*Documento interno — no se publica*

# MASTER CONTEXT v2 — ialabs.app legal package (22 Oct 2026)

Replaces v1. Paste it before every prompt and copy it into the Project instructions. Every rule below is a decision the founder already made. Do not ask again.

## 1. Company and contact (final values)

- Legal entity: **Cordova Group S.A.S.**, NIT **901578119-7**, Colombia. Domicile: **Medellín, Antioquia**. Street address: **[DIRECCIÓN]** (the only open company fact).
- Legal representative and Data Protection Officer: **Mateo Piza Ruiz**, «Representante Legal y Oficial de Protección de Datos». Same person approves AI use cases.
- Public phone and WhatsApp (claims, critical support): **+57 300 332 9814**.
- E-mails (write them without brackets; creating them is a pending item): **privacidad@ialabs.app** (privacy and deletion), **soporte@ialabs.app** (support, consumer PQR, AI errors), **legal@ialabs.app** (contracts, notices), **abuso@ialabs.app** (abuse).
- No LLC exists today. Cordova Group S.A.S. is the party everywhere. Contracts allow assignment to an affiliate under common control (future LLC) with 30 days' notice.

## 2. Sites and brands (multisite version is the base)

- Sites: **ialabs.app (sitio principal), agentrixlabs.com.co y s360.tech** — defined term «los Sitios».
- Brands: ialabs.app and Soluciones 360 Technology (S360T). Name the agentrixlabs.com.co **domain**; do not invent an "Agentrix" brand claim beyond the domain.
- Header line of every document: `**IALABS.APP · AGENTRIXLABS.COM.CO · S360.TECH — CORDOVA GROUP S.A.S.**`
- Every legal page lives on ialabs.app. The other two Sites link to them in the footer.
- Product name: «ialabs.app» or «la Plataforma».

## 3. Legal URLs (all under https://ialabs.app)

| Doc | URL |
|---|---|
| 08 Política de Privacidad (replaces 01) | /legal |
| 06 Términos de Servicio | /terminos |
| 03 Términos para consumidores | /terminos/consumidores |
| 07 Eliminación y desvinculación | /legal/eliminacion |
| 09 Subencargados | /legal/subencargados |
| 10 IA Responsable | /legal/ia |
| 11 Uso Aceptable | /legal/uso-aceptable |
| 12 Cookies | /legal/cookies |
| 13 Desarrollos a la Medida y Propiedad del Código | /legal/desarrollos |

Do not create other URLs (no /planes, /pqr, /estado, /soporte, /solicitud forms).

## 4. What we sell and what exists today

- B2B **and B2C**: we also sell to natural persons as final consumers (Ley 1480 applies to them; 03 governs them).
- Channels offered today: **WhatsApp Business Platform, Instagram and Messenger, voice calls with AI** (recorded and transcribed when the client enables it).
- **Voice cloning of a real person: offered**, only with that person's separate, prior, express written authorization (biometric data).
- **No login with Google or Facebook** to the Platform. Facebook Login for Business is used only inside Meta Embedded Signup.
- Panel functions that exist today: **disconnect WhatsApp, disconnect Google, delete account and data**. Describe them generically («en la configuración de canales de la Plataforma, opción Desconectar»); exact menu labels are a pending check.
- Functions NOT confirmed (do not promise them publicly): «Reportar respuesta» button, automatic card-number redaction before LLM calls, stopping a recording mid-call, «marque 0».
- Human escalation keyword: **ASESOR** (chat) / «asesor» (voice).
- Google scopes (plan decision 5): openid, userinfo.email, userinfo.profile, calendar.events, gmail.send, drive.file with Google Picker. No restricted scopes, so no CASA.

## 5. Data location (hard rule)

- Personal data is hosted and processed **only in Colombia, the United States and EU member states**. Never elsewhere without the client's written instruction and art. 26 Ley 1581 guarantees. Network transit through CDN nodes may happen, encrypted, without storage.
- Adequacy citation: «numeral 3.2 del Capítulo Tercero del Título V de la Circular Única de la SIC (Circular Externa 005 de 2017)».
- Transmission (to an Encargado): arts. 2.2.2.25.5.1 and 2.2.2.25.5.2 Decreto 1074 de 2015. Transfer (to another Responsable): art. 26 Ley 1581 de 2012.
- Chinese-origin open models (e.g., Kimi) only through OpenRouter with US providers, zero retention, no fallback. Never Moonshot's direct API.

## 6. Subprocessors (active)

OVHcloud (VPS, United States — IP range of OVH US; confirm entity), Supabase (Postgres, US or EU region; confirm entity, not Singapore), Cloudflare (CDN, tunnels, R2 in US or EU), n8n (n8n Cloud, EU — n8n is also self-hosted), OpenAI, Anthropic, Groq, OpenRouter (LLMs, US, no training), ElevenLabs (voice synthesis, transcription and voice agents, US; training opt-out is a **blocking** pending), Twilio (telephony, SMS, recordings, US), Resend (transactional e-mail, US). In reserve: Contabo (Germany), AWS and Google Cloud (US or EU regions only). **Removed: Hostinger (Brazil).**
Responsable-side providers (no Contactos data): Bold (payments, Colombia), HubSpot (own CRM, US). Telegram: internal technical alerts only, without personal data → not a subprocessor.
Platforms the client contracts directly (not subprocessors): Meta (WhatsApp, Instagram, Messenger) and Google Workspace.
Open checks to list as pending, not as brackets: Dapta (agents still running there during migration), Airtable/Lovable Cloud if used as an agent backend, client-specific tools (Calendly, Make).

