Data Deletion Instructions

1. What data we delete

When you request deletion, we may delete the following, depending on the type of data subject you are:

1.1. If you are a merchant (business owner or staff)

• Your user account and access credentials.
• Your name, email, phone and employment details.
• Business configurations associated only with your profile (not those shared with the team).
• Integration tokens with your social networks or WhatsApp if they are linked only to your personal account.

If you are the sole administrator of the business, deleting your account means terminating the subscription and deleting the entire company (see section 8).

1.2. If you are an end customer of the business

• Your name, document type and number, email, phone.
• Addresses and geographic coordinates saved for deliveries.
• Vehicle data (car washes, parking lots).
• WhatsApp messages linked to you and attached files where legally applicable.
• Attached documents (for example, a copy of your ID).

2. How to request it

Write to contacto@phantomsoft.io with the subject line “Data deletion request” and include:

1. Your full name.
2. Your document number (national ID, tax ID, or other as applicable).
3. A legible copy of your ID document or a special power of attorney if you are acting on behalf of another person.
4. The email or WhatsApp number you used to interact with PhantomApp (if you remember it).
5. A clear description of what you want to delete (your entire account, only conversations, only certain data, etc.).
6. Address or email where we can officially respond.

If the business you interacted with is still active in PhantomApp, you can also ask that business, as data controller, to delete your information. PhantomApp supports you in making this happen.

3. Response time

We respond within 15 business days of receiving your complete request, with the possibility of extending the term by up to 8 additional business days when the complexity of the request requires it, as provided in article 15 of the Colombian Data Protection Law (Ley 1581 de 2012).

If we need additional information to identify you or understand the scope of the request, we will contact you; the term starts running when we receive the required information.

4. What we keep by law

Some data cannot be deleted immediately because a rule requires us to keep it. In particular:

• Invoices and tax documents: minimum 5 years (Colombian Tax Statute).
• Accounting and audit records: up to 10 years according to the Colombian Commercial Code.
• Proof of consent: for the duration of the relationship plus the statute of limitations for any resulting legal actions.
• Information requested by a competent authority: for as long as the authority requires it.

In those cases, we mark your profile as deleted, limit access to the minimum authorized staff and remove the remaining data once the legal obligation expires.

5. What happens technically

1. Identity verification: we verify that you are in fact the data subject or a duly authorized representative.
2. Immediate logical deletion: we mark your profile as deleted and you stop appearing in the product.
3. Physical deletion: within the following 30 days we permanently remove data that is not subject to legal retention obligations.
4. Propagation to sub-processors: we send the relevant deletion requests to external services (Meta, Firebase, Supabase, etc.) and follow up until the action is confirmed.
5. Confirmation: we send a communication to the email you indicated with details of what was deleted and what was retained.

6. Data sent via WhatsApp

If you request deletion of your conversations with a business that uses PhantomApp and WhatsApp Business:

• We delete the conversation history stored on our servers associated with your number or your document (messages, files, internal agent notes).
• We delete the consent events associated with the WhatsApp channel.
• Meta, as the operator of the WhatsApp platform, maintains its own retention policy. You can exercise your rights directly before Meta at facebook.com/help/contact/507739850846588.

7. Deletion at sub-processors

PhantomApp shares data with technical providers (see section 4 of the Privacy Policy). When we receive a deletion request:

• We execute the deletion APIs available at each provider.
• For providers without an API (or with their own retention windows) we wait for the time required by their policy and follow up.
• If a sub-processor does not allow effective deletion within a reasonable period, we inform you transparently.

8. Consequences of the request

Deletion is irreversible. Before executing the action, please keep in mind:

• You will lose access to your account. We will not be able to restore the deleted information.
• If you were the sole administrator of the business, the business account is also terminated and staff lose access.
• Electronic invoices already issued remain on file with DIAN by legal obligation, regardless of this deletion.
• If you had a payment in progress, we will refund what is due according to the Terms & Conditions.

Have questions before requesting it? Write to us at contacto@phantomsoft.io and we will guide you.