Zuturno

Privacy and Data Processing Policy

Version 2026-10-20 · Last updated: October 20, 2026

In compliance with Law 1581 of 2012, Decree 1074 of 2015 and other applicable regulations, FATTY OINK S.A.S., identified with NIT (Colombian tax ID) 902.114.793-4, domiciled in Bogotá D.C., Colombia, operating under the Zuturno brand (“Zuturno”, the “Controller”, “we” or “our”), in its capacity as Data Controller, adopts this Privacy and Personal Data Processing Policy (the “Policy”). This Policy explains what information we collect through our website https://www.zuturno.com and the desktop application (the “Software” or the “Application”), how we use it, with whom we share it and what measures we adopt to protect it. By registering, purchasing a license or using the Service, you (the “Data Subject”) accept the practices described in this Policy and authorize the processing of your data under the terms provided herein.

1. Controller identification

  • Controller: FATTY OINK S.A.S. (owner of the Zuturno brand).
  • NIT (Colombian tax ID): 902.114.793-4.
  • Address: Calle 118 # 12-40, Bogotá D.C., Colombia.
  • Area responsible for handling inquiries and claims: the Legal Representative of FATTY OINK S.A.S. (Personal Data Protection), at [email protected] or at the address above.
  • Website: https://www.zuturno.com.

2. Definitions

The definitions of Law 1581 of 2012 are adopted, among them: personal data, sensitive data, Data Subject, Controller, Processor, processing, authorization, transmission and transfer of data.

3. Information we collect

a) Information you provide directly:

  • Support email (if you write to us): name, email, subscription status, reason for contact and the content of your message.
  • Payment information: name, email, country and billing details. Payments are processed by Dodo Payments, which acts as Merchant of Record, through PCI DSS-certified processors. Full card details are processed and stored exclusively by them; we never see or store your full card number.
  • Account and license information: name, email and customer and subscription identifiers from the payment processor, necessary to manage your license.

b) Information collected automatically:

  • Device and license data: when activating and using the Software, we collect a device identifier, an activation/installation identifier and the timestamp of the last activity, for the sole purpose of managing and enforcing the license (for example, limiting the number of devices per license).
  • Connection data: to validate the license and check for updates, the Application connects to our servers. In these connections, your IP address and the technical information of the request are processed by our hosting and CDN providers to deliver and protect the service. Our request logs store the date, path and result of each request, the version of the Terms accepted and a hash of the license key (not the key itself or your IP), and are automatically deleted after 90 days. Proof of your acceptance of the Terms and of your data processing authorization is kept separately, in a record that is not deleted after 90 days (see section 10).
  • Analytics data: we use Google Analytics 4 to collect page URLs, referrals, interaction events (such as plan clicks, the start of a trial and installer downloads), browser and operating system information, approximate region and pseudonymous identifiers. Analytics cookies are only set with your consent, except in the United States, where they are on by default and you can turn them off (see section 14).
  • Cookies and local storage: we use analytics cookies (subject to your consent) and the browser’s local storage to remember your cookie choice. You can restrict them from your browser settings.

c) Information we do NOT collect:

  • The activity the Application generates (simulated mouse movements, clicks, scrolling, keystrokes and application switching) and its settings are created and stored locally on your computer; they are not sent to our servers or to third parties.
  • The Software does not monitor, record or transmit the content of your screen, your keystrokes, your browsing activity, your files or any personal content from your device.
  • We do not collect biometric data, personal tax identification numbers or identity documents, except for the strictly necessary billing data.

4. Purposes of processing

We process your information for the following purposes:

  • Provide and manage the Service: create and manage your subscription, issue and validate license keys, deliver updates and enforce the license terms.
  • Communication and support: respond to your requests, send transactional emails (license keys, subscription confirmations) and provide customer service.
  • Billing: manage the recurring subscription charge through the payment processor.
  • Site improvement: analyze aggregated and pseudonymous reports to understand usage and improve performance, content and experience.
  • Security and fraud prevention, and compliance with legal obligations.

5. Data Subject authorization

The processing of your data requires your prior, express and informed authorization, which is obtained upon registration, contracting or use of the Service, or by other suitable means. The processing of sensitive data, when applicable, will require explicit authorization; as a general rule we do not request sensitive data. You may revoke authorization at any time, without prejudice to legal or contractual retention obligations.

In the desktop app, authorization is given by ticking a specific checkbox, separate from the acceptance of the Terms and unticked by default. We keep proof of each authorization: the date and time, the version of this Policy and of the Terms, a hash of the license key and of the device identifier, and the version and operating system of the app.

6. Data of minors

The Service is not directed to minors under eighteen (18) years of age and we do not knowingly collect data from minors. If we become aware that we have collected data from a minor without the corresponding authorization, we will take steps to delete it.

7. With whom we share your information

We do not sell, rent or commercialize your personal information. We share data with the following Processors and providers, solely for the purposes described:

  • Dodo Payments, our Merchant of Record, and its payment processors: they receive your name, email, country and payment details to process the subscription, calculate taxes and issue receipts. Their processing is also governed by Dodo Payments’ privacy policy.
  • Google (Google Analytics 4): receives pseudonymous identifiers and data on usage, device, referral, page and approximate location. Advertising features are disabled.
  • Hosting, content delivery (CDN) and security providers: may process IP addresses, request headers and device information to deliver and protect the site.
  • Email/support provider: to manage communications with you.
  • Authorities: we may disclose information when required by law, a court order or a valid request, or to protect our rights or the safety of third parties.

