Privacy notice

Controller: PICK S.A.S., NIT 902051012-9, domiciled in Bogotá D.C., Colombia.

Address: Calle 97A # 7A-24, Bogotá D.C. Phone: 311 331 5304.

Official privacy channel for Habeas Data, inquiries, complaints, deletion, and consent revocation: pickglobalcontact@gmail.com.

The policy applies to users, prospects, support requesters, sponsors, contractors, partners, and other data subjects whose data Pick processes.

Identification and contact data: name, email, WhatsApp number, and city; phone number or other data if shared through support or a commercial relationship.

Account and authentication data: email, AWS Cognito-managed password, confirmation of legal age, confirmation status, IP address, user-agent, sign-up bot check, and safety events.

Profile and product data: cities, interests, bio, photo, age, gender, LinkedIn/Instagram links, matches, match codes, generated introductions, and WhatsApp clicks.

Product usage events, stored by Pick in its own database: sign-up with the source campaign, sign-ins, profile completed or updated, suggestions viewed, introductions generated, WhatsApp opens, hidden suggestions, reports, and account deletion.

Optional measurement, only if you authorize it: page views and journey steps recorded by Meta Pixel, plus sign-up, completed-profile, and WhatsApp-open events that Pick sends to Meta with your hashed email and phone number, IP address, and browser.

Support, reports, and feedback: requests, abuse reports, private reasons for hiding suggestions, the reason you choose when deleting your account (stored without identifying you), messages or comments sent to @pick.global on Instagram or Facebook, context submitted by the data subject, and response traceability.

Commercial, contractual, sponsor, contractor, billing, and compliance data when there is a relationship with Pick.

Pick does not request sensitive data in free-form fields. If a data subject voluntarily shares it, Pick handles it with minimization, security, and deletion when no longer needed.

Create and administer accounts; ask users to confirm they are of legal age; prevent fraud, abuse, spam, automated sign-ups, and impersonation.

Complete profiles, suggest matches based on shared cities and interests, generate AI-assisted introductions, and enable WhatsApp communications when the user opens the link.

Understand who makes up the community through aggregate age and gender statistics, and let each user filter their new suggestions by age and gender. Age and gender are required in the profile and do not rank suggestions.

If the user adds their Instagram to the profile, message them directly from the official @pick.global account to thank them, ask about their experience, invite them to community plans, or share Pick news. They can ask us to stop at any time by replying to the message or writing to pickglobalcontact@gmail.com.

Handle safety, report review, hidden suggestions, account suspension, support, feedback, inquiries, complaints, and Habeas Data requests.

Measure product activation and quality with first-party usage events that are not shared with third parties; campaign measurement with Meta or marketing only with separate, revocable authorization.

Comply with legal, contractual, accounting, tax, evidentiary, and dispute-resolution obligations.

Primary bases: prior, express, and informed authorization; performance of the agreement or pre-contractual steps; legal compliance; and exercise or defense of rights when applicable.

AWS (Cognito, API Gateway, Lambda, S3/CloudFront) for authentication, execution, safety, and media.

MongoDB Atlas for operational storage, including product usage events; AWS Bedrock for generated introductions using minimal context data.

Cloudflare (Turnstile) checks that sign-ups are not made by bots; it receives the IP address and technical browser data.

WhatsApp receives the text and metadata when the user opens the deep link to continue outside Pick.

Meta (Meta Pixel and Conversions API) only receives data if the data subject authorizes optional measurement: journey events and, from Pick's server, hashed email and phone number, IP address, and browser, to measure campaigns.

Instagram and Facebook (Meta Platforms) process the direct messages Pick sends from @pick.global and the messages or comments people send to those accounts.

Sponsors receive aggregate metrics or information needed for sponsored mechanics; Pick does not share individualized contact data without explicit authorization.

Data may be stored or processed outside Colombia using reasonable contractual, technical, and organizational safeguards.

Access, update, correct, and delete personal data.

Request proof of authorization, be informed about how data is used, submit inquiries and complaints, and revoke authorization when applicable.

Escalate to the Colombian Superintendence of Industry and Commerce when appropriate, especially if the data subject disagrees with Pick's response.

Send the request to pickglobalcontact@gmail.com with full name, identity document type and number, email or response channel, clear description, and supporting evidence if applicable.

Inquiries: response within 10 business days from receipt. If an extension is needed, Pick will explain the reason and new response date, not exceeding 5 additional business days.

Complaints, corrections, deletion, or revocation: response within 15 business days. If an extension is needed, Pick will explain the reason and new response date, not exceeding 8 additional business days.

For deletion, Pick verifies identity, locates the data, assesses legal or contractual retention duties, and deletes, anonymizes, or blocks what applies.

Each request must leave an internal trail of receipt, classification, responsible owner, response date, result, and support sent to the data subject.

Account and profile data are retained while the user relationship exists and for the time needed for legal, contractual, or evidentiary obligations.

Usage events, operational logs, reports, clicks, and safety events are retained for up to 12 months unless a legal, evidentiary, or safety reason requires longer retention.

Backups may be retained for up to 90 days. When backups are restored, applicable deletion rules will be re-applied.

Pick applies reasonable security controls, restricted access, encryption in transit, and operational traceability. Incidents will be documented and reported when legally required.

This policy is effective as of 2026-10-01 and remains in force while PICK S.A.S. processes personal data or until replaced by a new version.