This is an English translation provided for convenience. In case of any discrepancy, the Spanish version, available at /legal/privacidad, prevails.
This policy explains which personal data OPTIMO TECH S.A.S. processes through the website https://optimotech.app and the Óptimo MCP service, for what purposes, for how long, with whom it is shared and how you can exercise your rights. It is issued pursuant to Statutory Law 1581 of 2012, Decree 1377 of 2013, now compiled in Single Regulatory Decree 1074 of 2015, and other Colombian personal data protection rules.
1. Data Controller
The Data Controller (“Responsable del Tratamiento”) is OPTIMO TECH S.A.S., a Colombian company with tax ID (NIT) 901.957.428-4, domiciled in Bello, Antioquia, Colombia.
- Website: https://optimotech.app
- Service: Óptimo MCP, available at https://mcp.optimotech.co/mcp
- Channel for personal data inquiries, claims and requests: [email protected]
- Sales contact: [email protected]
2. Scope
This policy covers two distinct processing contexts. The first is the commercial website optimotech.app, where contact and demo requests are received, meetings are scheduled and, if you agree, site usage and campaign effectiveness are measured. The second is the Óptimo MCP service, a remote Model Context Protocol server that allows AI assistants such as Claude to query and operate the ServiceNow instances that the customer registers and controls.
With respect to the records that reside in the customer’s ServiceNow instances, Óptimo Tech acts on behalf of the customer, who decides which instances to connect, with which credentials and which operations to request. In that context, Óptimo Tech processes the data as a Data Processor (“Encargado del Tratamiento”), following the customer’s instructions and the terms of the contract.
3. Data collected
3.1. Website optimotech.app
| Category | Data | Source |
|---|---|---|
| Contact and demo forms | Name, business email, company, role, number of ServiceNow instances, preferred language, message and campaign source (for example, UTM parameters). | You, when submitting the form. |
| Demo scheduling | Name, email, chosen date and time and, where applicable, meeting notes. | You, when booking through Microsoft Bookings. |
| Bot protection | Technical browser and device signals, IP address. | Cloudflare Turnstile, when a form is submitted. |
| Analytics and measurement, only with your consent | Cookie identifiers, pages visited, interactions, device and browser type, approximate location derived from IP, conversions. | Google Analytics 4, Microsoft Clarity, LinkedIn Insight Tag, Google Ads and HubSpot, loaded through Google Tag Manager. |
| Cookieless aggregated analytics | Aggregated traffic metrics, without persistent identifiers. | Cloudflare Web Analytics. |
3.2. Óptimo MCP service
| Category | Data | Source |
|---|---|---|
| Dashboard account | Email, password hash (bcrypt), role, creation date and last access. | The user, when registering by invitation. |
| ServiceNow instances | Alias, URL, technical user and credential (password, token or OAuth secret). | The user, when registering each instance. |
| OAuth authorization | Dynamically registered clients, codes, access and refresh tokens, scopes, source IP. | The connection flow from the MCP client. |
| Audit | Tool name, instance, user, date, result and a summary of the request without credentials. | Each tool execution. |
| Working memory | Observations and preferences that the user or the assistant explicitly save. | Explicit user actions. |
| Cache | Table metadata and public ServiceNow documentation, with expiry. | Queries to the instance and to public ServiceNow documentation. |
| IP allowlist | IP addresses or ranges authorized to connect, with an expiry date. | The user or the corresponding service tool. |
The service does not store the content of conversations with the assistant. ServiceNow records returned by a tool are transmitted to the MCP client and are not retained, unless the user chooses to save them as an observation in their working memory.
Óptimo Tech does not request sensitive data within the meaning of article 5 of Law 1581 of 2012. If the records of a customer instance contain such data, processing is limited to transmitting it to the MCP client when the user requests it.
4. Purposes of processing
On the website, data is used to:
- Respond to contact, sales information and demo requests, and follow up on the business opportunity.
- Schedule, confirm and hold demo meetings.
- Send proposals, quotes and communications related to the requested service.
- Protect forms against abuse and automated traffic.
- With your consent, measure site usage, improve its content and evaluate the effectiveness of advertising campaigns.
In the Óptimo MCP service, data is used to:
- Authenticate the user and their MCP client through OAuth 2.1 with PKCE.
- Execute on the user’s behalf the operations they request on their ServiceNow instances.
- Keep operations traceable through auditing and detect misuse.
- Provide continuity across sessions through the working memory that the user decides to save.
- Provide support, manage the contractual relationship and invoice.
Data is not used for advertising profiling or to train artificial intelligence models, and it is not sold or disclosed to third parties for their own purposes. Advertising measurement on the website is limited to what is described in the Cookie policy and only operates if you accept it.
5. Legal basis: authorization
Processing is based on the prior, express and informed authorization of the data subject. On the website, that authorization is given by submitting a form or booking a meeting after reading this policy and, for analytics and marketing cookies, by accepting them in the consent banner. In the service, authorization is given by accepting the invitation, creating the account and registering instances. In addition, certain processing is necessary to perform the contract with the customer and to comply with legal obligations, such as accounting and tax obligations.
Óptimo Tech keeps evidence of the authorization granted. You may revoke it at any time, as described in section 9.