8. International transfers and transmissions

Some of our providers are located outside Colombia, mainly in the United States: Amazon Web Services (hosting of the website and the license server, and email delivery), Cloudflare (CDN and security), Google (Google Analytics 4 and the support mailbox) and Dodo Payments (payments). Consequently, your data may be subject to international transfer or transmission. Such operations are carried out in accordance with Law 1581 of 2012 and Decree 1074 of 2015, adopting the required safeguards. By accepting this Policy, you authorize such transfers and transmissions for the purposes described herein.

9. Disclosure method and transmission security

Data sent to third-party providers is transmitted via HTTPS/TLS. Payment data is transmitted directly from your browser to the payment processor’s servers and is not stored in our infrastructure. License and device data is transmitted via HTTPS to our API server.

10. Data retention

We retain account and license data for the duration of your subscription and for a reasonable period thereafter, to handle disputes, reactivations or legal obligations (for example, accounting or tax). Proof of the authorization and of the acceptance of the Terms is kept for as long as we process your data and for the additional time needed to handle claims or requests from authorities; technical request logs are deleted after 90 days. Contact form data is retained for the time necessary to handle your request. Analytics data is retained according to the applicable configuration. Once the purposes are fulfilled, the data is deleted or anonymized, unless there is a legal retention obligation.

11. Security measures

We adopt reasonable technical, human and administrative measures to protect your information, including:

  • Encryption in transit (TLS/HTTPS) of communications.
  • Secure payment handling: we do not store or have access to your full card data; processing is performed by a PCI DSS certified provider.
  • Access controls: administrative access is restricted to authorized personnel and protected by authentication.
  • Data minimization: we limit collection to the categories described in this Policy.

However, no method of transmission over the Internet or electronic storage is completely secure. To the extent permitted by law, we do not guarantee absolute security and will not be liable for unauthorized access or disclosures that occur despite the implementation of reasonable measures, except for willful misconduct or gross negligence.

12. Rights of Data Subjects (Habeas Data)

In accordance with article 8 of Law 1581 of 2012, you have the right to:

  • know, update and rectify your personal data;
  • request proof of the authorization granted;
  • be informed, upon request, about the use given to your data;
  • file complaints with the Superintendence of Industry and Commerce (SIC) for infringements;
  • revoke the authorization and/or request the deletion of the data when there is no legal or contractual duty to retain it;
  • access your personal data being processed free of charge.

13. Procedure for inquiries and claims

To exercise your rights, write to us at [email protected]. Inquiries will be answered within a maximum term of ten (10) business days, extendable by five (5) business days. Claims will be handled within a maximum term of fifteen (15) business days, extendable by eight (8) business days, in accordance with articles 14 and 15 of Law 1581 of 2012. Before filing a complaint with the SIC, the Data Subject must exhaust the inquiry or claim procedure before the Controller.

14. Cookies and analytics; opt-out

We use Google Analytics 4 with Google Consent Mode. Outside the United States, analytics cookies are only set after you click “Accept” in the cookie notice; until then, or if you reject them, Google Analytics only receives cookieless signals, without identifiers that persist across visits. In the United States they are on by default and you can reject them in the notice. You can change your choice at any time from “Cookie settings” at the bottom of the site, delete cookies from your browser, or use the opt-out add-on available at https://tools.google.com/dlpage/gaoptout. We do not use advertising cookies. Blocking analytics does not prevent you from browsing the site.

15. Third-party links

The site may contain links to third-party sites (for example, the payment processor’s billing portal or social media). We are not responsible for the privacy practices or content of those sites; we recommend reviewing their policies before providing information.

16. Validity of the Policy and databases

The first version of this Policy has been in effect since September 28, 2026, and this version (2026-10-20) since October 20, 2026. The databases managed by the Controller will be kept for as long as necessary to fulfill the purposes described or while there is a legal or contractual obligation to retain them.

17. Changes to this Policy

We may update this Policy at any time. When we do, we will revise the “Last updated” date. Continued use of the site or the Software after the publication of the changes constitutes acceptance of the revised Policy.

18. Governing law and supervisory authority

This Policy is governed by Law 1581 of 2012, Decree 1074 of 2015 and other applicable Colombian regulations. The competent authority for personal data protection is the Superintendence of Industry and Commerce (SIC), through the Delegate for the Protection of Personal Data.

19. Contact

For questions or requests about this Policy or the processing of your data, contact us at [email protected]. Controller: FATTY OINK S.A.S. — NIT 902.114.793-4 — Calle 118 # 12-40, Bogotá D.C., Colombia.

20. Users outside Colombia

If you live in another country, you may have additional rights under local law (for example, the EU General Data Protection Regulation, Brazil’s LGPD or US state privacy laws), such as accessing, correcting or deleting your data, objecting to its processing or requesting its portability. We process your data only for the purposes of this Policy, on the basis of performance of the contract (providing the Service and managing your license), compliance with legal obligations and our legitimate interest (security, fraud prevention and improving the website). We do not sell your personal data or share it for targeted advertising. To exercise any of these rights, write to us at [email protected].