Privacy notice
Last updated: October 27, 2026.
Peaje gets your site ready for AI agents. To do that it handles your account data, reads your site's content and logs what agents do when they arrive. This notice explains what we keep, why, who we share it with and how to ask us to delete it.
1. Data controller
The controller of your personal data is Sandra Carrillo, based in Bogotá, Colombia, owner of the Peaje service (usepeaje.com).
Contact email for any personal data matter: hello@usepeaje.com.
This notice is governed by Colombian Law 1581 of 2012, Decree 1377 of 2013 and the other Colombian personal data protection rules.
2. Who this notice applies to
- Peaje users: people who create an account and register one or more sites.
- People who use the radar: those who enter a domain and their email to see the result.
- Whoever sends requests to a site running Peaje: agents, bots and programs whose requests go through Peaje (section 9).
3. What data we collect
3.1 Your account and your sites
- Email address. It is what you use to sign in: we send a code to that email. We do not use passwords.
- Your Privy user ID, from the provider that verifies your email and creates your business wallet, and the address of that wallet.
- For each site: name, short identifier (slug), domain and, if you add them, the business logo, phone, address, description and public profiles.
- The plan status of each site (free, trial, founder or Pro) and its dates.
3.2 Your site's content
- The public pages of your domains, which Peaje reads to describe your site to agents, calculate your score, learn the tone you write in and verify tasks.
- What Peaje generates from that: descriptions for agents, the plan, page drafts, tasks, the questions we track in AI assistants and their results, reports and mystery shopper tests.
3.3 Radar
- When you use the radar we keep your email, the domain you checked, the language, the date of the last report we sent you and whether you agreed to receive tips by email (an optional box, unchecked by default). We keep your email in a cookie so we do not ask for it on every check.
- Your IP address is used only in memory to limit repeated attempts. We do not store it.
3.4 Agent visits to your site
For each request that goes through Peaje we log the path, the method, the user agent (the name the program identifies itself with, for example GPTBot), the agent type, the response, whether it paid, the amount, the network and the time. If you have the kit proxy installed, we also log each page of your site that a known AI bot reads, such as GPTBot or ClaudeBot: the path without parameters, its user agent and the time. Visits from people to your pages are not logged. We do not store the IP address of whoever makes the request. You, the site owner, see these logs.
3.5 Agent payments
If you charge agents, we keep a record of each payment: the path, the amount, the fee, the network, the agent's wallet address, the payout address it was sent to and the transaction reference. These transactions are also recorded on public blockchain networks that anyone can look up.
3.6 Conversation with the agent
The messages you write to the Pro agent and its replies, on the dashboard, on Telegram or on Slack, with the channel they came through.
3.7 Telegram and Slack
- If you connect Telegram: the chat ID, your Telegram username and the language.
- If you connect Slack: the workspace ID and name, the channel, the user who installed the app and the bot token, which we store encrypted.
- If you schedule reports: the channel, the destination (email or chat), the frequency and the time zone.
3.8 Subscription
We keep your plan status and its end date, plus the identifiers Paddle assigns to your customer record, your subscription and each charge, so we can link payments to your business and open the Paddle portal from Manage subscription. We do not receive or store card numbers, security codes or bank details: the Pro subscription payment is processed by Paddle (section 7).
3.9 What we do not collect
- We do not ask for sensitive data: health, ethnic origin, sexual orientation, religious beliefs, political or union affiliation, biometric data. If you write it in the chat, it stays under your control and you can ask us to delete it.
- We do not store IP addresses of users or visitors.
- We do not use tracking, advertising or third-party cookies (section 13).
4. What we use your data for
- Providing the service: creating your account, signing you in, generating your site's kit, showing you the radar and the visits, and running the Pro agent.
- Recording the payments your site receives from agents.
- Managing your subscription and applying each plan's limits.
- Notifying you by email, Telegram or Slack: monitor alerts, the weekly report and radar results.
- Sending you tips on getting found by agents, only if you agreed in the radar.
- Answering your support messages.
- Meeting legal obligations and keeping the service secure: preventing abuse, fraud and automated misuse.
We do not sell your data. We do not rent it. We do not hand it to advertisers or data brokers.
5. Legal basis and consent
We process your data with your prior, express and informed consent, which you give when you create your account or use the radar and accept this notice. We also rely on performance of the contract, compliance with legal obligations that apply in Colombia and our legitimate interest in keeping the service secure and working.
You can withdraw your consent at any time, except when a rule or the contract requires us to keep the data. Withdrawal does not affect what we did before it.
6. How we use artificial intelligence
- We use language models to describe your site, build the plan, write drafts and tasks, and talk with you.
- To measure whether you are cited, we ask questions to ChatGPT, Claude, Perplexity and Gemini. Those assistants receive the questions, not your email or your account data.
- We do not train models on your content. The AI providers process the data under their terms for programming interfaces.
- We do not make automated decisions with legal effects on you.
