Privacy policy

1. Data controller

Controller

LILAB S.A.C., holder of Peruvian taxpayer ID (RUC) 20604947805

Registered office

Av. Canaval y Moreyra N.º 185, Dpto. 1403, San Isidro, Lima, Perú

Contact email

hola@lilab.io

Telephone

+51 994 616 555

Brand

Rigo One (https://lilab.io)

LILAB S.A.C. determines the purposes and the means of the processing described in this policy. For any matter related to your personal data, including the exercise of rights, the channel is hola@lilab.io.

2. Data we process

We process only the data you provide voluntarily and the data generated by your interaction with the demonstration:

Registration data

Name, work email address, country and, optionally, telephone number. They are collected in the demo access form together with your express authorization.

Commercial context data

Company, your role in the decision, whether your operation works in batches, the main challenge you face and the timeframe in which you want to address it. You answer these within the demo and every answer is optional.

Demonstration usage data

Guided tour events, such as opening the demo, the case chosen, its completion and the click on the link to schedule a conversation. Each type of event is recorded only once per person.

Evidence files and their metadata

The test documents you decide to attach, together with the fictitious batch, the action, the perspective used, the reference and the note you write when confirming it.

Messages to the assistant

The text you write to the commercial assistant on the site, when you use it.

Technical data

A session cookie with an opaque identifier, and the technical logs generated by our infrastructure providers, such as IP address and request data, for security and diagnostic purposes.

Aggregated browsing data

Google Analytics records page views, source of the visit, device type and usage events such as opening the demo or starting a guided tour, with the IP address anonymized. You can object to this measurement with the mechanisms described in the Cookie policy.

We neither request nor need sensitive data, nor confidential information about your company. We expressly ask you not to include it in the files or in the texts you write within the demo: the batches in the demonstration are fictitious and require no real information.

3. Purposes and legal basis

Enable your access to the demonstration

Legal basis: consent of the data subject (Law 29733, art. 5). For EEA visitors: performance of pre-contractual measures at your request (GDPR art. 6(1)(b)).

Keep and display the files you attach

Legal basis: consent. Without this processing, the evidence function of the demo cannot be provided.

Respond to your interest and contact you about the product

Legal basis: express consent given by ticking the box on the registration form. You may withdraw it at any time.

Understand which parts of the product are relevant and better prepare the commercial conversation

Legal basis: consent. For EEA visitors: legitimate interest in assessing the commercial interest of whoever requests a demonstration (GDPR art. 6(1)(f)).

Measure in aggregate how the site is used in order to improve it

Legal basis: legitimate interest in knowing how the site is used in order to improve its content, with aggregated data and anonymized IP. You may object at any time, without losing any function, as explained in the Cookie policy.

Keep the site secure, prevent abuse and diagnose faults

Legal basis: legitimate interest in protecting the integrity and the availability of the service.

Comply with legal obligations that apply to us

Legal basis: compliance with a legal obligation.

We do not use your data for third-party advertising, we do not sell it and we do not transfer it for commercial purposes.

4. Automated assessment of interest

With the context data you answer and the guided tour events, we calculate two internal indicators: fit (how closely your operation resembles those the product is designed for) and intent (how advanced your interest is). The calculation is an explicit, deterministic formula over what you declared; it does not infer attributes you have not reported, it does not consult external sources and it does not use profiles acquired from third parties.

These indicators serve only to prioritize the order in which we attend to requests and to prepare the conversation. They produce no legal effects concerning you and do not similarly affect you significantly: every contact decision is taken by a person. In any case, you may request a human review of this assessment and object to it by writing to hola@lilab.io.

5. Recipients and data processors

We do not transfer your data to third parties for their own purposes. To provide the service we rely on the following providers, which act as data processors under contract and with an obligation of confidentiality:

Vercel Inc. (United States)

Hosting of the site and execution of the server functions.

Vercel Blob

Private storage of the evidence files you attach.

Turso / ChiselStrike Inc.

