Personal data processing policy
Last updated: 2026-11-10 · Colombian Law 1581 of 2012 and Decree 1377 of 2013
1. Controller
- Controller: LanFaro (company being incorporated in Colombia). Registration details will be published once it is incorporated; meanwhile, write to vcdane22@gmail.com
- Privacy contact: vcdane22@gmail.com
When a technician or MSP uses LanFaro to review their clients’ networks, the technician is the controller of that network data and LanFaro acts as their processor (see the data processing agreement).
2. General principle: scanning runs on your computer
The desktop app and the agent scan your network on your own computer. What they see (IP and MAC addresses, names, vendors, ports) is stored on your computer and only reaches our cloud if you enable the “Cloud” option. In the app, Settings → What leaves this computer lists every external service it can connect to, whether it is active and when it was last used.
3. What data we process and why
| Data | When | Purpose |
|---|---|---|
| Email, name, language, password (hash only; we never see it), type of use and country if you tell us | At sign-up | Providing the service, tailoring help, the suggested plan and displayed prices |
| Two-step verification factor (stored by Supabase Auth) | If you turn it on | Account security |
| Network data: network name, public IP, ISP, and per device IP, MAC, name, vendor, model, OS, ports and timestamps | Only with “Cloud” enabled in the app or with a linked agent | Web dashboard, history, alerts and reports |
| Linked computers: computer name, OS, version, last agent heartbeat | When linking the app or agent | Managing computers and alerting if an agent goes silent |
| Technical traits of a device (first 3 or 4 MAC bytes if not random, DHCP fingerprint, services, ports), without IP, full MAC or names | Only if you answer “Did we get it right?” | Improving device recognition (shared catalog) |
| Problem reports: your description and, only if you tick the box, technical diagnostics (versions, plan and the last lines of the app log, with trimmed MACs) | When you click “Report a problem” in the app | Support and bug fixing (with your consent); deleted with your account |
| AI assistant usage: cost, topic and model (we do not store question text). The question is processed by Anthropic (US) with anonymous technical data: no IP, no full MAC and no device names | When you use the assistant | Answering and enforcing your plan’s allowance |
| Verified WhatsApp number | Only if you turn on WhatsApp alerts | Sending urgent network alerts |
| Browser push subscription | Only if you turn it on | Sending alerts |
| Security log: IP and user agent on logins, links, plan and security changes | Always | Security and fraud prevention; visible in your account |
| An MSP’s end-client data (client name and email) | If the technician enables the monthly client report | Sending the report to the client on the technician’s behalf |
| Anonymous app usage statistics | Only if you turn them on (off by default) | Improving the product |
| Billing (name, email, country, amount) | When you pay | Charges and taxes; card data is handled by Lemon Squeezy, never by us |
| Free-trial fingerprints: one-way hash of the normalised email, the computer identifier and the router MAC | When you sign up, link the app and upload scans | Giving one Pro trial per person and per computer (legitimate interest in preventing fraud). They cannot be reversed, do not identify you on their own and are kept without a link to your account if you delete it |
We do not process sensitive data. We do not sell data or use it for advertising. LanFaro never accesses traffic content or camera video, and never tries passwords.
4. Authorisation
By creating an account you give prior, express and informed authorisation for the processing described, which is recorded (date and acceptance). Optional features (Cloud, WhatsApp, push, catalog contributions, statistics) ask for their own consent when enabled, and you can withdraw it by turning them off.
5. Your rights
You may: know, update and correct your data; request proof of your authorisation; be told how we use it; revoke the authorisation and request deletion where there is no legal duty to keep it; access your data free of charge; and file complaints with Colombia’s Superintendence of Industry and Commerce (SIC) after first contacting us.
From Account you can download all your data as JSON and delete the account instantly, without writing to us.
6. Requests and complaints
- Channel: vcdane22@gmail.com, stating your name, account email and request. We may ask you to confirm your identity from the account email.
- Inquiries (what data we hold and how we use it): answered within 10 business days of receipt; if not possible, we will explain why and answer within the next 5 business days.
- Complaints (correction, update, deletion or breach): answered within 15 business days from the day after receipt; if not possible, we will explain why and answer within the next 8 business days. If a complaint is incomplete we will ask for what is missing within 5 days; if not received within 2 months, it is deemed withdrawn.
7. Processors and international transfers
We use providers that process data on our behalf, several of them outside Colombia (mainly in the United States). Each has a transmission agreement with the safeguards of article 25 of Decree 1377 of 2013. The full list, with what each receives, country and when, is under Subprocessors.
8. Retention
Scan and event history is kept according to your plan (3, 90, 365 or 730 days) and then deleted automatically. Account data is kept while the account exists. Deleting it erases all your data; we keep only the accounting records required by law (10 years).
9. Security
Encryption in transit (TLS), per-user isolation in the database (RLS), optional two-step verification also enforced in the database, tokens stored only as hashes, signed updates and an audit log. If we detect an incident affecting your data we will notify you and report it to the SIC.
10. Cookies
Only strictly necessary cookies (session and language). No tracking or advertising cookies.
11. Minors
The service is intended for people aged 18 or older. We do not knowingly collect data from minors; if we detect it, we delete it.
12. Users outside Colombia
If you are in another country, the rights of your local law also apply (for example, the GDPR in the EU/EEA) and you may complain to your data protection authority.
13. Validity and changes
This policy applies from publication and for as long as LanFaro processes personal data. We will publish any change on this page and, if material, email you before it applies.