What data of yours Kapa21 processes, and what you can do about it.

TROY BIT SPA, RUT 78.004.889-1, registered at Vergara 196, Concón, Valparaíso Region, Chile.

For anything concerning your personal data, including exercising your rights, write to misdatos@contacto.kapa21.cl. That is the address kept operational to receive and answer those requests.

Kapa21 has not yet appointed a data protection officer. Until it does, requests are handled through that same address.

If you only visit the site

With Google Analytics, an analytics identifier and browsing data —pages viewed, where the visit came from, device type— are processed for the purpose of measuring use of the site. The IP address is truncated before being stored.

The basis is your consent, requested on arrival and withdrawable at any time. If you do not give it, Google Analytics does not load and the site works exactly the same. The «Accept / Don't measure» choice controls Google Analytics only.

Separately, and always, the site uses Vercel Web Analytics and Speed Insights, for security and proper operation of browsing. They use no cookies and do not identify you: they record, in aggregate, which pages load and how long they take, to detect failures, abuse and performance problems. That is why they do not depend on your choice about Google Analytics.

If you create an account

• Identification — full name, RUT, phone and email. To identify you as the data subject, meet know-your-customer requirements and communicate with you.
• Acceptance of terms — which version you accepted, when, and from which IP address. So that the exact text you accepted can be evidenced.
• Transaction data — balances, movements and receipts. To provide the service and keep the accounting record.

The basis is performance of the contract you accept on registering and, where applicable, compliance with legal obligations, principally tax and anti-money-laundering.

About your financial situation

Chilean law treats socio-economic situation as sensitive data. Any processing that classifies clients by their balance will require your express and specific consent, which will be requested separately and not inside the general terms. Kapa21 does not carry out that classification today.

If that changes, this policy will be updated before it begins and will state the logic applied and the consequences envisaged for you.

In that case you will have the right to an explanation, to human intervention, to express your point of view, and to request a review of the decision.

• Supabase — Supabase Pte. Ltd., Singapore. Database and authentication: stores your account, your identity document, your transactions and your consent history. The data sits in São Paulo, Brazil; the company manages it from Singapore. Its policy.
• Vercel — Vercel Inc., United States. Hosting and running the site, which runs in São Paulo, Brazil; and also Web Analytics and Speed Insights: aggregate, cookie-free measurement of which pages load and how long they take. Its policy.
• Resend — Plus Five Five, Inc., United States. Delivery of the emails Kapa21 sends you. Receives your address and the message content. Its policy.
• GoHighLevel — HighLevel LLC, United States, with subcontractors in India. Commercial management. Receives your name, email, phone and the record of what we discussed. Added on 2026-09-02. Its policy.
• Google Analytics — Google LLC, United States. Usage measurement, only if you consent. Receives a visitor identifier and browsing data; the IP address is truncated before storage. Its policy.
• Sentry — Functional Software, Inc., United States. Technical error logging. Receives what broke and on which screen, so it can be fixed. It does not receive who you are: cookies, headers, address parameters and any national ID, email, phone number or bank account number appearing inside the error message are stripped before anything is sent. Added on 2026-09-08. Its policy.
• Mercado Pago — Mercado Pago Operadora S.A., RUT 76.516.950-K, Chile. Processes the card payments you make to Kapa21. It receives what you enter in its payment form —your card details and the email it asks for— together with the amount and description of the purchase. Kapa21 does not send it your name, national ID or email, and does not see your card number. It also receives the transfer you make to verify your bank account, with the origin account details your bank provides; we return that amount to the same account. Unlike the others, Mercado Pago processes that data on its own behalf, as a controller, under its own policy.

Outside Chile

Except for Mercado Pago, all of them process the information outside Chile, so there is an international transfer of data to three countries:

• Brazil — where the database is stored and where the site runs (Supabase and Vercel).
• United States — where emails are sent, errors are logged, commercial management takes place and usage is measured (Resend, Sentry, GoHighLevel, Google), and where Vercel is headquartered.
• Singapore — Supabase’s headquarters, from where it manages the service.

The safeguards. With each of the six, Kapa21 has a data processing agreement (DPA) that incorporates the European Union’s standard contractual clauses, which bind the provider to process the data only on instructions, with security measures and without passing it on. Five of them —Vercel, Resend, HighLevel, Google and Sentry— are also certified under the EU-US Data Privacy Framework; Supabase is not, and relies on the standard clauses alone.

And what is still missing, plainly: the Personal Data Protection Agency has not yet published the list of countries with an adequate level, nor its own model clauses. Until it does, these transfers rest on the contractual safeguards described above, which is what the law allows while that list does not exist. When the Agency publishes its clauses, Kapa21 will adopt them and update this policy.