6. Processors and third parties
To operate the website and the service, Óptimo Tech relies on the following providers, which process data on its behalf under their own terms of service and security measures:
| Provider | Use | Main location |
|---|---|---|
| HubSpot, Inc. | CRM: recording contact requests and sales management; site tracking if you accept marketing cookies. | United States |
| Microsoft Corporation | Microsoft Bookings for demo scheduling; Microsoft Clarity for usage analytics, only with consent. | United States |
| Cloudflare, Inc. | Turnstile for bot protection, network security and cookieless Web Analytics. | United States |
| Google LLC | Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking, only with consent. | United States |
| LinkedIn Corporation | LinkedIn Insight Tag for campaign measurement, only with consent. | United States |
| Infrastructure providers | Hosting and HTTPS proxy for the Óptimo MCP service. | As per contract |
In addition, two third parties chosen by the customer take part in the service. The customer’s ServiceNow instances receive only the requests the user asks for, authenticated with the credential the user registered, and process that data under the customer’s contract with ServiceNow. The MCP client, for example Claude, receives the tool responses, and any further processing is governed by the assistant provider’s policy.
7. International data transfers
The providers listed in the previous section are located in, or mainly process data in, the United States of America. Consequently, use of the website and the service involves the international transfer or transmission of personal data to that country. Óptimo Tech carries out these operations in accordance with article 26 of Law 1581 of 2012 and its implementing regulations, based on the data subject’s express authorization and, where applicable, on the transmission agreements or data protection terms offered by each provider, which require them to apply security measures and to process the data only for the stated purposes.
By accepting this policy, you expressly authorize such international transfer or transmission.
8. Rights of the data subject
As the data subject, you have the right to:
- Know, update and rectify your personal data, including data that is partial, inaccurate, incomplete, fragmented or misleading.
- Request evidence of the authorization granted, except where the law does not require it.
- Be informed, upon request, of how your data has been used.
- Revoke the authorization and request the deletion of your data when legal principles, rights and guarantees are not respected, provided there is no legal or contractual duty to retain it.
- Access your personal data being processed free of charge.
- File complaints with the Superintendencia de Industria y Comercio (SIC), the Colombian data protection authority, for violations of the law, once the inquiry or claim procedure with Óptimo Tech has been exhausted.
Users of the service can also delete instances and observations from the dashboard, revoke the MCP client’s authorization and request the deletion of their account.
9. Procedure for inquiries and claims
Requests must be sent to [email protected], stating the full name of the data subject, the channel for receiving a response, a description of the request and, if acting on behalf of another person, a document evidencing the representation. Óptimo Tech may request reasonable additional information to verify the requester’s identity.
9.1. Inquiries
Inquiries about the data subject’s personal data are answered within a maximum of ten (10) business days from the date of receipt. If it is not possible to respond within that period, the requester will be informed of the reasons for the delay and the date on which the inquiry will be answered, which may not exceed five (5) business days after the first period expires.
9.2. Claims
Claims to correct, update or delete data, or to report an alleged breach, are answered within a maximum of fifteen (15) business days from the day after receipt. If the claim is incomplete, the requester will be asked within five (5) days to remedy it; if two (2) months pass without the requester doing so, the claim will be deemed withdrawn. If it is not possible to respond within the period, the requester will be informed of the reasons for the delay and the response date, which may not exceed eight (8) business days after the first period expires. While the claim is being processed, the data will be flagged in the database as “claim in process”.
10. Data retention
Data is kept only for as long as necessary to fulfil the purposes described and applicable legal obligations:
- Contact and demo requests: while there is a business relationship or an active opportunity and up to twenty-four (24) months after the last interaction, unless you request deletion earlier.
- Analytics and marketing cookie data: for the duration stated in the Cookie policy and each provider’s configuration.
- Account, instances and working memory: while the account is active. Unused instances are invalidated after thirty (30) days of inactivity and require revalidation in the dashboard.
- OAuth tokens: expire according to their lifetime and can be revoked at any time.
- Audit: kept for traceability during the term of the contract and can be purged at the account holder’s request, unless it must be kept to handle a claim or a request from an authority.
- Cache: expires automatically and can be cleared from the dashboard.
- Accounting and contractual information: for the periods required by Colombian commercial and tax law.
11. Security measures
Óptimo Tech applies reasonable technical, human and administrative measures to protect data against tampering, loss, and unauthorized consultation, use or access. In the Óptimo MCP service:
- Instance credentials are encrypted at rest with Fernet (AES-128-CBC with HMAC), using a master key that is not stored in the database. They are never shown in the dashboard or in tool responses.
- Account passwords are stored only as bcrypt hashes.
- All traffic is encrypted over HTTPS.
- The MCP endpoint requires OAuth 2.1 authorization with PKCE and, when enabled, an IP allowlist.
- The dashboard applies Content Security Policy (CSP), HSTS, X-Frame-Options and CSRF protection.
- Every tool execution is recorded in the audit log, without credentials.
No system is completely invulnerable. If a security incident affecting personal data occurs, Óptimo Tech will report it to the Superintendencia de Industria y Comercio and to the affected data subjects as required by law.
12. Minors
The website and the service are aimed at companies and professionals. Óptimo Tech does not knowingly collect data from children or adolescents. If it becomes aware that data from a minor has been received, it will delete it.
13. Changes to this policy
Material changes to this policy will be published on this page with the update date and, where they affect the purposes of processing, will be communicated to data subjects through the usual channels before they take effect. If a change requires a new authorization, Óptimo Tech will request it.
This policy is effective from its publication.
Last updated: October 13, 2026.