Privacy policy

We are GEKKOLABS S.A.S. (CoreAI), a software agency based in Montevideo, Uruguay. We build software with AI agents. This policy explains what personal data we collect through our website, why we collect it, and what rights you have over it.

If you have any question about this policy, write to us at support@coreai.com.uy.

The "start a project" form. When you fill in the form, we collect your name, email address, company and the message you write. We use this information only to reply to you and evaluate your request. Your submission is stored in a database hosted by Supabase, and a notification email is sent to us through Resend so we can respond quickly.

Bot protection. The form is protected by Cloudflare Turnstile. To decide whether a visitor is human, Turnstile may process your IP address and some browser signals. It does not show CAPTCHA puzzles and does not use cookies to track you.

Analytics. We use Vercel Web Analytics to count page views and to record one custom event when a lead is submitted. It does not use cookies and does not identify you personally.

Advertising measurement. On our public pages, the Google Ads tag and the Meta Pixel tell Google and Meta which of our ads brought you, and whether you then asked for a quote or booked a meeting. The section "Cookies and advertising" explains what they collect and how to turn them off.

Hosting. Our site is hosted on Vercel. When you visit, your requests are processed by Vercel's edge network, which may be located outside Uruguay. Like any web server, it handles technical data such as your IP address in order to deliver the page.

We do not sell personal data, and we do not knowingly collect data from children.

We use two advertising tags on the public pages of this site (the home page, the frequently asked questions and these legal pages, in English and in Spanish): the Google Ads tag and the Meta Pixel. They let us measure which of our ads bring people who ask for a quote or book a meeting, and show our ads again to people who visited us. They do not load on the sign-in page or inside the CoreAI platform.

They collect the pages you visit, when you ask for a quote or book a meeting, and technical data about your device, browser and connection, including your IP address. When you ask for a quote or book a meeting while signed in, the Google tag also sends your email address, scrambled (hashed) in your browser before it leaves, so Google can match the request to the ad you clicked. Google and Meta process this data as independent controllers, under their own privacy policies.

• Google Ads (_gcl_au) remembers the ad click that brought you, for up to 90 days.
• Meta (_fbp, _fbc) identify your browser and the ad click that brought you, for up to 90 days.
• CoreAI (coreai.geo-locale, coreai.ad-region) remember the language of your country and whether our advertising tags run in your region, for 30 days. Each holds one word and no identifier.

We do not load these tags for visitors in the European Economic Area, the United Kingdom or Switzerland, nor when your browser sends the Global Privacy Control signal. Anywhere else, you can turn them off in this browser here:

You can also delete these cookies in your browser's settings, and choose how Google and Meta use your data for ads in Google's My Ad Center and in Meta's ad preferences.

We process form submissions because you asked us to get in touch: that is, with your consent and to take steps at your request before any contract. We process technical and security data (bot protection, hosting, analytics) based on our legitimate interest in running a website that works, is secure and is not abused by bots. We measure our advertising based on our legitimate interest in knowing which of our ads work; you can object at any time, as the section "Cookies and advertising" explains. Where we rely on consent, you can withdraw it at any time by contacting us.

This policy is governed by the laws of Uruguay, including Law 18.331 on personal data protection, under the supervision of the Unidad Reguladora y de Control de Datos Personales (URCDP).

• Supabase stores form submissions in our database.
• Resend sends us the notification email when a form is submitted.
• Cloudflare provides Turnstile bot protection for the form.
• Vercel hosts the site and provides cookieless analytics.
• Google measures our Google Ads campaigns with the Google Ads tag.
• Meta measures our Facebook and Instagram ads with the Meta Pixel.

Each of these providers processes data on our behalf, under their own terms and security commitments, and only for the purposes described above. Google and Meta also process the data of their advertising tags for their own purposes, as independent controllers.

Some of these providers operate servers outside Uruguay, including in the United States and the European Union, so your data may be transferred internationally. These transfers rely on the safeguards each provider offers, such as contractual data-protection clauses and recognized security certifications. If you want more detail about a specific provider's safeguards, contact us.

We keep lead submissions for 24 months from our last contact with you, and then delete them, unless a client relationship began. In that case we keep the information for as long as needed to serve that relationship and meet our legal obligations. Technical logs and analytics data are kept only as long as our providers need them for the purposes above. Advertising cookies expire as listed in "Cookies and advertising".

Under Uruguayan law you have the right to:

• Access the personal data we hold about you.
• Correct it if it is inaccurate or incomplete.
• Delete it, when there is no valid reason for us to keep it.
• Object to processing based on our legitimate interest.

To exercise any of these rights, email us at support@coreai.com.uy. We will respond within the time allowed by law, and we may ask you to confirm your identity first.

If you are not satisfied with our response, you have the right to file a complaint with the URCDP, Uruguay's data protection authority.

If you are in the European Union or the United Kingdom, you keep the rights that the GDPR and UK GDPR give you where they apply, including the right to complain to your local supervisory authority.

We take reasonable technical and organizational measures to protect your data: encrypted connections (HTTPS), access limited to the people who need it, and providers that maintain recognized security standards. No system is perfectly secure, but if we ever learn of a breach affecting your data we will notify you as required by law.

We may update this policy from time to time, for example when we change providers or add features to the site. We will post the new version here and update the date below. If a change is significant, we will highlight it on this page.