## 7. Consistency numbers (use exactly these)

- Habeas data: consultas 10 días hábiles (+5); reclamos 15 días hábiles (+8); incomplete claim: 5 days to complete, abandoned after 2 months.
- Requests about Contactos that reach us: forwarded to the client within 2 días hábiles.
- Deletion: acknowledgment and confirmation code 2 días hábiles; access revocation 1 día hábil; active databases 15 días hábiles (+8); backups rotate in at most 35 days.
- Incidents: notify client within 48 hours of confirmation; SIC report within 15 días hábiles from detection.
- Retention: conversations 12 months from last interaction; audio 90 days; transcripts 12 months; technical logs 12 months (security up to 24); invoices 10 years (art. 28 Ley 962 de 2005); prospects 24 months from last interaction or until revocation; deletion-request records 2 years; proof of authorization: while we process the data and 3 years more (art. 52 Ley 1437 de 2011); backups ≤ 35 days.
- Termination: 30 days to export, then deletion (15 días hábiles) and certificate.
- Notice for changes to terms, prices or subprocessors: 30 days. Emergency replacement of a subprocessor: notice within 5 días hábiles.
- B2B payment: periods in advance, within 5 días hábiles of the e-invoice; suspension 5 días hábiles after the default notice; annual IPC (DANE) adjustment plus pass-through of third-party price increases with 30 days' notice.
- Liability cap: fees paid in the previous 12 months; 2x for data protection; no indirect damages; exceptions: dolo, culpa grave, confidentiality, indemnities, client's payment obligations, harm to life or physical integrity; never against consumers.
- SLA: 99,0 % monthly; credits 5 % (<99,0 ≥98,0), 10 % (<98,0 ≥95,0), 25 % (<95,0); RPO 24 h, RTO 8 h; report on request (no public status page).
- Confidentiality: 5 years; indefinite for trade secrets and personal data.
- Disputes: Colombian law; 30 days of direct negotiation; arbitration for claims ≥ 100 SMMLV at the Centro de Arbitraje y Conciliación de la Cámara de Comercio de Medellín para Antioquia, one arbitrator, in law, in Medellín, in Spanish; smaller claims before the competent judges of Medellín (flag CGP art. 28 num. 3 as a lawyer check). Consumers: SIC or judges of their domicile; arbitration never applies to them.
- Custom-development IP: pre-existing components stay with Cordova Group (express «pacto en contrario», art. 20 Ley 23 de 1982 as amended by art. 28 Ley 1450 de 2011); client-specific code assigned upon full payment, in writing (art. 183 Ley 23 de 1982 as amended by art. 181 Ley 1955 de 2019).
- Effective date of every document: **22 de octubre de 2026**, version 1.0 (08 is 2.0).
- Personal data: we may list broad data categories, but each category must map to a stated purpose (art. 2.2.2.25.2.1 Decreto 1074 de 2015). Never sell, no ads, no profiling with Meta or Google data, never train models with conversations or client data, no mixing across clients.

## 8. Document numbering (final package folder `paquete-final/`)

00 Índice · 00 Contexto Maestro v2 · 02 DPA · 03 T&C consumidores · 04 T&C B2B · 05 SLA · 06 Términos de Servicio · 07 Eliminación · 08 Privacidad (absorbs 01) · 09 Subencargados · 10 IA Responsable · 11 Uso Aceptable (P03) · 12 Cookies (P05) · 13 Desarrollos a la Medida (P10) · 14 Cesión fundador → sociedad (P11) · 15 Orden de Servicio + anexo técnico (P12) · 16 NDA (P13) · 17 Procedimiento de consultas, reclamos y supresión (P14) · 18 Seguridad de la información e incidentes (P15) · 19 Retención y supresión + spec técnica (P16) · 20 EIPD (P17) · 21 Inventario de bases y RNBD (P18) · 22 Auditoría de consistencia (P23). 01 is archived (absorbed by 08).

## 9. Output format

- Markdown (.md). Spanish (Colombia), plain language, short sentences, numbered sections («## 1.»), defined terms with initial capitals. Technical specs (e.g., 19 Part B) in English.
- Line 1: `*Borrador para revisión de abogado colombiano*`. Internal documents add `*Documento interno — no se publica*` on line 2.
- Line 3: the header line of §2. Then `# Title`. Then: `Versión 1.0 · Vigente desde el 22 de octubre de 2026 · Cordova Group S.A.S., NIT 901578119-7 · Sitios: ialabs.app (sitio principal), agentrixlabs.com.co y s360.tech` plus ` · Publicada en <URL>` for public pages.
- Brackets only for facts nobody has: `[DIRECCIÓN]`, a client's data in templates, asset values, repository names. Uncertain legal citations: `[VERIFICAR]`. Do not leave `[CONFIRMAR …]` in the body: move operational checks to the pending list. Template variables in scripts or forms use `{VARIABLE}`.
- End with `## Anexo interno — no publicar` → `### Cambios respecto a versiones anteriores` (table, if anything changed) → `### Pendientes antes de publicar` (or «antes de firmar» / «antes de usar») as `- [ ]` items, last item «Revisión del abogado.».
- Never contradict 02–10. If you must, record it in the changes table.