Privacy policy

On this page

Effective November 1, 2026 · Version 2026-11-01

Who is responsible

MyParcero.ai is a bilingual guide to Medellín and Antioquia with an AI guide called Parcero. It is provided by Devspeak S.A.S. (DevSpeak Labs), a company incorporated in Colombia and domiciled in Cll. 7D # 43A - 40, Piso 8, Medellín, Antioquia 050022, Colombia, which is the controller (responsable del tratamiento) of the personal data described here. Contact: info@devspeak.dev.

This page is our privacy policy. It covers the website and the chat with Parcero on the website, on WhatsApp and on Telegram, and it applies wherever you use them. We apply it together with the data protection laws that apply to you; where those laws give you more protection than this policy, they prevail.

What we collect

Browsing the guide needs no account. We do not ask for your name, email address or phone number to browse.
Technical data: like any website, our hosting provider receives your IP address and browser details to deliver the pages. To limit abuse we count requests per IP address in our cache; each counter expires within 1 hour. We do not write a traveler's IP address to our database.
Web chat: the messages you write and a random chat session id kept in a cookie. We do not ask for your name or contact details.
WhatsApp: your messages and your phone number reach us through WhatsApp (Meta) and our WhatsApp provider, Kapso. We do not store your number in our database; we store a keyed hash (HMAC-SHA256) of it instead. While your message is being answered it is kept encrypted, together with the number we reply to.
Telegram: your messages and your Telegram chat id reach us through Telegram. We do not store the chat id in our database; we store a keyed hash (HMAC-SHA256) of it instead. While your message is being answered it is kept encrypted, together with the chat id we reply to. Telegram also sends your profile name and username with each message; we discard them on arrival and do not store them.
Other messaging channels: if we open Parcero on other messaging channels (such as iMessage or SMS), they will follow the same rules, and we will add them to this policy before they open.
Voice notes: if you send a voice note, its audio is converted to text by Amazon Transcribe (Amazon Web Services) and then handled like a written message. We never store the audio. If you spoke to Parcero, it may also reply with a voice note that we generate on our own servers, without third parties.
Location, only if you share it: “Near me” on the website asks your browser for your location, rounds it to about 100 meters and uses it to sort places by distance for that search; the rounded location is part of the page address, so it can appear briefly in our hosting provider's request logs. A location pin you send on WhatsApp or Telegram is used only to answer that message (for example, to sort places by distance or as the starting point of a route you asked for) and is deleted with the message. We do not keep your location.
Preferences: the language Parcero replies in and how you arrived at the chat (for example, from a QR code).
Usage events: when a sponsored place is shown or opened, linked to your chat session record.
Business inquiries (For business form): business name, contact name, email, optional WhatsApp number, category, area and message.
Corrections and claims of a listing: your message, an optional link as evidence and your email address.
Sponsor accounts of businesses: email address and name, the one-time sign-in codes, and the IP address and browser of each sign-in session. If a business buys a sponsorship, the subscription status and a record of the terms it accepted. We never receive card numbers.
Shared plans: the places, days, time slots and stop order of a plan you choose to share.
Analytics, only if you choose Accept in the cookie banner: Google Analytics records the pages you view, the website or campaign that brought you, device, browser, language, approximate location and events such as opening a sponsored place or starting a sponsorship checkout. Never your messages, phone number or name.

We do not ask for sensitive data (such as health, religion or political views). Please do not send it in the chat.

Why we use it

To answer your questions and recommend real places from this guide.
To remember your reply language and how you arrived between chats.
To count impressions and clicks of sponsored placements for the businesses that pay for them, in totals only, without sharing your identity with them.
To measure how the guide and the chat are used, in totals, and improve them.
To prevent abuse and keep the service secure.
To answer business inquiries, corrections and claims.
To run sponsor accounts and subscriptions.
To comply with our legal obligations.

We do not sell personal data and we do not build advertising profiles.

We may share aggregated, anonymous statistics with businesses, for example demand by category and zone. They never include messages, phone numbers, names or identifiers, and no figure covers fewer than 20 travelers.

We process your data with your prior, express and informed authorization. You give it when you accept the chat notice on the website, when you keep writing to Parcero on WhatsApp or Telegram after its privacy notice, or when you tick the consent box on a form. Analytics cookies run only if you choose Accept in the cookie banner. Sponsor accounts are processed to provide the service the business asked for. You can revoke your authorization or consent at any time (see Your rights).