7. Who we share data with
We share data only with providers we need to run the service. Each one processes the data on our instructions and is bound to protect it. This is the complete list as of the date of this notice:
- Supabase: database. It is where your account, your sites, the visits, the payments and the conversation with the agent live.
- Vercel: hosts the website and the dashboard (usepeaje.com).
- Railway: hosts the gateway (api.usepeaje.com), which agent requests go through and where the Pro agent runs.
- Privy: sends the sign-in code to your email, verifies your identity and creates and manages your business wallet. It receives your email.
- Resend: sends operational emails (radar results, alerts, the weekly report and tips if you agreed). It receives your email and the content of the message.
- Anthropic (Claude): generates the descriptions, the plan, the drafts, the tasks and the agent's replies from your site's content and your messages. It also answers questions for citation measurement.
- OpenAI, Perplexity and Google (Gemini): answer the questions we use to measure whether they cite your site.
- Ora: calculates the agent-readiness score. It receives the domain being checked.
- Telegram and Slack: only if you connect them, to talk with the agent and receive reports. They receive the messages you exchange with the agent on that channel.
- Paddle: sells the Pro subscription as Merchant of Record: it processes the payment, calculates and remits your country's taxes and issues the invoice. It receives your email, your country and your payment method directly in its checkout; Peaje never sees your card details. Paddle's terms and privacy policy also apply to that payment.
We may also hand data to authorities when there is a valid legal request, and to legal or accounting advisers when needed to defend a right. If we add or change a provider that processes personal data, we update this list and the date of this notice.
8. International transfers
The providers in section 7 run servers outside Colombia, mainly in the United States and the European Union. That means your data is transferred and processed abroad. By accepting this notice you authorize that transfer.
9. Whoever sends requests to a site running Peaje
- We log the data in section 3.4 on behalf of the site owner, who sees it on their dashboard. For that data, the site owner is the controller and Peaje acts as processor.
- We do not store the IP address of whoever makes the request. We do use it in memory, briefly, to limit excessive requests.
- If an agent pays, its wallet address stays in the payment record and on the public network where it was made.
Our hosting providers may keep their own technical logs, with IP addresses, for short periods for security and diagnostics. That happens on their infrastructure and is governed by their policies.
10. How long we keep your data
- Your account, your sites and their content: while your account is active.
- Agent visits: while the site that received them exists.
- Conversation with the agent: while the site exists. You can ask us to delete it without deleting the rest.
- Radar: until you ask us to remove you. If you agreed to tips, you can withdraw that permission at any time.
- Payment and billing records (and the withdrawals made before payments went straight to your wallet): for the period Colombian law requires.
When you ask us to delete your account, we delete your data from our systems within thirty (30) calendar days, except what we must keep by law. What is already on a public blockchain network cannot be deleted.
11. Security
- Data is encrypted in transit and stored encrypted at rest by our providers.
- Slack tokens are stored encrypted.
- Service keys exist only on the server and are never exposed in the browser.
No system is perfect. If an incident affects your personal data, we tell you and notify the competent authority as the law requires.
12. Your rights
As the owner of your personal data, Colombian law gives you these rights:
- Know what data of yours we hold and access it free of charge.
- Update and correct data that is incomplete, inaccurate or out of date.
- Delete your data when there is no legal or contractual duty to keep it.
- Withdraw the consent you gave us.
- Request proof of the consent you gave.
- Be informed about how we have used your data.
- File complaints with the Superintendence of Industry and Commerce (SIC) for breaches of the data protection law.
How to exercise them
Write to hello@usepeaje.com from your account email, with your name, the right you want to exercise and what you need. If you write from another email we ask you to verify your identity before we act.
- Inquiries: we answer within ten (10) business days at most. If we cannot, we tell you and use up to five (5) more business days.
- Claims: we answer within fifteen (15) business days at most. If we cannot, we tell you and use up to eight (8) more business days.
14. Minors
Peaje is a service for people eighteen (18) and older. We do not knowingly collect data from minors. If we detect an account of a minor, we delete it along with its data.
15. Messages we send you
- Operational: sign-in code and notices about your account, your site and your subscription. They are part of the service while you have an account.
- From the Pro agent: monitor alerts and the weekly report, by email, Telegram or Slack depending on what you set up.
- Tips: only if you checked the box in the radar. Each one tells you how to unsubscribe.
16. Changes to this notice
We may update this notice when the product or the rules change. When the change is substantial, we tell you by email or in the dashboard before it takes effect. The last updated date is at the top and bottom of this document. Continuing to use Peaje after a change means you accept it.
17. Contact
Any question, request or claim about your personal data: hello@usepeaje.com. Controller: Sandra Carrillo, Bogotá, Colombia.
If you think we did not handle your request well, you can go to Colombia's Superintendence of Industry and Commerce. The rules for using the service are in the terms. The Spanish version of this notice governs.
Last updated: October 27, 2026.