Privacy Policy

Controller: Guillermo Arboleda, an individual trading as 4dimntion ("4dim"), based in Medellín, Colombia. Single point of contact for anything concerning personal data: hola@4dimntion.com. Full legal identification is provided to any data subject who asks for it and to any authority that requires it.

Connection is sold to businesses, and that splits this policy into two roles worth keeping apart:

• 4dim is the controller of data about the people who open and use a Connection account: whoever buys it, administers it and works the inbox.
• 4dim is a processor for data about the people who message a business through WhatsApp, Instagram or Messenger. That data belongs to the business; 4dim processes it on the business's instructions and to deliver the service, never for its own purposes.

The distinction matters when someone wants to exercise their rights: if you messaged a business, that business is the one who decides about your data, and 4dim is obliged to help you reach them. The concrete route is in Data deletion.

This is the complete list. There are no implied categories: if it is not here, it is not collected.

That last row is the easy one to overstate, so here it is in full. Traffic measurement on the public site is ours: it runs on Umami, an open-source program, installed on the same infrastructure described in section 07. The script that feeds it is served from this domain and reports back to this domain. There is no Google Analytics, no Meta pixel, no other third-party tag: nothing about your visit leaves for another company.

It sets no cookies and writes nothing to your browser. The one thing it reads from local storage is a flag you can set yourself to stay out of the count: umami.disabled with the value 1. A content blocker does the same job and breaks nothing on the site.

Your IP address reaches the server, as it does on any request. The measurement does not store it: it uses it for two things and drops it: to infer the approximate location shown in the row, and to compute — together with the browser your device declares and a value that rotates — a session fingerprint. That fingerprint does not travel with you to any other site, stops matching once the value rotates, and gives no way in to a name. Nothing that identifies a person is collected, bought, or matched against anything from outside.

The console — Connection, the panel, the sign-in page — is not measured, and not because a box was left unticked: the script is not on those pages. What is written inside a conversation never passes through the measurement at all.

Connection does not ask for or process sensitive data — health, ethnic origin, sexual orientation, beliefs, biometrics. It does not take payments inside the product and therefore stores no card data. It uses no advertising or third-party tracking cookies: the only cookies it sets are the ones that hold a signed-in session.

Connection connects to WhatsApp Business Platform, Instagram Messaging and Messenger when the business explicitly authorises it. Through that channel arrive messages, attachments, the sender's identifier and their display name.

The following limits apply to that data, and they are hard limits:

• It is used solely to operate the inbox of the business that authorised the connection: showing the thread, ordering it, replying to it and following it up.
• It is never sold, rented, or handed to data brokers or ad networks.
• It is never used to target advertising, on or off Meta platforms.
• It is never used to build profiles outside the business's own CRM, to enrich third-party databases, or to score credit, insurance, employment or any decision about a person beyond the commercial relationship that person opened themselves.
• It is never used for surveillance of any kind, nor supplied to surveillance tools.
• It is never used to train general-purpose artificial intelligence models, ours or anyone else's.
• No business sees another's data: tenant isolation is enforced in every database query, not just in the interface.
• When the business disconnects the channel or ends the service, that data is deleted within the periods in section 08.

Meta is not responsible for this policy and does not sponsor Connection. Meta's own processing of the same messages on its platforms is governed by Meta's policies, not by this one.

Each purpose, and nothing beyond it:

• Receiving, ordering and answering the business's conversations, and showing it who is waiting for a reply and since when.
• Keeping the contact record and history, so that someone who wrote a month ago does not have to start over.
• Commercial follow-up within the relationship the person opened by messaging.
• Granting account access, applying roles and permissions, and detecting improper access.
• Billing the business and meeting accounting and legal obligations.
• Running and improving the product: diagnosing failures and measuring usage. This uses aggregate data and technical logs, not conversation content.
• Knowing which pages of the public site get read and how people arrive at them, to decide what to write and what to fix. This uses the measurement described in section 02, which carries data about no one.

Legal basis. For account data, performance of the contract with the business. For the business's contacts, the prior, express and informed authorisation required by Colombia's Law 1581 of 2012, which the business must obtain and be able to evidence; Connection records the fact of that authorisation — whether it was given, when, and where it came from — precisely so it can be evidenced.

Connection can propose a reply based on the thread. A proposal lives as a draft and does not go out until a person at the business approves it: the system does not send messages on its own. That rule is in the data model, not in a promise — a message in draft state has no path to delivery that bypasses approval.

The business is accountable for what it approves. If message content is at any point processed by an artificial intelligence provider, that provider is listed in section 06, processes the data solely to generate the reply, and is contractually barred from using it to train its models.

No automated decisions with legal effects are made about any person. Ordering an inbox is not deciding about anyone.

Data is never sold. It is shared only with those the service cannot exist without:

• Meta Platforms — WhatsApp, Instagram, Messenger — because that is where messages come in and go out.
• The infrastructure provider hosting 4dim's servers and database.
• The artificial intelligence provider that drafts replies, where that feature is active on the account.
• Authorities, where a legitimate judicial or administrative order requires it. In that case the minimum required is disclosed and those affected are notified, unless the order itself forbids it.

Each is bound to process the data only for what it was engaged to do. An up-to-date list of providers is supplied to anyone who asks at hola@4dimntion.com.

The database and attachments live on servers managed by 4dim on infrastructure contracted from a cloud provider, which may be outside Colombia. Meta's channels additionally operate on Meta's own infrastructure, also outside the country.

Law 1581 of 2012 permits that transfer with the data subject's authorisation. By messaging a business through a Meta channel and accepting that business's policy, it is understood to be granted for what this policy describes. Every provider is required to maintain a level of protection equivalent to the one declared here.

When the service ends, the business may request a copy of its data before it is erased. Thirty days after termination, it is deleted from live systems.

All traffic travels encrypted over TLS. Passwords are stored as cryptographic hashes and cannot be recovered, not even by 4dim. Channel credentials are stored encrypted and are never displayed again after being saved. Access within a business is controlled by roles and permissions, and isolation between businesses is enforced in the database query itself.

No system is invulnerable. If an incident affecting personal data occurs, the affected businesses and Colombia's Superintendency of Industry and Commerce are notified as the law requires.

Law 1581 of 2012 gives you the right to know, update and correct your data; to request proof of the authorisation you gave; to be told how your data has been used; to withdraw authorisation and request erasure where no legal duty to retain applies; to access your data free of charge; and to complain to the Superintendency of Industry and Commerce.

Exercise them by writing to hola@4dimntion.com. The statutory deadlines are 10 business days for an enquiry and 15 business days for a claim, extendable once with notice of the reason.

If your data is in Connection because you messaged a business, that business is the one who decides about it. Write to us anyway: we will identify the business, pass on your request and follow it through until it is resolved. The full step-by-step procedure is in Data deletion.

Connection is a work tool and is not directed at minors. Accounts are not opened for anyone under 18. If a minor messages a business through a connected channel, their data is processed under that business's responsibility and in the minor's best interest; where it becomes apparent that a minor's data is being processed without proper authorisation, it is deleted.

If this policy changes, it is published here with a new effective date and version number. Where a change materially affects how data is processed, businesses with active accounts are notified at their contact email before it takes effect.

For any question, request or complaint: hola@4dimntion.com. It is the same address for everything, deliberately: one channel that gets answered is worth more than four that share the blame.