https://coexistence.rcstudio.dev

Supervisory authority in Colombia: Superintendencia de Industria y Comercio (www.sic.gov.co).

Last updated: 15 September 2026.