This policy complies with Colombian Law 1581 of 2012 and Decree 1074 of 2015 (which incorporates Decree 1377 of 2013). It explains how Phanteus processes personal data in its business services (Trebial Web, Trebial Commerce, Trebial POS), in Phanteus Account and in its commercial relationships. The Spanish version is the reference text.
In short: we use your data only to provide the service, keep it secure, invoice and comply with the law. We do not sell it or use it for third-party advertising. You can access, correct or ask us to delete it by writing to soporte.phanteus@gmail.com. If you are a customer of a store or site built with Phanteus, the controller of your data is that business; Phanteus only provides the technology.
1. Data controller
| Controller | GOMEZ S.A.S., operating under the Phanteus brand |
| Tax ID (NIT) | 902.058.719-9 |
| Domicile and address | Bogotá D.C. — Kr 24 # 22B-36, Los Mártires |
| soporte.phanteus@gmail.com | |
| Phones | +57 323 581 0259 · +57 310 461 3857 |
| Website | phanteus.com |
2. Scope, and when Phanteus is not the controller
This policy covers data Phanteus processes as Controller: its clients and their contact people, Phanteus Account users, people who write to us, providers and visitors to this site.
When Phanteus is not the controller: our clients’ sites, stores and points of sale collect data about their customers and contacts, such as orders, forms or point-of-sale buyers. There, the client business is the Controller and decides how that data is used. Phanteus acts as its Processor, on its behalf and under its instructions and the Data Processing Agreement. If you are a buyer or contact of one of those businesses, please direct your requests to it; if you write to us, we will forward them.
3. Definitions
- Personal data: information that identifies a person or makes them identifiable.
- Data subject: the person the data refers to.
- Processing: any operation on data: collecting, storing, using, transmitting or deleting it.
- Controller: whoever decides on the database and the processing.
- Processor: whoever processes data on the Controller’s behalf.
- Authorization: the data subject’s prior, express and informed consent.
- Transfer: sending data to another Controller.
- Transmission: communicating data to a Processor so that it processes it on the Controller’s behalf.
4. Principles
We process data under the principles of legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality set out in article 4 of Law 1581 of 2012, and we collect only the data needed for each purpose.
5. What data we process and why
| Data subjects | Data | Purposes |
|---|---|---|
| Clients and their contact people | Name, ID, company and tax ID, position, email, mobile, address, billing and payment details | Preparing proposals, contracting and providing the service, invoicing and collecting, support, service notices and legal, accounting and tax obligations |
| Phanteus Account users | Email, name, companies and role in each; one-time codes (valid for minutes); sign-in records (date, IP address, browser) | Identifying the person, giving access to their company’s products, protecting accounts, preventing fraud and keeping an audit trail |
| People who write to us | Name, company, email, phone and the content of their message | Replying, preparing proposals and, only with authorization, sending information about our services (you can opt out anytime) |
| Support requests | Whatever you send (messages, screenshots, descriptions) | Solving the case and improving the service |
| Providers and partners | Name, ID, contact and payment details | Contracting, paying and legal obligations |
| Visitors to phanteus.com | Technical data for each visit (such as the IP address) logged by the hosting provider | Serving the site and protecting it from abuse. This site uses no cookies, analytics or tracking |
We do not process sensitive data (health, ethnic origin, political or religious views, biometrics and the like) in our relationships with data subjects. Our services are not aimed at people under 18: accounts are for adults acting on behalf of a business.
6. Authorization
- We request your authorization before or when collecting your data, by means that allow it to be proven later: electronic acceptance, a checkbox, email or conduct that unequivocally shows it.
- Phanteus Account: the client business tells us which of its people may sign in. By registering them, it represents that it informed them of this policy and has their authorization. On first sign-in, each person accepts this policy.
- No authorization is required in the cases of article 10 of Law 1581: requests from authorities, public data, medical or health emergencies, historical, statistical or scientific purposes, and civil registry data.
