Skip to content
Privacy

Personal data processing policy

We comply with Colombian Law 1581 of 2012, Decree 1377 of 2013, and applicable international data protection standards (Habeas Data).

This document explains how Moshipp SAS (hereafter “Nuvlyx” or “we”), acting as Data Controller, collects, stores, uses, shares, and deletes the personal data of people who interact with the Nuvlyx SaaS platform, its website, and related services.

1. Data Controller

Legal name: Moshipp SAS
Tax ID (NIT): 901.675.933-1
Registered address: [PHYSICAL ADDRESS — to be registered]
Email: hola@nuvlyx.com
Website: https://nuvlyx.com

2. Scope and acceptance

This policy applies to: (i) Owners, i.e., resellers who subscribe to Nuvlyx to operate their own storefront; (ii) end customers who sign up or interact with stores run by an Owner on Nuvlyx infrastructure; and (iii) visitors to nuvlyx.com.

By signing up, subscribing, or browsing the site, the Data Subject states they have read, understood, and accepted this policy, expressly authorizing the processing of their data under the terms described here.

When end customers register on an Owner-run store, Nuvlyx acts as a Data Processor while the Owner is the Controller. This relationship is further governed by our Terms of Service, which include a Data Processing Agreement.

3. Data we collect

We process the following categories of data:

  • Identification: full name, ID number, date of birth (when applicable), nationality.
  • Contact: email, mobile phone, postal address, country.
  • Store data (Owners): business name, tax ID, store domain, billing details, banking info for payment reconciliation.
  • Transactional data: order history, products purchased, amounts, payment methods, transfer receipts, digital wallet balance.
  • Technical and usage data: IP address, device identifiers, browser type, operating system, pages visited, login timestamps, activity and error logs.
  • Communication data: content of support messages, contact forms, and other interactions you choose to share.

We do not collect sensitive data (racial origin, political views, religious beliefs, health, sexual life, biometric data) unless voluntarily provided and expressly authorized.

4. Processing purposes

  • Create, manage, and administer Owner and end-customer accounts.
  • Deliver the contracted SaaS service: host the store, process orders, deliver digital licenses, manage the wallet, integrate payment gateways.
  • Charge subscription fees, issue invoices, and handle accounting and tax obligations.
  • Send operational, security, and service notifications (license delivery, confirmations, stock alerts, payment reminders).
  • Provide technical support and customer service.
  • Comply with legal, tax, accounting, and regulatory obligations.
  • Prevent, detect, and investigate fraud, abuse, money laundering, and illegal activity.
  • Perform anonymized aggregate analytics to improve the service.
  • Send marketing communications and newsletters only when expressly authorized (with opt-out at any time).

5. Your rights

Under Article 8 of Colombian Law 1581/2012, Data Subjects have the right to:

  • Know their personal data processed by Nuvlyx and the purposes.
  • Update and rectify data that is incomplete, inaccurate, or outdated.
  • Request proof of the authorization granted for processing.
  • Be informed about the use made of their data.
  • Withdraw authorization and/or request deletion when the principles, rights, and constitutional or legal safeguards are not respected.
  • Access their data free of charge.
  • File complaints with the Colombian Superintendence of Industry and Commerce (SIC) for breaches of Law 1581/2012.

6. Exercising your rights

To exercise any of the above, email hola@nuvlyx.com with:

  1. Full name, ID number, and contact details.
  2. Clear description of the facts and request (inquiry, update, rectification, deletion, revocation, etc.).
  3. Supporting documents, if applicable.

Inquiries are answered within a maximum of ten (10) business days; complaints within a maximum of fifteen (15) business days. If extended, we will inform the Data Subject of the reason and new deadline, within the additional terms allowed by law.

If the answer is not satisfactory, the Data Subject may turn to the SIC, Colombia’s data protection authority.

7. Transfers and processors

To deliver the service, Nuvlyx may transfer or transmit personal data to the following processors or third parties, located in Colombia or abroad, under contractual agreements that guarantee protection levels equivalent to those required by Colombian law:

  • Cloud infrastructure providers (servers, databases, CDN).
  • Payment gateways such as Wompi, MercadoPago, or others authorized per country.
  • Transactional email providers (e.g., Resend, SendGrid).
  • Messaging providers (Telegram) when the Owner activates the add-on.
  • Support and CRM providers (e.g., Chatwoot).
  • Competent authorities upon binding legal request.

We do not sell personal data to third parties for advertising purposes.

8. Minors

Nuvlyx is not directed at minors. We do not knowingly collect personal data from children under 14. If we discover that a Data Subject is a minor without guardian consent, we will delete their data.

9. Retention and deletion

Personal data will be retained for as long as reasonably necessary to fulfill the purposes for which it was collected or applicable legal obligations (e.g., tax and accounting records). After that, data is securely deleted or anonymized.

When an Owner cancels their subscription, data is retained for a grace period of up to 30 days to allow reactivation or export. After that, data is deleted from active systems and backups within a reasonable time, unless legally required to be retained.

10. Security measures

We apply reasonable technical, human, and administrative measures to protect data against unauthorized access, alteration, loss, or misuse: AES-256 encryption at rest, TLS 1.3 in transit, multi-tenant isolation via Row Level Security, role-based access controls, audit logs, and incident response. See our security page for details.

11. Cookies and similar tech

We use cookies and similar technologies to keep sessions active, remember preferences (such as language or currency), measure usage, and protect the platform from abuse. You can configure or remove cookies from your browser; some cookies are strictly necessary and removing them may impact functionality.

12. Updates

Nuvlyx may update this policy to reflect legal, operational, or technological changes. Material changes will be communicated via the website or email at least fifteen (15) days before they take effect. Continued use of the service after that window constitutes acceptance.

13. Contact

For questions, complaints, or to exercise rights regarding personal data, email hola@nuvlyx.com. The competent Colombian authority for data protection is the Superintendence of Industry and Commerce (SIC), www.sic.gov.co.