Privacy Policy
Effective date: August 9, 2026
This notice explains how Carlos D. Escobar-Valbuena, operating as Broomva, located in Bogotá, Colombia ("Broomva," "we," or "us"), processes personal data through broomva.tech. Broomva is the controller for website, account, support, billing, and product-analytics processing described here. A signed business agreement may assign a different role for customer-controlled data.
1. Data we process
- Account and identity: name, email, avatar, authentication identifiers, organization membership, and account settings received from you, Google, GitHub, or Neon Auth.
- Content: prompts, chats, generated responses, files, images, documents, notes, feedback, and tool inputs and results.
- Billing: plan, subscription status, transaction identifiers, invoices, and limited payment metadata from Stripe. Full payment-card details are handled by Stripe.
- Technical and security: IP address, device and browser information, timestamps, request and error records, abuse signals, authentication events, and diagnostic traces.
- Onchain identity: if you use Base account features, wallet address, signed authentication message, network identifiers, and related public blockchain records.
- Optional analytics: pages and features used, referral and campaign parameters, and performance measurements, only after you accept optional analytics where the consent control is shown.
- Communications: support requests and other messages you send us.
Please do not include highly sensitive personal data, secrets, or regulated records in prompts or uploads unless a specific feature and written agreement expressly support that use.
2. Purposes and legal grounds
- Provide the Service and bill paid plans: performance of a contract or steps you request before entering one.
- Authenticate, secure, debug, prevent abuse, and improve core reliability: performance of the contract and our legitimate interests in operating a secure, reliable service, balanced against your rights.
- Optional product and performance analytics: your consent where required. You may refuse or withdraw without losing core access.
- Support and service communications: contract performance and our legitimate interests in responding and operating the Service.
- Taxes, legal requests, disputes, and compliance:applicable legal obligations and legitimate interests in establishing or defending legal claims.
Colombian processing is also governed by Law 1581 of 2012 and its implementing rules. Where consent is the applicable authorization, you may request proof of it and withdraw it subject to lawful exceptions.
3. AI and tool processing
When you invoke an AI model or tool, Broomva transmits the prompt, relevant conversation context, attachments, and tool parameters needed to produce the result. Requests may pass through Vercel AI Gateway and the model or tool provider you select. Available providers can change; the current categories are listed on our Subprocessors page.
Broomva does not use private chat content to train its own public AI model. That statement does not promise zero retention by every provider. Provider retention, abuse monitoring, and training treatment depend on the configured product and contract. Avoid submitting information that the selected feature is not intended to process.
4. Recipients and service providers
We disclose data only as needed to operate the Service, at your direction, to complete a transaction, to professional advisers under confidentiality, to comply with law, to protect rights and safety, or in a business transfer. Core provider categories include Vercel for hosting and AI gateway services, Neon for database and authentication, Stripe for billing, Sentry for essential error monitoring, and selected AI and tool providers. Browser-based PostHog and Vercel analytics run only after the optional analytics choice described below. Limited authenticated product, account, model/tool, organization, marketplace, and billing events may also be sent server-side to PostHog to understand adoption, feature reliability, and commercial operations under our service-data authorization and, where applicable, our legitimate interests. These events are not the legal record of your Terms acceptance or data authorization. You may object by contacting us; we will assess and honor the objection where required.
Langfuse may receive model, chat, user, trace, and—depending on active telemetry settings—prompt or output data for service observability.
We do not sell personal data. We do not use optional analytics for cross-context behavioral advertising.
5. Retention
We retain account and content data while your account is active and for a reasonable period afterward to support restoration, security, fraud prevention, disputes, and legal obligations. Billing and tax records may be kept for the legally required period. Security and error logs are retained for operationally limited periods. Optional analytics follow the provider configuration then in effect. Backups are overwritten on scheduled cycles and may not be immediately editable.
We are validating a record-level retention schedule. Until it is published, you may ask for the applicable period or criterion at contact@broomva.tech. We will erase or anonymize data when no purpose or legal basis remains. Account cancellation alone is not necessarily an erasure request.
Acceptance receipts are decoupled from the active account record so account deletion does not automatically destroy proof of contract and data authorization. They are retained only while reasonably needed for that evidentiary purpose or a legal claim, subject to applicable minimization, deletion, and objection rights. The final period and treatment of receipt IP and user-agent fields remain part of the retention-schedule review.
6. Cookies and analytics
Sentry error and performance telemetry is treated as essential for reliability and security. Browser session replay is disabled and default personal-information collection is disabled. An error report can still contain technical request context; do not place secrets in URLs or other technical fields.
7. International transfers
Broomva operates from Colombia and providers may process data in the United States and other countries. Use of the Service is not treated as blanket consent to every transfer. We are validating provider roles, destinations, and the contracts or other safeguards required for each restricted transfer. This notice does not itself prove that standard clauses, transfer assessments, or supplementary measures are complete. Contact us before submitting EU, UK, or other restricted customer data if you require evidence of a specific transfer safeguard.
8. Your choices and rights
Depending on applicable law, you may request access, a copy, correction, updating, deletion, restriction, objection, or portability; withdraw consent; ask for proof of authorization; obtain information about use; and complain to a competent authority. In Colombia, you may complain to the Superintendencia de Industria y Comercio after completing any required direct consultation or claim process with us.
Send a request to contact@broomva.tech with enough information to identify the account and request. We may verify identity. We will acknowledge and answer within the time required by the law that applies, explain lawful denials, and notify relevant recipients of corrections or erasure where required. You may appeal or complain to your local authority. We do not discriminate for exercising a right.
9. Security and incidents
We use measures including encrypted transport, access controls, secure authentication, tenant-scoped authorization controls, monitoring, and vulnerability handling. No Internet service is perfectly secure. See the Security page to report a vulnerability. If an incident triggers a legal notification duty, we will notify the competent authority and affected people as required.
10. Children
The Service is not directed to children under 18 and we do not knowingly collect their data. A higher age or guardian authorization may apply where you live. Contact us if you believe a child provided data so we can investigate and take appropriate action.
11. Automated decisions
The general chat and agent features generate content but are not intended to make decisions about people that produce legal or similarly significant effects. Do not deploy the Service for such decisions without a separate assessment and written agreement.
12. Onchain and file-storage limitations
Public blockchains are independently replicated. If you use a Base feature, Broomva can address its offchain account records but cannot erase a valid transaction or identifier already written to the public Base blockchain.
New attachment uploads and generated-image storage are currently disabled while private, signed-access storage is implemented. Earlier public-by-link blob objects, if any, require a separate inventory and revocation review. Do not rely on an old blob URL as confidential storage.
13. Changes and contact
We may update this notice as data flows or law change. We will post the effective date and provide reasonable notice of material changes. Where new consent is required, continued use alone will not substitute for it.
Controller and privacy contact: Carlos D. Escobar-Valbuena, operating as Broomva, Bogotá, Colombia; contact@broomva.tech; https://broomva.tech.