7. Your rights
Under article 8 of Law 1581 of 2012, you have the right to:
- Access, update and correct your data.
- Request proof of the authorization you gave us.
- Be informed of how we have used your data.
- File complaints with the Superintendence of Industry and Commerce (SIC), after making your request or claim to us.
- Revoke authorization and request deletion, unless there is a legal or contractual duty to keep the data.
- Access your data free of charge.
8. How to exercise your rights
Channel: write to soporte.phanteus@gmail.com with the subject “Personal data”. Requests are handled directly by the Phanteus team. To protect your data, we may ask you to confirm your identity before answering.
Inquiries (what data we hold about you and how we use it):
- We answer within ten (10) business days of receipt.
- If we cannot, we will explain why and answer within five (5) business days after that deadline.
Claims (to correct, update or delete data, or if you believe we breached the law). Include:
- your name and ID;
- a description of the facts;
- an address or email for the reply;
- any supporting documents.
This is how we handle them:
- If a claim is incomplete, we will ask you to complete it within five (5) days; if two (2) months pass without that, we will consider it withdrawn.
- Within two (2) business days, we will tag your data as “claim in progress”.
- We answer within fifteen (15) business days; if we cannot, we will explain why and answer within eight (8) business days after that deadline.
9. Who we share data with
We do not sell personal data. We share it only with:
-
Providers that help us deliver the service, acting as processors under contract and only for that purpose:
Provider Purpose Server location Supabase (on Amazon Web Services) Databases and authentication for Phanteus Account and the services United States Vercel Hosting of the sites and Phanteus Account United States and global network Resend Automated emails (sign-in codes and notices) Brazil and United States Google (Gmail) Support email United States and others GitHub Platform source code (does not store client data) United States -
Payment gateways, only in our clients’ stores. The gateway (for example, Wompi) processes payment data under its own policy and as its own controller; Phanteus does not see or store card numbers.
-
Authorities, when a law or an order requires it.
-
Accounting and legal advisors, bound by confidentiality.
International transfers and transmissions. Some of these providers store data in the United States and other countries. The SIC included the United States in its list of countries with an adequate level of protection (Circular Única, Title V, as amended by External Circulars 005 and 008 of 2017). Each processor is bound by contractual terms requiring it to protect the data, as required by article 2.2.2.25.5.2 of Decree 1074 of 2015.
10. Security
We apply reasonable technical, human and administrative measures, including:
- encrypted connections (HTTPS);
- role-based access, with rules in the database itself so each person sees only their own data;
- encrypted secrets;
- one-time sign-in codes, with no passwords to steal;
- audit logs and our providers’ backups.
No system is infallible. If an incident affects your data, we will report it to the SIC and to the affected people, as the law requires.
11. How long we keep data
| Data | Period |
|---|---|
| Clients, contracts and invoicing | While the relationship lasts, then as long as accounting, commercial and tax rules require (generally ten (10) years for accounting records) |
| Phanteus Account | While the account exists; on deletion it is erased, except what the law requires us to keep |
| One-time codes | Minutes (they expire after 10 minutes) |
| Technical and sign-in logs | Twelve (12) months, unless needed to handle an incident or legal proceeding |
| People who wrote to us and did not contract | Up to two (2) years from the last contact, or until they request deletion |
12. Storage in your browser
- phanteus.com uses no cookies.
- Phanteus Account stores the account session in your browser (local storage) so you don’t need a new code on every visit. It is strictly necessary for the service and is not used for advertising or tracking. It is cleared when you click “Sign out”.
13. Changes to this policy
If we make material changes to this policy, for example to its purposes or providers, we will announce them before they apply, by email or in Phanteus Account. The version and last-update date appear at the top of this document.
14. Effective date
This policy is effective from October 29, 2026. The databases will remain in force while Phanteus provides its services and for the retention periods in section 11.