Privacy policy – Hackea tus Finanzas

Courtesy translation. The Spanish version (Política de privacidad de Hackea) is the binding one; if there is any difference, the Spanish text prevails. The children’s notices below are also shown in English inside the app. This document is a draft that has not yet been reviewed by a licensed attorney.

Personal Data Processing Policy

1. Who is responsible. The data controller is Camilo Andrés Tirado Cabrera, an individual, identified with Colombian citizenship ID 80.881.926, address Calle 159 # 7-74, Bogotá, Colombia, phone +57 314 460 2503, email [email protected], hereinafter “Hackea” or “the Controller”. Hackea tus Finanzas is an online financial-education course for children and young people aged 8 to 18, offered at rentaycapital.com and in its web app.

2. Legal framework. This policy complies with the Colombian Constitution (arts. 15 and 20), Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015), Constitutional Court ruling C-748 of 2011, Law 1098 of 2006, Law 2489 of 2025, Decree 769 of 2026 and the instructions of the Superintendence of Industry and Commerce (SIC). It is a separate document from the Terms and Conditions.

3. Definitions. We use the words of the law with this meaning:

Data subject: the person the data refers to.
Adult account holder or Customer: the person over 18 who buys the course and creates the family account.
Student: the child or teenager who uses a profile created by the adult.
Representative: the parent, guardian or whoever has the legal representation or custody of the Student.
Processor: whoever processes data on behalf of Hackea.
Authorization, Processing, Transmission and Transfer: as defined in art. 3 of Law 1581 and art. 3 of Decree 1377.

4. Principles. We apply the principles of legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality (Law 1581, art. 4). With minors’ data we also apply the best interests of the child, the prevalence of their rights, minimization, and privacy by design and by default.

5. What data we process, from whom and for what.

5.1 “Customers” database (adults who buy). Data: name, email, password (stored encrypted), Hotmart purchase code, product and plan bought, purchase and expiry dates, payment status (approved, refunded), devices and sessions used to sign in (technical identifier of the device and browser), records of acceptance of the terms and of the authorizations, and messages sent to us. Purposes:

a) to create and manage the family account and give access for the time purchased;
b) to verify the purchase with Hotmart and handle refunds and guarantees;
c) to send messages necessary for the service: welcome, link to create the password, password recovery, expiry, changes to the terms;
d) to show the Students’ progress and the missions to validate;
e) to handle requests, complaints, claims and data requests;
f) to prevent fraud and unauthorized sharing of the account;
g) to comply with legal obligations and keep proof of the contract;
h) only if the adult authorizes it in a separate checkbox: to send news and offers from Hackea and the other courses at rentaycapital.com.

5.2 “Student profiles” database (minors). Data: alias chosen by the family, age range or route (8–11, 12–14, 15–18), encrypted PIN, progress (lessons viewed, answers to questions, predictions, missions completed, streak and achievements), savings goal and the deposits and bonuses the adult records or confirms, and the technical identifier of the device and session. We do not collect the Student’s real name, surnames, date of birth, ID document, photo, voice, video, location, email, phone, school or biometric data. The explanations the Student writes in the lessons are stored only on their device and are not sent to our servers. Purposes (only these):

a) for the Student to use the course and the app, and for their progress to be saved and synchronized across their devices;
b) to adapt the content to their age route;
c) to show the adult the progress, missions and goal so they can support learning;
d) to improve the course with aggregate statistics that do not identify any Student.

We never use the Students’ data for advertising, commercial profiling, sale, transfer or automated decisions that produce effects on them. Nor to train third parties’ artificial-intelligence systems.

5.3 “Interested parties” database (waiting list, pilot, free class). Adult’s data: name, email, number of children by age range (aggregate data that does not identify any minor) and the authorization given. Purposes: to notify them of the launch or the pilot, to give them access to the free class and, only if they authorize it in a separate checkbox, to send them commercial communications.

5.4 Site visitors. We measure visits anonymously, without advertising cookies or social-network pixels, to know which pages are used. In the Student areas there is no third-party measurement.