Database where the registration, the session, the events and the file metadata are kept.

OpenAI, L.L.C. (United States)

Processing of the messages you write to the commercial assistant, when this function is active. Neither your email address nor your telephone number is sent to it.

Google LLC

Two distinct services: Google Analytics 4, for the aggregated measurement of site usage, and the scheduling calendar, only if you decide to book a conversation through the corresponding link. In both cases your data is also processed in accordance with the Google privacy policy.

We may also disclose data to the competent authorities when there is a legal obligation to do so.

6. International transfers

The providers indicated process the data on servers located outside Peru, mainly in the United States. By registering and accepting this policy, you give your consent to the cross-border flow of your personal data in accordance with article 15 of Law No. 29733.

For visitors from the European Economic Area, these transfers are covered by the Standard Contractual Clauses approved by the European Commission or by the adequacy framework applicable to each provider. You may ask us for information about the safeguards applied by writing to hola@lilab.io.

7. Retention periods

Session cookie

Seven (7) days from registration, or until you clear the data of your browser.

Registration, context and event data

For as long as the commercial interest remains alive and, at most, twenty-four (24) months from your last interaction with the site, unless you request its deletion or withdraw your consent beforehand.

Evidence files and their metadata

For as long as your evaluation lasts and, at most, twelve (12) months from the last interaction, unless deletion is requested beforehand. Uploads interrupted before being confirmed may leave objects without metadata, which are removed in the periodic cleanup tasks.

Messages to the assistant

The same period as the registration data.

Analytics data

Fourteen (14) months from the visit, in accordance with the retention settings of Google Analytics.

Technical logs of the providers

The retention period of each provider, for security and diagnostic purposes.

Once the periods indicated have elapsed, the data is deleted or irreversibly anonymized, unless it has to be kept to meet a legal obligation or to defend against possible claims.

8. Your rights

As the data subject you may exercise, free of charge, the rights of access, rectification, cancellation and objection (ARCO rights) recognized by Law No. 29733, as well as the rights of information, withdrawal of consent and objective processing provided for in that law.

If you are in the European Economic Area, you also have the rights of erasure, restriction of processing, portability and objection, and the right to withdraw your consent at any time, without this affecting the lawfulness of the processing carried out beforehand.

To exercise them, write to hola@lilab.io stating the right you wish to exercise and a means that allows us to verify your identity, such as the same email address you registered with. We will respond within the applicable legal deadlines.

If you consider that your request was not handled properly, you may lodge a complaint with the National Authority for Personal Data Protection (ANPD) of the Ministry of Justice and Human Rights of Peru. Visitors from the EEA may complain to the supervisory authority of their country of residence.

9. Security measures

We apply technical and organizational measures proportionate to the risk of the processing:

• The session is handled with an opaque cookie, marked HttpOnly, whose value is stored in the database only as a cryptographic digest.
• The evidence files are kept in private storage, never in public paths of the site. Every read or download verifies the session and the ownership of the file.
• Direct uploads are restricted to the directory of the session, to a maximum size and to a validity of ten minutes, with no overwriting of existing files.
• The internal commercial tracking panel is protected with separate authentication and excluded from search engine indexing.
• All traffic is served over HTTPS.

No system is completely infallible. We ask you not to include confidential information in the demonstration.

10. Minors

The site and the demonstration are aimed at professionals and not at minors. We do not knowingly collect data from minors. If we detect that we have processed the data of a minor without the corresponding authorization, we will delete it.

11. Cookies

The site uses a strictly necessary cookie to keep your demo session, and Google Analytics cookies, which you may object to. It also uses the local storage of the browser to keep your progress in the guided tours. The details, and how to disable the measurement, are in the Cookie policy.

12. Changes to this policy

We may update this policy when the product, our providers or the applicable law change. The version in force is the one published on this page, with its date of last update. If the change substantially affects the processing of data based on your consent, we will notify you by email and, where appropriate, request consent again.