Privacy Policy

Translation notice: this page is a courtesy translation of the Política de Privacidad in Spanish. If there is any difference between the two versions, the Spanish version governs, as it is the one issued under Peruvian law (Law No. 29733).

Reference standard: Law No. 29733, Personal Data Protection Law of Peru, and its regulations currently in force, Supreme Decree No. 016-2024-JUS (in force since March 30, 2025).

Version of this document: 2026-09-27.
Effective date of this version: September 27, 2026.

1. Identity and address of the owner of the personal data bank

Company name	Codart S.A.C.
RUC (tax ID)	20547734476
Registered address	Av. Jorge Basadre Este 381, San Juan de Lurigancho, Lima, Peru
Contact email for privacy matters	contacto@codart.pe

Codart is responsible for the processing of the personal data collected through its landing page and the "LandingChat" chat widget embedded in it (codart.pe and www.codart.pe).

2. What data is collected and how

2.1 When you write in the chat

The content of the messages the visitor writes to the virtual assistant, and the reply generated by the system.
A visitor identifier (visitor_id) and a conversation identifier (conversation_id), generated automatically by the browser and stored only on the visitor's own device (see §8). They do not identify the person on their own; they group the messages of a single conversation.
The URL of the page from which the chat was opened, stored without query parameters (?...) or fragment (#...): only the domain and the path (for example https://codart.pe/servicios, never https://codart.pe/servicios?utm_campaign=...). It is used to know which page a request came from.
The visitor's IP address and user-agent are not stored in conversations or messages.

2.2 When you leave your contact details (the "lead" form)

When the assistant does not have a reliable answer, or the visitor asks for it, a contact form may be offered. It collects the following, only if the visitor enters them:

Name.
Email address and/or phone number (at least one of the two is required).
An additional message, if the visitor writes one.
The consent checkbox, explicitly ticked, and the version of the consent text the visitor accepted (see §9).
The same page URL (origin + path, without parameters) and the reason the form was offered.

This data is stored so that the Codart team can get in touch with the visitor about that inquiry.

2.3 Technical data, usage limits and security

To prevent abuse (for example, a single origin sending too many messages in a short time), the system applies usage limits by IP address and by account, temporarily and in server memory: they are not stored permanently or linked to an identity. This check does not identify the person; it only counts how many requests arrived from the same technical origin within a short time window, to avoid overload and misuse of the service.
The widget does not use third-party cookies. The information that persists in the browser lives in localStorage, which belongs exclusively to the visitor's device (see §8).

3. What this data is used for (purpose)

The data the visitor shares through the chat or the contact form is used only to:

Answer their inquiry within the chat conversation itself (the virtual assistant uses the message to generate a reply about Codart's products and services).
Contact them, if they left their details in the form, to discuss their inquiry or to schedule the advisory session or free consultation they requested.
Security and abuse prevention of the chat service itself (avoiding overload, spam or misuse of the contact form).

This data is not used for advertising, profiling, sale to third parties, or any purpose other than the ones above.

4. Legal basis: consent

The processing of the contact form data is based on the visitor's prior, informed, express and unequivocal consent, in accordance with article 5 of Law No. 29733.

The chat itself (answering the question within the conversation) can be used without providing any additional personal data: anyone can talk to the assistant without identifying themselves.
For the contact form, the visitor must expressly tick the consent checkbox before sending their data (see the exact text in §9). If they do not tick the checkbox, the form is not sent and their contact details are neither stored nor shared with anyone; they can keep using the chat as usual.
Consent can be withdrawn at any time by writing to contacto@codart.pe, without affecting the lawfulness of the processing carried out before its withdrawal. When consent is withdrawn, the lead's data is deleted within the cancellation period set out in §6.

5. Data processors and international transfers

Codart uses external providers to operate the chat service. Each one acts as a data processor (or, in the case of AI model providers, as a sub-processor within the OpenRouter chain) and receives only the data strictly necessary to provide its service. All of these providers are located outside Peru:

Provider	What data it receives	Purpose	Country / region
Hostinger	The service's whole database (conversations, messages, leads) and the server logs	Hosting of the server and the database	United States (Phoenix, Arizona)
Zoho Mail	The notification email that arrives in the contacto@codart.pe mailbox, with the lead's data	Receiving the notifications in the Codart team's mailbox	United States
Resend	The lead's name, email, phone and message, and the origin page URL	Sending the notification emails to the Codart team	United States
OpenRouter (with DeepInfra and CoreWeave, backup from OpenAI via Microsoft Azure)	The text of the visitor's message, the recent conversation history and the fragments of Codart's web content relevant to the reply	Generation of AI replies and computation of semantic similarity	United States, with a no-retention policy (Zero Data Retention, ZDR)
Cloudflare	None: it only distributes the widget file (code, no visitor data)	Distribution of the chat script through its global network	Global network; it does not receive the form data

Processing by AI providers under a no-retention policy (ZDR). Chat messages and related content searches are processed by artificial intelligence model providers contracted under a Zero Data Retention (ZDR) policy: these providers do not retain the messages or use them to train their models, beyond the time strictly necessary to generate the reply.

