Privacy Policy

1. Controller

Controller: Potencia Labs SAC. Address: CAL. BARAJAS 456, SAN BORJA - LIMA - LIMA, PERÚ. Privacy and data-rights contact: contacto@potencialabs.com.

2. Scope

This policy covers the website, forms, AI Readiness Assessment, Potencia Insights, Kallpia, the Complaints Book, and related communications. Contracted client services may have additional notices or agreements.

3. Data processed

• Contact and professional context: name, email, company, role, country, need, and message.
• AI Readiness Assessment: enumerated organizational context, answers, scores, methodology version, and result; name, email, company, and role only when a report is requested.
• Potencia Insights: email, language, source, and request, confirmation, and unsubscribe evidence.
• Kallpia: messages, replies, language, session, and temporary progress. With authorization, name, email, preferred channel, number and registration country for phone; or exact @username, optional username key, and number for WhatsApp; plus professional context, summary, and consent evidence.
• Complaints Book: required identity and contact details, product or service, amount where applicable, details, and requested resolution.
• Minimum technical data needed for security and operation, such as IP, browser, timestamps, events, and error logs.

4. Do not submit sensitive data

General channels and Kallpia are not designed for health, biometric, financial, credential, trade-secret, children’s, or other sensitive data. Do not share it unless a dedicated channel lawfully requests it.

5. Purposes

• Respond to inquiries and manage requested opportunities.
• Calculate the assessment and, if requested, deliver the report.
• Operate Kallpia and coordinate follow-up only with consent.
• Confirm and manage Potencia Insights.
• Register, manage, and respond to complaints and claims.
• Prevent abuse and maintain security, continuity, and traceability.
• Meet legal obligations and valid authority requests.

6. Legal basis and consent

We process data to respond to requests and pre-contractual interactions, meet legal obligations, protect the service, and—where applicable—on the basis of free, prior, informed, express, unambiguous, and demonstrable consent. Marketing is optional and requested separately. Withdrawal does not affect processing lawfully completed before it.

7. Artificial intelligence

Kallpia identifies itself as AI and provides informational guidance; it can make mistakes and does not make binding decisions. The assessment uses versioned rules for its score, band, and actions. An AI model drafts only the explanation from enumerated categories and scores: it does not receive name, email, company, role, IP address, or free-text form content. Results are not an audit, certification, legal assessment, or guarantee, and material decisions require human review.

8. Recipients and processors

We use Hetzner for infrastructure hosted in Germany; Mailgun for transactional email; Google Workspace to receive and answer communications; and OpenRouter together with the selected model provider for AI inference. Ghost, PostgreSQL, n8n, and Coolify run as software within our infrastructure and do not receive data as independent providers. Each service accesses only what it needs for its function. We do not use advertising analytics or sell personal data.

9. International transfers

Email, communication, and AI services may process data outside Peru, including the United States and other locations disclosed by the applicable provider. Potencia Labs limits the content sent, uses available configuration and contractual safeguards, and documents each flow. Where a feature relies on consent, the requested authorization discloses this transfer; other flows are limited to the applicable request or legal obligation.

10. Retention

• Inquiries, lead summaries, consent evidence, and commercial history: up to 5 years from the last meaningful interaction.
• Completed assessment without a report: 12 months. Assessment and report request: up to 5 years.
• Kallpia: interactive session 24 hours; unconsented conversation up to 30 days; conversation with authorized follow-up up to 90 days; minimum lead data, summary, and exact consent evidence up to 5 years.
• Potencia Insights: while the subscription remains active; required evidence and suppression records may be kept up to 5 years after unsubscribe or the last communication.
• Complaints Book and response: 5 years.
• Technical and security logs: normally up to 12 months; rolling backups: normally 30 to 90 days.
• Periods are extended only for a legal obligation, dispute, or documented preservation need. On expiry, data is deleted or anonymized.

11. Current-tab copy

To keep Kallpia visible while navigating, the current tab keeps a limited copy of up to 60 messages in browser session storage. Persistent local storage is not used, the copy is intended to disappear when the tab closes, and it does not extend the server session lifetime.

12. Security and incidents

We use encryption in transit, environment separation, least privilege, secrets outside source code, validation, abuse controls, backups, and monitoring. No system is infallible. If an incident occurs, we apply containment, investigation, documentation, and required notifications.

13. ARCO-P rights

You may request information, access, portability, updates, inclusion, correction, cancellation or deletion, objection, and consent withdrawal. Email contacto@potencialabs.com with your identity, specific request, and reply channel. We ask only for reasonable verification needed to protect your data. You may also contact Peru’s National Authority for Personal Data Protection.

14. Cookies and measurement

We use only mechanisms strictly necessary for session, security, and operation. No non-essential analytics or advertising cookies are active. If this changes, we will publish the inventory and applicable consent mechanism before activation.

15. Children

Corporate services are not directed to children. The Complaints Book allows a parent or guardian to be identified where applicable.

16. Data banks and authorities

Potencia Labs maintains a data-bank inventory and manages registration or updates with Peru’s National Personal Data Protection Registry. Data is disclosed to authorities only under a valid obligation or request.

17. Changes

We publish the date of each update. If a change materially affects a purpose or consent, we provide the notice or renewed authorization that applies.

18. Applicable framework

This policy is based on Peru’s Law 29733 and DS 016-2024-JUS, and considers Law 28493, Law 29571, Law 31814, and DS 115-2025-PCM according to the feature used.