Scope note. This document does not replace Marsupia's Terms and Conditions. The Terms and Conditions govern the business relationship (what the service includes, payments, cancellation, liability). This Policy governs exclusively what personal data is processed, for what purpose, for how long, and what rights the data subject holds. Both documents must be read together. In the event of a conflict between the two regarding personal data, this Policy prevails.
Controller: Vincent Navarro Moreno, acting under the trade name Marsupia (natural person — see note at the end of this clause).
ID document: C.C. 1.103.105.328, issued in Corozal, Sucre, Colombia.
Domicile: Barranquilla, Atlántico, Colombia.
Email for personal data matters: pqr@marsupia.co
Phone: +57 302 291 2507
Website: https://www.marsupia.co
Marsupia processes technical internet-connection records generated by the devices included in the service. Each record contains, exclusively:
These records are the sole source from which the La Bitácora and La Brújula reports are derived.
This section is just as binding as the previous one. Marsupia does not access, collect, store, or process:
Marsupia does not sell, lease, or transfer personal data to third parties for commercial purposes, under any circumstances.
Data is processed exclusively to:
Any other purpose requires new and separate authorization.
The minor's data is processed solely in accordance with their best interests and respect for their fundamental rights, pursuant to Article 7 of Law 1581 of 2012 and Ruling C-748 of 2011.
No data of the minor is processed without the prior, express, and informed authorization of whoever holds their legal representation, granted in accordance with the Minor's Data Processing Authorization document.
Marsupia operates on the principle of accompanying, not surveilling. The service is not designed to operate in secret. The legal representative commits to informing the minor, in terms appropriate to their age, that the service is active and what it consists of.
When the minor is fourteen (14) years of age or older, their informed assent will additionally be sought. The adolescent's refusal does not prevent the provision of the service contracted by their legal representative, but it is recorded and taken into account when defining the scope of the companionship, in accordance with the principle of progressive autonomy recognized in Decree 0769 of 2026.
Marsupia does not require or store the minor's identity document, photograph, school, or home address.
7.6.1. The legal representative declares that, in a manner appropriate to the minor's age and maturity, they have informed — or will inform at the start of the service — the minor that the family uses a digital companionship service that analyzes general browsing information from their devices, and has given or will give them the opportunity to express their opinion on the matter.
7.6.2. Marsupia makes available to the legal representative the family agreement conversation ("family pact") as a suitable mechanism to give effect to this right, on the understanding that the service is built on transparency toward the minor, not on hidden observation.
7.6.3. In the case of adolescents (ages 14 to 17), special weight will be given to their opinion, in light of their greater autonomy — the same criterion as in clause 7.4.
To the extent that browsing information could potentially reveal data falling under special categories, the legal representative declares they are aware they are not obliged to authorize its processing, and that, if they do so, they do so freely. The service is provided without requiring any classification of the minor's sensitive content.
To provide the service, Marsupia relies on technology providers who act as data processors. By their nature, some operate with infrastructure located outside Colombia. By authorizing the processing, the data subject expressly authorizes this international transfer, in accordance with Article 26 of Law 1581 of 2012.
Marsupia requires these providers to maintain confidentiality and security conditions equivalent to those of this Policy.
Providers are identified by functional category, not by trade name — a decision confirmed by the controller: Law 1581 requires informing the data subject about the transfer, but does not require naming each provider commercially, and naming them by category protects the configuration know-how that is proprietary to the service.
The data subject may request early deletion at any time, except where a legal duty of retention exists.
Every data subject, or their legal representative, has the right to:
Revoking the authorization results in termination of the service, because the service cannot be provided without processing the technical connection records.
Proof of consent. Marsupia keeps, for each family, a record of the consent and authorization granted — date, time, means used, and version of the document accepted — as proof of authorization under Law 1581 of 2012, available to the data subject upon request.
Single channel: pqr@marsupia.co
Inquiries. Answered within a maximum of ten (10) business days. If that is not possible, the requester will be informed of the reason and the response date, which will not exceed an additional five (5) business days.
Complaints. Handled within a maximum of fifteen (15) business days, counted from the day following receipt. If that is not possible, the requester will be informed of the reason and the response date, which will not exceed an additional eight (8) business days.
The complaint must identify the data subject, describe the facts, and attach any supporting documents. If the complaint is incomplete, Marsupia will request the missing information within the following five (5) days; if the requester does not provide it within two (2) months, the complaint will be deemed withdrawn.
Before approaching the Superintendence of Industry and Commerce, the data subject must have exhausted this process with Marsupia first.
Marsupia declares and undertakes that its tools, in line with articles 2.2.31.2.5, 2.2.31.2.6, and 2.2.31.2.7 of Decree 1078 of 2015 as amended by Decree 0769 of 2026:
Marsupia does not perform judicial police functions nor make legal determinations about conduct. When indications of crimes against a minor are identified in the course of the service, Marsupia will direct the family toward the relevant institutional channels:
In cases involving child sexual abuse or exploitation material, reporting to the Attorney General's Office is immediate and mandatory.
Marsupia currently operates as a natural person. Under the regime in force, the obligation to register with the National Database Registry before the Superintendence of Industry and Commerce falls on companies and non-profit entities that exceed certain asset thresholds, not on natural persons. If Marsupia is incorporated as a company, this obligation must be reassessed immediately.
This Policy is effective as of the date indicated at the beginning and remains in force for as long as Marsupia processes personal data. Any substantial modification will be communicated to data subjects through their registered contact channel, at least ten (10) calendar days in advance. The current version is always available at https://www.marsupia.co/politica-de-datos