LAST UPDATED: 6 SEPTEMBER 2026

Privacy policy

This policy describes what personal data Comando ("Comando", "we") processes, for what purpose and what rights you have over it, whether you visit comando.pro or use the platform at app.comando.pro.

1. Data controller

The controller is Comando. You can reach us about any privacy matter at privacidad@comando.pro.

2. Data we process

• Account data: name, email address, company, role and access credentials.
• Waiting list data: the email address you leave in the form on the site.
• Integration data: the records (contacts, leads, deals, orders, messages) you authorise us to sync from your CRMs, ecommerce platforms, lead sources, messaging channels and webhooks. Comando processes them on your behalf and under your instructions.
• Third-party credentials: OAuth tokens and API keys for the systems you connect, stored encrypted.
• Usage and technical data: activity logs, change audit trail, IP address, browser and performance metrics.

3. Purposes and legal basis

• Providing the service: syncing data, running automations and sending notifications (performance of the contract).
• Managing your account, support and operational communications (performance of the contract).
• Letting you know when your account is ready, or sending product news if you joined the waiting list (consent, revocable at any time).
• Security, fraud prevention, auditing and legal compliance (legitimate interest and legal obligation).
• Improving the product through aggregated metrics (legitimate interest).

4. Data processed on behalf of our customers

When you connect a CRM or another system, Comando acts as a processor for your contacts' and customers' data. You decide what is synced, which automations run and who gets notified. We do not use that data for our own purposes, nor share it with third parties beyond the providers needed to operate the service.

5. Google data (Google Sheets)

If you connect Google Sheets, Comando requests the drive.filescope, which grants access only to the files you select through Google's picker and to those Comando creates at your request. We cannot see, list or search the rest of your Google Drive.

With those files we do only what is needed to provide the service: read the rows and columns your rules need, write the changes you confirm and detect edits to keep the information in sync. We store the identifier of each authorised file, the encrypted access credentials and a partial copy of the fields your rules use.

Comando's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We do not use your Google data for advertising, nor sell or transfer it to third parties for commercial purposes.
• We do not use your Google data to train artificial intelligence models, ours or anyone else's.
• Nobody on our team reads that data, unless you expressly authorise it for support, or it is strictly necessary for security or to comply with a legal obligation.
• We only transfer it to the providers needed to operate the service, under contract and with the same restrictions.

You can withdraw access whenever you want: disconnect the sheet from Comando, or revoke the app's permission from your Google account settings. When you do, we stop accessing the file and delete the synced copy within the periods set out in the retention section.

6. Meta data (Facebook and Instagram)

If you connect your Meta ad account, Comando accesses it with the ads_management, ads_read y business_management, y only the assets you select during authorisation. We do not access the rest of your business portfolio, your personal profile or your messages.

With that authorisation we do only what you ask: read your campaigns, ad sets and ads; read their performance metrics; and create, edit, pause or resume campaigns and budgets when you confirm it. Every write is recorded in your change history with the before and after.

We store the identifier of the authorised ad accounts, the encrypted access token, and a copy of the metrics and campaign names needed to answer you. We do not store personal data about the people who see your ads: the metrics we read are aggregated.

• We do not use your Meta data to train artificial intelligence models, ours or anyone else's.
• We do not sell it, transfer it for commercial purposes, or combine it with other customers' data.
• Nobody on our team reads it, unless you authorise it for support or it is strictly necessary for security or a legal obligation.

You can withdraw access whenever you want: disconnect Meta from Comando, or revoke the app in your Facebook account app settings. When you do, we delete the token and the synced copy within the periods set out in the retention section. Step-by-step instructions are in how to delete your data.

7. Providers and transfers

We use infrastructure and service providers (hosting, databases, process orchestration, messaging, email, analytics and monitoring) that process data on our behalf under confidentiality and data protection agreements. Some may be located outside your country; in those cases we apply the corresponding legal safeguards.

8. Retention

We keep account data while the account is active and for up to 12 months after it closes, unless the law requires longer. Synced data is deleted when you disconnect the integration or close the account, within the backup retention periods. Audit logs are kept for as long as applicable regulation requires.

9. Security

We apply encryption in transit and at rest, role- and workspace-based access control (multi-tenant), credential rotation, audit logging and periodic reviews. No system is infallible; if we detect an incident affecting your data, we will notify you as the law requires.

10. Your rights

You can request access, rectification, erasure, objection, restriction and portability of your data, and withdraw your consent, by writing to privacidad@comando.pro. We will respond within the legal deadlines. If what you want is to delete your data, how to delete your data has the exact steps and timeframes. You may also lodge a complaint with the data protection authority in your country.

11. Cookies

The comando.pro site uses only the technical storage needed to work. The app.comando.pro platform uses session and security cookies. We do not use third-party advertising cookies.

12. Minors

Comando is aimed at businesses and professionals. We do not knowingly collect data from anyone under 18.

13. Changes

We may update this policy. We will publish the current version on this page along with the date it was last updated. If the change is significant, we will tell you by email or inside the platform.