Scrutix

Privacy Policy

How we collect, use and protect personal information in Scrutix — and what you can do about it.

Effective 2026-08-30Leer en español (versión canónica)

1. Who is responsible for your data

Scrutix is a platform used by political campaigns to organise their work. That means there are two different controllers depending on whose data we are talking about.

If a campaign registered you as a citizen

The campaign is the controller, not Scrutix. It decided to collect your data and for what purpose. We act as a processor: we store and process that information on its instructions and never for our own purposes. To exercise your rights, contact the campaign first. If you don't know which one it is, write to us and we will help you identify it.

If you are a platform user

For your account data — profile, preferences and the credentials of any service you connect, such as Google Calendar — Scrutix is the controller.

Legal name:
Scrutix (datos de prueba, pendientes de registro)
Tax ID (NIT):
000.000.000-0 (provisional)
Registered office:
Medellín, Colombia
Address:
Pendiente de registro
Email:
sales@scrutix.co
Phone:
Pendiente de registro

2. What data we process and why

About citizens registered by a campaign: identification and contact details, location, publicly available electoral data (polling station and table), a record of interactions such as door-to-door visits and survey answers, and political opinion — see section 3.

Purpose: to let the campaign organise its field work, coordinate volunteers and communicate with people who authorised it. We do not sell personal data and we do not share it with third parties for their advertising.

About platform users: name, email, phone, role within the campaign, interface preferences and the activity logs needed for security.

3. Sensitive data: political opinion

Under Article 5 of Colombia's Law 1581 of 2012, political orientation is sensitive data. Scrutix processes it: campaigns record whether a person supports them and how strongly.

Accordingly, and as Article 6 requires:

  • You are not obliged to authorise the processing of sensitive data. You may refuse, and refusing cannot be held against you.
  • It is processed only with your express authorisation, save for the exceptions the law provides.
  • Access is restricted within the platform by each user's role.

4. Google account data

If you connect your Google account to sync your calendar, this is exactly what happens. Connecting is optional and Scrutix works without it.

Which permissions we request, and why:

  • View and edit calendar events — to show events from the calendar you choose inside Scrutix, and to place events your campaign schedules onto that calendar.
  • View the list of your calendars — names only, so you can pick which one to sync. It grants no access to any calendar's contents.
  • Read your free/busy availability — busy time ranges with no title, no location and no attendees. This lets the campaign avoid double-booking you without learning what you are doing.
  • Your email address — to show you which account is connected.

We request no access to Gmail, Drive, Contacts or any other Google service, and we request the narrowest scopes that accomplish this work.

What we store:

  • Access credentials, encrypted. They are readable only by the server processes that synchronise your calendar.
  • Events from the calendar you choose: title, date, location and description.
  • From availability calendars, only the busy time ranges. Our database has no field in which to store their titles.

What we do NOT do with it:

  • We do not sell it or transfer it to third parties.
  • We do not use it for advertising, ours or anyone else's.
  • We do not use it to train artificial intelligence models.
  • No one on our team reads it, unless you explicitly ask us to in order to resolve a problem, or the law compels us.

How to revoke it, at any time:

  • In Scrutix, from the calendar, using Disconnect. We then revoke the grant with Google and delete the stored credentials.
  • From your Google account, under Third-party apps with account access.

Scrutix's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Your rights

As the data subject, the law gives you the right to:

  • Know what data of yours we process, and how.
  • Update and correct anything inaccurate or incomplete.
  • Delete it, where no legal duty requires us to keep it.
  • Withdraw the authorisation you gave.
  • Request proof of that authorisation.
  • Complain to Colombia's Superintendency of Industry and Commerce, after first raising it with the controller.
  • Access your data free of charge.

6. How to exercise them

Responsible team:
Área de Protección de Datos
Email:
sales@scrutix.co
Phone:
Pendiente de registro

Write to us with your name, something that identifies you, what you are asking for, and a reply address.

  • Enquiries: answered within 10 business days.
  • Complaints: answered within 15 business days.
  • If we cannot meet the deadline, we tell you why and when we will.

7. How we protect information

  • Encryption in transit, and of the credentials of connected services.
  • Strict separation between campaigns: one campaign's data is not reachable from another.
  • Role-based access control within each campaign.
  • Audit logging of sensitive operations.

No system is infallible. Should an incident affect your data, we will notify it as the law requires.

8. Who we share information with

We use providers to operate the service, processing data on our instructions: hosting and database, email and messaging delivery, and artificial intelligence models for analysis features.

Some are located outside Colombia. Transfers are made with the safeguards Law 1581 of 2012 requires. We do not sell personal data to anyone.

9. Effective date

This policy is effective from 2026-08-30.

If we change it substantially, we will announce it through our usual channels before it takes effect.