Privacy policy
What data the platform collects, what it is used for, who it is shared with and how to exercise your rights over it.
1. Who is responsible for the data
The data controller is Coraliae SRL, tax ID (CUIT) 30-71240183-0, with offices at Asunción 2444, 1419, City of Buenos Aires, Argentina ("Coralia"). For any privacy question: privacidad@coraliae.com.
The platform is a service for businesses. The client company decides what information it uploads and who on its team has access; Coralia processes it to provide the contracted service.
2. What data we collect
We only collect the data needed to assess the climate risk of the assets, produce the reports and manage the accounts.
| Type of data | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, phone (optional), role, company the user belongs to | The user or the admin who invites them |
| Company | Legal name, tax ID, sector, country, plan and logo | The company admin |
| Assets and management units | Location and coordinates of facilities, asset type, grouping into management units | The company's users, by hand or from Excel, KMZ or shapefile |
| Vulnerability | Answers to the vulnerability surveys, impacts, costs and adaptation measures | The company's users and the people they choose to answer |
| Assessments and reports | Chosen scope, risk index results, prioritized measures and final report | Produced by the platform from the data above |
| AI assistant | Questions to Coral-IA, answers and notes it keeps to remember context | The company's users |
| Plan | Requested plan, billing cycle and comment of each request | The company admin |
| Support | Name, email, company and message | The user who writes |
We do not ask for sensitive data as defined by Law 25,326 (health, ethnic origin, political opinions, etc.) and we ask users not to upload it, including in survey answers.
3. What we use the data for
We use the data to provide the contracted service. We do not sell it or use it for advertising.
- Assessing the assets' exposure to climate hazards, their vulnerability and their risk index.
- Proposing adaptation measures and producing the final report.
- Supporting the company through Coralia's technical team.
- Approving new accounts and managing users, permissions and plans.
- Answering support requests.
- Keeping the platform secure and preventing misuse.
- Producing aggregated, anonymous statistics that do not identify any company or asset.
Legal basis. We process the data because it is necessary to perform the contract with the client company and, where applicable, with the user's consent, under Law 25,326.
4. Use of artificial intelligence
- When it is used. Only when the user writes to Coral-IA, the platform's assistant.
- What is sent. The user's question and the context needed to answer it, such as the screen they are on.
- What Anthropic does with the data. It does not use it to train models and deletes it within 30 days, except content flagged for violating its usage policy.
- Human review. Coral-IA's answers are guidance and may contain errors: the company must check important data before using it.
5. Who we share the data with
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, files and sign-in | São Paulo, Brazil |
| Vercel | Running the application | São Paulo, Brazil |
| Anthropic | Coral-IA assistant | United States |
| Google and Microsoft | Corporate sign-in | [To be confirmed] |
| Resend | Sending emails | United States |
Coralia team. Consultants access the data needed to approve accounts, support the assessments and provide help.
Authorities. We only hand over data when a law or an order requires it.
International transfers. Some providers have servers outside Argentina, including in countries that Argentine regulations do not consider to offer adequate protection, such as the United States. Coralia works with providers that hold recognized security certifications, such as SOC 2, and apply adequate safeguards. By using the platform, the user consents to those transfers.
6. How long we keep the data
- During the service. For as long as the company has an active account.
- After cancelling. The company can first request a copy of its assessments at contacto@coraliae.com. The data is deleted 90 days after cancellation.
- Exceptions. We keep for longer whatever a law requires us to keep.
- Backups. Deleted data may remain in backups for up to 7 days.
7. Security
We protect the data with encryption, access control by company and providers with SOC 2 Type 2 audits. The details are in Platform security. If an incident affects personal data, we notify the affected company without undue delay.
8. Cookies and data stored in the browser
The platform only uses cookies and browser data that are necessary for it to work; it does not use analytics, advertising or tracking cookies.
| Cookie or stored data | What it is for | Duration |
|---|---|---|
| Session (Supabase) | Keeping the user securely signed in | For the length of the session |
| Language | Remembering the chosen language | 1 year |
| Assessment tool working copy | Keeping the assessment being edited in the browser until it syncs with the platform | Until the user clears the browser data |
| Display preferences | Remembering the chosen theme (light, dark or nature) and the guided tour progress | Until the user clears the browser data |
If we add analytics cookies in the future, we will list them here and ask for consent before turning them on.
9. Your rights
You can ask to see, correct, update or delete your personal data by writing to privacidad@coraliae.com.
- Access. Knowing what data we hold and what we use it for. We reply within 10 calendar days.
- Correction and update. Correcting inaccurate or outdated data.
- Deletion. Asking us to delete the data, except what we must keep by law or by contract. Corrections and deletions are handled within 5 business days.
The data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown, as provided in article 14, paragraph 3 of Law No. 25,326.
The Agency for Access to Public Information, as the Supervisory Authority of Law No. 25,326, is empowered to handle complaints and claims filed by those whose rights are affected by non-compliance with the rules on personal data protection.
10. Changes and contact
If we change this policy, we notify each company's admins by email at least 15 days in advance. Contact: privacidad@coraliae.com · Coraliae SRL, Asunción 2444, 1419, City of Buenos Aires, Argentina.