How long we keep it

Conversation context: 24 hours after your last message.
Your session record (reply language and how you arrived): until you send /stop or after 12 months of inactivity.
Usage events: 13 months. Deleting your session record unlinks them from you.
Technical records of each AI reply (ids, counts, model, cost and outcome, never the text of your messages): 30 days. Sending /stop deletes them.
WhatsApp and Telegram messages being answered: deleted 1 hour after the reply; a message that cannot be processed is deleted after at most 14 days.
Message ids we keep to avoid answering a repeated delivery twice: 30 days.
Shared plan links: 90 days. After that the plan is deleted; only the link ID and its expiry date remain, so we can tell you the link has expired.
Business inquiries, corrections and claims: while we handle them and while the business relationship lasts, unless you ask us to delete them sooner.
Sponsor accounts: while the account exists. Sign-in sessions expire after 24 hours, and sign-in attempt counters after 1 day. Billing records are kept for as long as tax and accounting laws require.
Google Analytics data (only if you accepted): 14 months, then deleted automatically. Your cookie choice: on your device for 12 months, then we ask again.
Backups: our databases are backed up every day. Encrypted copies are kept for 30 days in Amazon Web Services and for up to 8 weeks on an encrypted computer managed by Devspeak S.A.S., so deleted data disappears from backups within that time.
Cookies: see Cookies and device storage below.

Plan data and share links

Your itinerary plan is stored on your device, not on our servers, and needs no account. When you share a plan, we store a read-only copy with the places, days, time slots and stop order only; your notes and custom plan titles are never sent or stored. Anyone with the link can view it. Shared links are deleted after 90 days.

Deleting your chat

You can delete your chat history at any time: choose “Delete my conversation” in the web chat, or send /stop on WhatsApp or Telegram. This deletes your conversation context and your session record at once.

Your rights

Depending on the law that applies to you, you have the right to:

know whether we process your personal data, and access it free of charge;
correct or update data that is inaccurate or incomplete;
have your data deleted when we have no legal or contractual duty to keep it;
receive your data in a portable, commonly used format, or have it sent to another provider;
object to, or ask us to restrict, certain processing, including processing based on our legitimate interests;
withdraw your consent or authorization at any time, and ask for proof of the authorization you gave;
be told how we have used your data;
not be treated differently for exercising these rights.

We do not sell personal data or share it for cross-context behavioral advertising, and we do not take decisions about you based solely on automated processing that have legal or similarly significant effects.

To make a request, write to info@devspeak.dev with the subject “Personal data” (“Datos personales”), saying what you want and how we can find your data. For WhatsApp, write from the same number or tell us the number, so we can compute its hash; on Telegram, sending /stop in your chat with Parcero is the fastest way; for the web chat, “Delete my conversation” is the fastest way, because the random session id is the only link between you and your chat. We may ask for information to confirm your identity before acting.

We answer questions about your data within 10 business days, extendable once by 5 business days, and requests to correct, update or delete data or revoke your authorization within 15 business days, extendable once by 8 business days; if we need more time we tell you why before the first deadline. If the law that applies to you sets a shorter period, we follow it.

Complaints: if you are not satisfied with our answer, you can complain to the data protection authority of the country where you live or work, or of the country where we are established. Please contact us first, so we can try to solve it.

Cookies and device storage

We use essential cookies, listed below. If you choose Accept in the cookie banner, we also load Google Analytics, which sets analytics cookies (_ga, _ga_<id>) to count visits and see how the guide is used; Google signals and ad personalization are off, and Google keeps the data for 14 months. With Essential only, or before you choose, analytics does not load; a Global Privacy Control signal from your browser counts as Essential only. No advertising scripts load. More detail is in our Cookie and analytics policy. Cookie and analytics policy

Visit statistics without cookies. MyParcero.ai also counts visits with Umami, an analytics tool we host on our own servers. It sets no cookies and stores nothing on your device. It records the page, the website or campaign that referred the visit, browser, operating system, device type, language and a country derived from the IP address. It does not store the IP address, and it identifies a visit only with a code that changes periodically, so visits cannot be linked to you over time. We use these totals to understand which pages and sources bring visitors and to improve MyParcero.ai.

Cookies set by MyParcero.ai
Name	Purpose	Duration	Type
`mp_cookie_consent`	Remembers your cookie-banner choice (Accept or Essential only). Set by our server; not readable by page scripts.	12 months	Essential
`mp_theme`	Remembers Light or Dark if you choose one, so the page does not flash the wrong theme. Removed when you choose System. Holds no identifier.	12 months	Essential (preference)
`mp_consent`	Remembers that you accepted the chat notice, so the chat can start. Set only when you accept it.	12 months	Essential
`mp_sid`	A random chat session id, signed by our server, so Parcero can keep the last 10 messages of your conversation for 24 hours. From your second message, our server also keeps a record for this session id (your reply language and how you arrived, no name or contact details) until 12 months without use. Set only after you accept the chat notice; Delete my conversation removes the cookie, the history and that record. Not readable by page scripts.	30 days	Essential
`mp_auth.session_token`	Keeps a sponsoring business signed in to its sponsor dashboard. Set only when a business account signs in with an emailed code; never for visitors. Not readable by page scripts.	24 hours	Essential

The site also keeps these items in your browser's storage. They stay on your device and are not sent to us:

mp_theme (local storage): a copy of your theme choice, used when the cookie is missing.
mp_shortcuts (local storage): whether keyboard shortcuts are on.
mp_recent_searches (local storage): your recent searches, shown only on this device.
mp_advisor_answers (local storage): your last answers in the activities advisor, kept on this device only so you can see your matches again without retyping them. "Start over" clears them.
mp_lang_switch (session storage): a note kept for about 10 seconds when you switch language, so focus and scroll position are restored.
mp_plan (local storage): your itinerary plan (place slugs and names, days, times of day, your title and notes), kept on this device until you clear it. A shared plan link stores only place slugs, days, times of day and order on our server, never your title or notes, and is deleted after 90 days.