6. Processing of children’s and teenagers’ data. We process the Students’ data only because it serves their best interests (their financial education, a right recognized in art. 67 of the Constitution) and while respecting their fundamental rights, as required by art. 7 of Law 1581, art. 12 of Decree 1377 and ruling C-748 of 2011. For this:

a) the authorization is given by the Representative, for each profile;
b) before authorizing, the Representative shows the Student the notice for children of their age and talks with them, and the Student can say in the app whether they agree or have questions; their opinion is weighed according to their maturity;
c) answering questions about the minor’s data is optional;
d) we collect the minimum data;
e) only the adult account holder and the Student themselves see their progress;
f) the adult can delete the profile at any time from their dashboard, and the Student can ask them to do so;
g) there is no chat, no content from other users and no contact between Students.

7. Processors and recipients. To provide the service we use the following providers, who process data on our behalf (Processors) under contracts that oblige them to comply with this policy and to maintain security and confidentiality (Decree 1377, arts. 24 and 25):

Cloudflare, Inc. (United States): hosting of the site and the app, servers and storage of accounts, profiles and progress.
Google LLC (United States): sending service emails and a private record of messages and statistics.

The United States is on the SIC’s list of countries with an adequate level of protection (External Circular 5 of 2017).

Hotmart (Hotmart BV, Netherlands, or Hotmart Company, Brazil, depending on the country and currency of the purchase) processes the payment as an independent controller, under its own privacy policy. Hackea receives from Hotmart and sends to it only the adult’s purchase data (name, email, code, product, status) to grant and revoke access. Since Brazil is not on the list of adequate countries, that communication takes place because it is necessary to perform the purchase contract and with the adult’s express authorization (Law 1581, art. 26, items a and e). No Student data is sent to Hotmart.

We will hand over data to authorities only when a law or an order requires it.

8. Rights of data subjects. The data subject, and in the case of Students their Representative (Decree 1377, art. 20), may:

a) know, update and rectify their data;
b) ask for proof of the authorization;
c) know how their data has been used;
d) revoke the authorization or ask for the data to be deleted when there is no legal or contractual duty to keep it;
e) access their data free of charge;
f) complain to the SIC after going through the procedure with Hackea.

9. How to exercise the rights. The responsible area is Hackea’s support, run by Camilo Andrés Tirado Cabrera. Requests are sent to [email protected], with the subject “Personal data”. They can also be made from the adult’s dashboard (to delete a profile; to download the progress or delete the account, write to us). The request must identify the data subject or the Representative, describe what is requested and give an address or email to reply to. We confirm receipt of each request by email, with date and time.

Inquiries: we respond within a maximum of 10 business days from receipt. If we cannot, we tell you why and respond within a maximum of 5 more business days (Law 1581, art. 14).
Claims (correction, update, deletion or revocation): if the claim is incomplete, we ask for it to be completed within the following 5 days; if 2 months pass without a response, it is deemed withdrawn. Within 2 business days we mark the data as “claim in process”. We respond within a maximum of 15 business days from the day after receipt, extendable by up to 8 more business days with notice (Law 1581, art. 15).

When the adult deletes a profile from their dashboard, the deletion on our servers is immediate. Backup copies are deleted within a maximum of 30 days. Data stored on devices is erased when signing out or uninstalling the app.

10. Security. We apply measures proportionate to the type of data, with emphasis on minors’ data:

encrypted connection;
passwords and PINs stored with one-way, salted encryption algorithms;
limit on attempts;
one session per device and a maximum number of devices;
restricted access to the information;
access logs;
periodic review.

No system is infallible. If an incident affecting personal data occurs, we will report it to the SIC within 15 business days of detecting it and notify the affected families of what happened and what they should do.

11. Retention and deletion.

Student profiles: while the family account is active. If access expires and is not renewed, they are deleted at the latest 60 days after expiry; beforehand we notify the adult so they can ask for the progress if they want it.
Adult’s account: while it is active and up to 12 months after expiry, unless they ask to delete it earlier (proof of purchase and of acceptances is kept for the legal term).
Proof of purchase and of acceptances (without Student data): for the term the law requires for commercial documents.
Interested parties: up to 12 months after launch or until the data subject asks to be removed.

