Privacy Policy

Last updated: October 5th, 2026

This policy explains what personal data Lafi – Living & Foodies («Lafi» or «the app») processes, why, who receives it, and how you can exercise your rights. It applies to the mobile app and to lafi.com.co and api.lafi.com.co.

1. Data controller

Livingandfoodies S.A.S., Tax ID (NIT) 901593510, registered office at CARRERA 35 # 34-35. Email for data requests: soporte@lafi.com.co.

2. Data we process

Account data

Email sign-up: name, email and password. The password is stored hashed; we cannot read it.
Google sign-in: your Google account identifier, email and name (when the account is created). If you have no photo in Lafi, we may use your Google profile photo as your avatar.
Apple sign-in: your Apple account identifier and email, which may be Apple’s private relay address. We store an encrypted token so we can revoke access with Apple if you delete your account.
Language and avatar. We do not ask for a phone number or date of birth at sign-up.

Gameplay data

Your Lafi credits and their history, prizes you win and redeem (with code and status), and your QR scans (account, partner and date).
Your trivia history (which questions you answered, not the option you chose).
Your ratings and comments about partners, and your comments on experiences. The comment on a rating is shown anonymously.
Your text answers to observation challenges.

Challenge photos

When you complete a photo challenge, the photo is taken with the app camera, stored on our servers and sent to an AI provider for evaluation (section 5). The app does not access your photo library. For now, anyone who has the exact link to a photo could open it, so please do not photograph people or personal information in challenges.

Location

The app asks for your location only while you use it, to check that you are within 50 meters of the partner when you redeem a QR code, and to show maps. We do not store your coordinates, only the calculated distance. We do not request background location.

Purchases

In-app purchases are processed by Apple or Google. We receive transaction identifiers, the product, the date and the status (for example, a refund). We do not receive or store your card details. We use a pseudonymous identifier to link the purchase to your account.

Questions to the Guía Sabio (AI guide)

If you ask a question, we send its text, without your name or email, to an AI provider to generate the answer (section 5). We do not store the text of your question, only a technical identifier to avoid duplicates; we do store the answer. We do not record your voice.

Technical data

A user identifier attached to error reports. We remove email, phone, coordinates and tokens from those reports.
The device name, linked to your session.
The app update servers (Expo) receive technical installation data such as platform, version and channel.
Like any internet service, our servers and providers may log your IP address in technical logs.

The app shows no advertising and we do not sell your data.

3. Why we use your data

Create and manage your account and session.
Run the game: credits, challenges, trivia, prize wheel, QR and prize redemption.
Verify that you visited a partner.
Evaluate photo challenges and answer your questions to the Guía Sabio.
Process purchases, access and refunds.
Security, fraud prevention and error detection.
Handle your support requests.
Send service emails (email verification, password reset, receipts). We send no third-party advertising, and if we ever send marketing we will ask for your consent.

4. Who receives your data

We do not sell your data. We share it with providers that help us run Lafi and with authorities when the law requires it.

Provider	Purpose	What it receives
Apple	Sign in with Apple, App Store purchases, maps on iOS	Account and transaction identifiers
Google	Google sign-in, Google Play purchases, maps	Sign-in data, purchase identifiers, visible map area
DeepSeek	AI to evaluate challenge photos and answer the Guía Sabio	The challenge photo or the question text
ElevenLabs	Voice for Guía Sabio answers	The AI answer text (not your voice)
Sentry	Error detection	User identifier and technical error details
Resend	Service emails	Email and name
Expo	App updates	Technical installation data
Wompi	Payments by business partners	Reference and amount; no tourist data

Partners. Partners (restaurants, agencies and other businesses) receive only what they need to operate, for example that a prize or code was redeemed and who validated it. When a partner employee generates a QR code, we store that employee’s location to verify the visit.

5. Artificial intelligence

Two features send data to DeepSeek, an AI provider whose servers are outside Colombia:

Photo challenge: the photo you take is sent for evaluation.
Guía Sabio: the text of your question is sent to generate the answer, without your name or email.

ElevenLabs receives only the answer text to turn it into speech. These providers process data under their own policies. If you do not want your photos or questions sent, do not use the photo challenge or the Guía Sabio; the rest of the app works without them. Avoid photographing people or personal information.

6. International transfers

Some providers in section 4 are outside Colombia. By accepting this policy and using the features that involve them, you expressly authorize the transfer and transmission of your data to those providers for the purposes described. This is done in accordance with Colombian Law 1581 of 2012.

7. How long we keep your data

We keep your data while your account exists and for as long as needed to meet legal, accounting and tax obligations, prevent fraud and resolve claims. Technical and transaction records may be kept for that period.

8. Deleting your account

In the app: Profile, then Delete account.
Without the app: email soporte@lafi.com.co from your account email with the subject «Delete my Lafi account». More details on the Delete my account page.

When you delete your account we remove your sessions, comments, challenge photos and answers, and revoke your Premium access and partner link. Your personal data (name, email, avatar and Google and Apple identifiers) is anonymized, and we revoke access with Apple if you used Sign in with Apple. We keep, linked to an anonymized account, credit movements, purchases, QR scans and trivia history, only as far as needed for legal, accounting and fraud-prevention obligations.

9. Your rights

Under Colombian Law 1581 of 2012 you may: know, update and correct your data; request proof of your authorization; be informed of how we use your data; file complaints with the Superintendencia de Industria y Comercio; revoke your authorization or request deletion; and access your data free of charge.

To exercise them, email soporte@lafi.com.co from your account email. We respond within the legal deadlines: 10 business days for inquiries and 15 for claims, extendable where the law allows.

10. Security

We protect your data with reasonable measures: encrypted connections (HTTPS), hashed passwords, encrypted tokens and access control. No measure is perfect and we cannot guarantee absolute security.

11. Minors

If you are a minor, you must use Lafi with the authorization and supervision of your parent or legal guardian.

12. Google user data

Lafi’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.