Service providers and international transfers

These providers process personal data on behalf of Devspeak S.A.S. (encargados del tratamiento), only to run MyParcero.ai:

Vercel Inc. (United States): hosts the website and its server functions.
Amazon Web Services, Inc. (United States): hosts DevSpeak Labs Cloud, where our database, cache, file storage, the message service for WhatsApp and Telegram and encrypted backups run; converts voice notes to text (Amazon Transcribe); and calculates routes and travel times (Amazon Location Service, with map data from HERE), receiving place names or coordinates, never your phone number.
Cloudflare, Inc. (United States): delivers the photos of places that we show on the website and in chat replies. When your browser loads one of these photos, Cloudflare processes your IP address, as any content delivery network does; the photos contain no personal data.
Anthropic, PBC (United States): writes Parcero's AI replies. It receives the text of your message and the recent conversation, never your phone number, name or IP address, and its commercial terms do not allow it to train models on this content. When AI replies are switched off or unavailable, Parcero answers straight from our verified guide and nothing is sent to Anthropic.
Kapso (kapso.ai): our WhatsApp Business provider, which carries WhatsApp messages between you and Parcero.
Dodo Payments: sells sponsorships to businesses as merchant of record and processes their payments, under its own privacy policy for the payment data it collects. Travelers never pay.
Apple (iCloud Mail): our email provider, which delivers our emails: the one-time sign-in codes for sponsor accounts and the billing confirmations to businesses, sent from a devspeak.dev address.
Google LLC (United States): Google Analytics, only after you choose Accept in the cookie banner.

WhatsApp is provided by Meta under its own terms and privacy policy, which apply to your use of WhatsApp.

Telegram is provided by Telegram Messenger under its own terms and privacy policy, which apply to your use of Telegram. Like Meta with WhatsApp, Telegram decides on its own how it processes your data in its service; we do not store your Telegram chat id, only a keyed hash of it.

We and our providers store and process data mainly in the United States. This means your data may be processed outside the country where you live, under laws that may protect personal data differently. Each provider is bound by a contract that requires it to protect the data and to use it only to provide its service to us, and we give each one only what it needs. You can ask us for more information at info@devspeak.dev. If we open other messaging channels or change a provider, we will update this list first.

How we protect it

Traffic to the site is encrypted (HTTPS). Phone numbers and chat ids are replaced by keyed hashes, messages waiting to be answered are encrypted, the website reaches the database with a restricted role, and access to our systems is limited to the people who run the service. No system is completely secure. If a security incident affects your personal data, we will notify you and the competent authorities as the law requires.

Children

MyParcero.ai is meant for adults. If you are under 18, use it with the permission of a parent or guardian and do not send personal data in the chat.

Contact and changes

Devspeak S.A.S., Cll. 7D # 43A - 40, Piso 8, Medellín, Antioquia 050022, Colombia. Privacy requests and questions: info@devspeak.dev.

When this policy changes, we publish the new version here with its effective date before it applies. If a change needs a new authorization from you, we will ask for it in the chat.

Change history

November 1, 2026: Cookie policy: place pages no longer offer a Google map; they show only our own map, which loads nothing from Google.
October 31, 2026: Privacy and cookie policy: voice notes (converted to text by Amazon Transcribe; the audio is never stored), Telegram as a messaging channel, how long we keep the technical records of AI replies, the providers that calculate routes and deliver place photos (Amazon Location Service with HERE map data, and Cloudflare), aggregated anonymous statistics for businesses, and the optional Google map on place pages. The terms do not change.
October 28, 2026: Counsel-approved texts: analytics cookies only if you choose Accept (Google Analytics) and a new Cookie and analytics policy page; rights, transfers, complaints and incident notice described for travelers from anywhere; consumer rights and disputes refer to the protections of your own country, with the courts of the city of our registered address.
October 16, 2026: Named the email provider: the privacy policy now lists Apple (iCloud Mail), which delivers our emails.
October 15, 2026: Sponsorship subscriptions are on sale: the terms now state renewal, cancellation, the 14-day withdrawal and Dodo Payments as merchant of record. The privacy policy names the email sender for sponsor sign-in codes. The address comes from the company facts. The Spanish text uses the formal “usted”.
October 14, 2026: First published version.