12. Changes to this policy. If the identity of the controller or the purposes change substantially, we will notify you before applying it and, if the purpose changes, we will ask for a new authorization (Decree 1377, arts. 5 and 13).

13. Effective date. This policy is in force since October 21, 2026. The databases will remain in effect while the service is provided and for the retention periods in section 11.

Privacy notice for the adult

Hackea tus Finanzas privacy notice

Camilo Andrés Tirado Cabrera ([email protected]) is responsible for your personal data and for the minimum data of the children and teenagers whose profiles you create.

What we keep about you: name, email, encrypted password, your Hotmart purchase data, the devices you sign in from and the authorizations you give us. What we keep about each student: only the alias you choose, their age range, an encrypted PIN and their progress (lessons, answers, missions, goals and the deposits and bonuses you record). We do not ask for their name, photo, email, location or date of birth.

What for: to give you access to the course for the year purchased, manage your family’s profiles, show you the progress, assist you, comply with the law and, only if you authorize it separately, send you news and offers. Students’ data is never used for advertising, profiling or sale.

Answering questions about a minor’s data is optional. Without the alias, the age range and the PIN we cannot create their profile.

With whom: Cloudflare and Google (United States) provide us with servers and email, as processors. Hotmart processes your payment under its own policy and receives only your purchase data, never the students’.

Your rights: to know, update, rectify and delete your data and that of your children or those you represent, revoke the authorization, ask for proof of it and complain to the SIC. Write to us at [email protected] or use your dashboard.

Full policy: Data Processing Policy.

Privacy notice for children and young people

This is the one shown when the profile is created and on the student’s first sign-in, according to their route.

3.1 Explorer route (ages 8 to 11) · told by Chigüi

Hi! I’m Chigüi. Before we start, here is what we keep about you.
• Your nickname. Not your real name. Pick one that doesn’t say who you are.
• Your age, roughly (8 to 11). That way we show you challenges for your age.
• Your secret code (PIN). We keep it so well hidden that not even we can see it. Don’t tell it to anyone, not even your friends.
• What you learn: your challenges, your answers and your stars.
Who sees it? Only you and the adult who signed you up.
What we DON’T do: we don’t ask for a photo or where you live. We don’t show you ads. We don’t give your things to anyone.
What if you don’t want to anymore? Tell your adult and they delete everything.
Do you agree?
[ Yes, let’s start! ] [ I have a question ] [ I don’t want to ]

3.2 Strategist route (ages 12 to 14)

Your data, your rules
For the app to work we keep only this:
Your alias (don’t use your full name) · your age range (12–14) · your PIN, encrypted (not even we can read it) · your progress: lessons, answers, missions, streak, achievements and your savings goal.
Who sees it: you and the adult who created your profile. Nobody else.
What we never do: ask for your photo, email, phone or location; show you ads; sell or hand over your data to other companies; use it to sell you things.
What you write to explain your answers stays on your phone or computer. It doesn’t reach us.
Your rights: you can ask what we keep, ask for corrections or ask your adult to delete your profile. If something looks odd, tap “Report a problem”.
Do you agree to us keeping this so you can use Hackea?
[ Yes, I agree ] [ I have questions ] [ I don’t agree ]

3.3 Hacker route (ages 15 to 18)

Privacy, no fine print
Data we process: alias, age range (15–18), encrypted PIN and progress (lessons, answers, predictions, missions, goals, deposits recorded by your adult, streak and achievements). Data we don’t ask for: name, ID, photo, email, phone, location, school, biometrics.
What for: so you can use the course, your progress is saved and the adult who signed you up can support you. There is no advertising, commercial profiling or sale of data. Your written explanations stay on your device.
Who is responsible: Camilo Andrés Tirado Cabrera, data controller ([email protected]). We use Cloudflare and Google servers in the United States, under confidentiality contracts.
Your rights: to know, correct and ask for your data to be deleted (your representative handles it, as the law says) and to complain to the Superintendency of Industry and Commerce. Full policy: Data Processing Policy.
Your opinion counts. Do you agree with this use of your data?
[ Yes, I agree ] [ I have questions ] [ I don’t agree ]

Courtesy translation of the Spanish document. Version 1.0, in force since October 21, 2026. Contact: [email protected].