It is kept while the relationship exists and, afterwards, for the periods the law requires. Once those periods are over, it is deleted or anonymised. These are the periods, by type of data:

• Identity document — 5 years from the end of the relationship. Law 19.913, article 5: obliged entities keep special records for a minimum of five years.
• Acceptance of terms and contracts — 6 years. They are the proof of what you accepted and when.
• Audit trail — 6 years. Internal control and proof.
• Rights requests — 6 years from the reply, to show the Agency that Kapa21 answered.
• Withdrawn consents — 1 year from withdrawal.

Transparently about this table: these periods are written into the system and are the ones the deletion job runs, not a separate statement. Four of the five rules are paused pending legal validation: today data is kept longer, never less.

Law 19.913, which creates the Financial Analysis Unit (UAF), is what allows and requires keeping some of this data even if you request its deletion. It is not an excuse: it is an obligation with a name, an article and a deadline, and when that deadline passes the data is deleted.

Two records are immutable by design: the accounting record and the audit log. They cannot be altered or deleted, because their value lies precisely in nobody being able to rewrite them. If you request erasure, you will be told exactly what is deleted, what is anonymised, and what must be kept by legal obligation.

• Access — to know whether Kapa21 processes data about you, what it is, where it came from, what it is used for, who receives it and for how long.
• Rectification — to correct data that is wrong, out of date or incomplete.
• Erasure — to ask for it to be deleted, in the cases the law provides for.
• Objection — to ask that a particular processing not be carried out.
• Portability — to receive a copy in a structured, commonly used electronic format, and to have it transmitted to another controller.
• Blocking — to temporarily suspend a processing while your rectification, erasure or objection request is resolved.

Access, rectification, erasure and objection are free of charge. If you gave consent for something, you can withdraw it at any time, without giving a reason and by the same means you gave it; withdrawing it does not affect the lawfulness of processing carried out beforehand.

How to exercise them, and within what deadline

Write to misdatos@contacto.kapa21.cl stating which right you are exercising and over what data. Kapa21 responds within 30 calendar days, extendable once by a further 30. A temporary blocking request is answered within 2 business days.

If you have an account, you can also do it yourself under My data (in Spanish): view and download your data, correct it, give or withdraw your consent, review the history of what you accepted, and request erasure, objection, portability or blocking. The deadlines are the same through either channel.

If Kapa21 rejects your request or fails to answer in time, you may complain to the Personal Data Protection Agency.

Each person and each company can only see their own data, and that separation is verified by automated tests that run on every change.

The accounting record cannot be modified from a client account. Whoever operates the platform is subject to second-factor authentication and separation of duties.

In the event of a security breach posing a reasonable risk to your rights, Kapa21 will notify the Agency within 72 hours of becoming aware of it, and will notify you without undue delay, stating which data was affected and what was done about it. If not everything is known at 72 hours, notice is given anyway with what is known: the deadline runs from becoming aware of the breach, not from fully understanding it.

First-party and necessary

No permission is asked for these: without them the site cannot know it is you. They only exist if you have an account.

• Session cookie (its name starts with sb- and ends in -auth-token) — keeps your session open after you sign in. It lasts while the session is active and is deleted when you sign out.
• k21_volver — remembers which page you wanted to reach when we asked you to sign in, to take you there afterwards. It lasts 2 hours and is read only by the server.

Measurement, only with your permission

If you choose «Measure» in the notice, Google Analytics sets the _ga and _ga_* cookies, which store a visitor identifier for up to 2 years. If you choose «Don’t measure», they are not set and the site works the same.

Vercel Web Analytics and Speed Insights, which measure in aggregate which pages load and how long they take, do not use cookies. Mercado Pago’s payment form may use its own: they are governed by its policy, not this one.

Your decision

The «Measure / Don’t measure» choice is not stored in a cookie but in your browser’s local storage, together with the version of this policy you decided against. Each new version asks again.

To change it today you have to clear this site’s data in your browser: the notice appears again and Google Analytics stops loading until you accept it again. A control on the page to change it without clearing anything is missing; it is stated here until it exists. In the meantime, you can also request it by email at misdatos@contacto.kapa21.cl.

• 2026-10-08 — Each recipient now has its own record: legal name, what it receives, in which country it processes it and a link to its policy; it is explained that Mercado Pago is Chilean and processes on its own behalf; the international transfer (Brazil, United States and Singapore) and the contractual safeguards covering it are detailed; and a «Cookies» section is added, naming each cookie and its lifetime.
• 2026-09-16 — Mercado Pago is added as a recipient; it is explained that Vercel Web Analytics and Speed Insights always run, without cookies, for security and proper operation; the «My data» screen is described; and two statements that were no longer true are removed: that Kapa21 did not operate with clients or real funds, and that it had no retention periods.
• 2026-08-14 — First published version. GoHighLevel (2026-09-06) and Sentry (2026-09-08) were later added as recipients without changing the version.