As these providers are located outside Peru, personal data is sent in accordance with the provisions of Law No. 29733 on cross-border flow of personal data, requiring each provider to commit contractually to confidentiality and to adequate handling of the personal data it receives.

6. Retention period

Chat conversations (messages and replies) are kept for 6 months from the last message in the conversation, and then deleted automatically.
A lead's data (name, email, phone and contact form message) is kept for 12 months from the last contact with that person, and then deleted automatically. It is deleted earlier if the person requests cancellation of their data or withdraws their consent (see §4 and §10).
Database backups are kept on a rotating basis for 14 days, and then overwritten.
The execution logs of the automation engine (n8n) that end in an error are kept for at most 72 hours, and then deleted automatically. Successful executions are not stored: the automation engine does not keep a message history; it only processes each message and discards it.
The AI model providers used to generate replies and searches are configured with the no-retention policy (ZDR) described in §5.

7. Security measures

Codart applies reasonable technical and organizational measures to protect the personal data it processes, including:

Encrypted communication (HTTPS) between the visitor's browser and the service's servers.
Isolation of each company's account data, so that only that company and Codart can access it.
Access control to administrative information through credentials, and restricted access to the internal administration systems.
Validation of the links and content shown to the visitor, to prevent the injection of malicious links or content into the chat's replies.

For security reasons, this document does not detail the technical architecture or the specific defense measures of the system.

In accordance with the regulations currently in force under Law No. 29733 (Supreme Decree No. 016-2024-JUS), Codart has internal procedures to handle security incidents that may affect personal data, including notifying the National Authority for Personal Data Protection and, where appropriate, the affected individuals, within the deadlines and under the criteria set by those regulations. The operational details of these procedures are not published here for security reasons.

8. Local storage in the browser (localStorage)

The chat widget stores two items in the visitor's browser localStorage (it does not use third-party cookies):

A visitor identifier (visitor_id), generated randomly by the browser itself.
A conversation identifier (conversation_id), so the same conversation can continue if the visitor reloads the page.

These identifiers are stored only on the visitor's device, and the code is designed to keep working (without persistence between visits) if the browser blocks or does not support localStorage (for example, in private mode). The visitor can delete them at any time from their browser settings ("clear browsing data" or similar).

In addition, this site stores display preferences in the visitor's browser (language, theme and currency: lc_lang, lc_theme and lc_currency). They contain no personal data, are not sent to Codart, and the visitor can delete them at any time from their browser settings.

9. Consent for the contact form

When sending the chat's contact form, the visitor sees and must tick the following text:

"I authorize Codart to use my data (name, email and phone) solely to contact me about this inquiry, in accordance with its Privacy Policy, including the use of external processing providers (sending emails and generating replies through artificial intelligence) described in it."

(version 2026-09-27)

If they do not tick the checkbox, the form is not sent and their contact details are neither stored nor shared with anyone; they can keep using the chat as usual.

10. ARCO rights and how to exercise them

Under Law No. 29733, the visitor who is the data subject has the right to:

Access: know what personal data of theirs Codart holds.
Rectification: correct inaccurate or incomplete data.
Cancellation (erasure): request the deletion of their data when it is no longer necessary for the purpose for which it was collected, or if they withdraw their consent.
Opposition: object to the processing of their data on legitimate grounds.
Portability: request that their personal data be delivered to them in a structured, commonly used format, or transferred to another controller, where applicable. This right was added by the regulations currently in force, Supreme Decree No. 016-2024-JUS.

To exercise these rights, the visitor can write to contacto@codart.pe, stating their name, the right they wish to exercise and, if possible, some detail that helps locate their request (for example, the email or phone number they left in the form). Codart will reply within the period set by Law No. 29733 and its regulations currently in force, Supreme Decree No. 016-2024-JUS.

If the visitor considers that their request was not handled or that their rights were not respected, they may file a complaint with the National Authority for Personal Data Protection (ANPD), part of Peru's Ministry of Justice and Human Rights.

11. Minors

Codart's chat is not directed at minors. Codart does not knowingly collect personal data from minors through this service. If a parent or guardian believes that a minor in their care left personal data in the contact form, they can request its deletion by writing to contacto@codart.pe.

12. Registration of the personal data bank

Codart's personal data bank is in the process of being registered with the National Registry of Personal Data Protection of the National Authority for Personal Data Protection (ANPD), as required by Law No. 29733.

13. Changes to this policy

Codart may update this Privacy Policy to reflect changes in the service, in the applicable regulations or in the providers used. Any change will be published on this same page, stating the date of the new version. If a change substantially affects the processing of data already collected with prior consent, Codart will request new consent when the law requires it.

Version history

2026-09-27 — first published version, approved by external legal counsel.

← Back to home