Last updated: September 29, 2026
kiosko is a platform where businesses (“Merchants”) publish catalogs of products, services and events and receive orders, bookings and purchases from their customers (“Buyers”). This policy explains what personal data we process, why, who we share it with and how to exercise your rights. We process data under Colombian Law 1581 of 2012 and Decree 1377 of 2013 (personal data protection / habeas data) and, where applicable, the rules of the user's country.
kiosko is the controller of the platform's account data. Write to jesusmarrugo177@gmail.com with any question about this policy or your data.
Buyers' data in a catalog is controlled by the Merchant that owns the catalog, and kiosko processes it on the Merchant's behalf to operate their catalog.
From Merchants and their team members: name, email address, password (stored only as a hash by our authentication provider, never in plain text), phone, business address and details, logo and images they upload, team role, payment gateway credentials (stored encrypted) and subscription status.
If you sign in with Google, we receive from your Google account only your name, your email address and your profile picture. We do not access your contacts, your email, your files or any other data in your Google account.
From Buyers: name, phone, email address, shipping address, order or booking notes and, when the Merchant requires it for events, an ID number. Buyers provide them voluntarily when placing an order, booking or buying tickets.
Technical data: server logs (IP address, browser, date and time) for security and fraud prevention, and aggregated, cookieless visit statistics (Vercel Analytics). We count visits to each catalog without identifying who makes them.
We do not collect card numbers: payments are processed directly by the gateway the Merchant chooses, or by Polar for our subscription.
To create and maintain your account, identify you when you sign in and give you access to the dashboard and the catalogs you are entitled to.
To operate catalogs: display them, record orders, bookings and tickets, send confirmations, reminders and status updates by email, and enable event entrance control.
To bill Merchants' subscriptions, prevent fraud and abuse, provide support and meet legal, tax and accounting obligations.
To improve the product with aggregated statistics. We do not use your data for advertising or build profiles for third parties.
We use the name, email and picture Google provides only to create your account, identify you in kiosko and show who you are inside the dashboard. We do not use them for advertising, we do not sell them and we do not share them with third parties other than the providers in section 5 that run the platform.
kiosko's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke kiosko's access to your Google account at any time from your Google account's security settings, and ask us to delete the data we received from it.
Only with the providers that make the service possible, each under its own data processing agreement: Supabase (database, file storage and authentication), Vercel (hosting and visit statistics), Resend (email delivery), Polar (Merchants' subscription billing) and Google (sign-in, if you choose it).
When a Merchant connects a payment gateway —Bold, Wompi, Mercado Pago or Stripe—, the Buyer's payment data is received and processed by that gateway under its own policy.
A Merchant sees its own Buyers' data, and its team members see what their role allows. Never those of other Merchants.
We do not sell or rent personal data. We only hand it to an authority when the law requires us to.
We use technical cookies needed to keep you signed in and remember the catalog you are working on. We do not use advertising or tracking cookies, and visit statistics do not use cookies.
While the account is active. If the account is deleted, we delete its data except what we must keep for tax or accounting obligations on orders, for as long as the law requires.
A Buyer can ask the Merchant or us to delete their data, unless there is a legal obligation to keep it.
You can access, update, correct and request deletion of your personal data, revoke your consent and request a copy of your data by writing to jesusmarrugo177@gmail.com. We will respond within the time limits set by applicable law. In Colombia you may also contact the Superintendence of Industry and Commerce.
We apply reasonable technical measures: encrypted connections (HTTPS), encryption of payment credentials, separation of each Merchant's data with access policies in the database, role-based permissions within each team, and backups. No system is infallible; if an incident affected your data, we would let you know.
The platform is intended for businesses and adults. We do not knowingly collect data from minors.
We may update this policy. The date of the current version appears at the top of the document and, if the change is significant, we will notify Merchants by email.