Privacy Policy

Makers Fellowship at makers.ngo (Makers, we, us), is the controller (responsable) of the personal data described in this policy. That means we decide why and how it is processed, and we answer to you for it.

• Data protection requests: team@makers.ngo
• General contact: team@makers.ngo

Our team handles data protection requests directly; there is no outside call centre between you and the people who hold your data.

This policy applies to every person whose data reaches us through makers.ngo or through the messages, calls and tools that belong to it:

• Applicants — anyone who starts or submits an application to the Fellowship, including through our admissions partner Nodi;
• Makers — people admitted to or who completed the Fellowship, including those in our talent pool;
• Students — makers invited to the learning platform at /learning;
• Companies — the people who send or manage a hiring request, and the supervisors and contacts they name;
• Partners — people who send a partnership enquiry for an organisation;
• Referrers and referred people — anyone who registers through a referral code;
• Our team — staff, volunteers and contractors who hold access to our internal dashboard.

It forms part of the Terms and Conditions. In this policy, personal data is any information that identifies you or could identify you; processing is anything done with it — collecting, storing, using, sharing or deleting it; a processor (encargado) is a provider that processes it on our behalf and on our instructions.

We process personal data under the Colombian Constitution (article 15), Statutory Law 1581 of 2012, Decree 1377 of 2013 as compiled in Decree 1074 of 2015, and the instructions of the Superintendencia de Industria y Comercio (SIC), the Colombian data protection authority. Where you live in another country and its law gives you more, see section 19.

We apply the principles the law sets out, and they shape how the system is built:

• Purpose and necessity: each form asks only for what its process needs, and we do not add fields "just in case".
• Freedom: we process your data with your prior, express and informed authorization, except where the law does not require it.
• Accuracy: we ask makers to confirm or update their profile every month, and we act on corrections you send us.
• Transparency: you can ask us at any time what we hold on you.
• Restricted access and circulation: our team sees what its role needs, and nothing personal is published on the open internet.
• Security and confidentiality: see section 16. Everyone on our team and every processor is bound to confidentiality, including after the relationship ends.

What we hold depends on how you came to us.

If you apply to the Fellowship: your full name, email, WhatsApp number, LinkedIn profile, country of residence and country of birth, the track you chose, how you heard about us and any referral code you used. If you applied through an earlier version of the form, we may also hold the additional answers it asked for, such as age range, gender, city, education, work and entrepreneurial experience, achievements, goals and an English self-assessment. We store the complete set of answers as submitted, the page and campaign that brought you to us (for example, the link parameters of an ad), your browser's user agent, and the status of your application.

If you apply through Nodi: our admissions partner Nodi shares with us your name, email, phone, LinkedIn, country and city, application date, the track and stage of your process, Nodi's evaluation and score, and your screening answers. From your professional profile we keep only your title, previous role names, skills and languages — never your CV file.

If you start an application and do not finish it: your email and the answers filled in so far, plus how far through the form you were.

If you register through a referral code: your name, email and the code you used. If you hold a referral code, we keep who it belongs to and which applications came through it.

If you are a maker: your name, email, phone, nationality, track, cohort, dates of joining and graduating, your referral code and your messaging preferences. If you are in our talent pool, also your professional profile — current situation, roles, seniority, tools, industries, languages and salary expectations — your CV, whether you have signed a participation agreement (with its date and version), and a set of professional tags derived from your profile (see section 8).

If you take part in a hiring process: each invitation we send you, whether it was delivered and whether you booked a screening call; whether that call took place and how long it lasted; the date we presented your profile to a company and the basis on which we were allowed to; interviews, offers, the outcome and, if hired, your role, start date, first salary and supervisor. After a hire, your answers to our check-ins on days 7, 14, 28, 56 and 84 — how the role is going, support from your supervisor, satisfaction, whether you need help — and the risk level we assign from those answers.

If you are a student on the learning platform: your name, email, track, class and invitation status; your login credentials, managed by our authentication provider; your attendance to each session; and the PDF deliverables you upload, with each version, its comment, its date and whether it was on time.

If you send a hiring request: your company's name and website; your name, email and WhatsApp number; the type of talent, roles, salary range and currency and job description; the time zone of your browser when you book a call; and the date and version of the data notice you accepted. As we work the request we add its stage, the person on our team who owns it, the dates we committed to, call notes and our own notes. If a hire goes ahead we also record the supervisor you name, agreement and payment references and documents, interview rounds, offers and rejection reasons, the start date and salary, and your answers to our check-ins on days 14, 30, 56 and 90, including satisfaction scores. We may also hold professional contact details of people at your company — name, title, email, phone and LinkedIn — that you or the company gave us in the course of a commercial relationship.

If you send a partnership enquiry: your organisation's name, type, size and website; your name, position, email and phone; the type of partnership, your timeline and your description.

If you are on our team: your email, name, role, access status, language preference and sign-in records; a log of sensitive actions you take in the dashboard; and, if you take part in internal tracking, your department, the indicators assigned to you and your check-in answers.

From any visitor: technical data about how the site is used, described in section 14. Our hosting provider also records your IP address in its access logs, and we use it momentarily to limit how often a form can be sent.

We do not ask for sensitive data as Colombian law defines it — racial or ethnic origin, political views, religious beliefs, union membership, health, sex life or biometric data. If a question ever touches on one of these, answering it is optional, we tell you so, and you can leave it blank without any consequence for your application.

Your image and voice can appear in the recording of a class or a call (see section 10). We do not use them to identify you by biometric means.

We never ask for a national id number, a bank account or card number, or a password through a form or a message. The only password you ever set is the one for your own learning or dashboard account, on our sign-in pages. If someone asks you for one of these in our name, it is not us — tell us at team@makers.ngo.

We process your data only for these purposes:

• Admissions: to review applications, verify what they claim — including references and certificates — detect duplicate applications, decide admissions, and keep you in our Talent Network for later intakes.
• Drafts: to let you resume an application you have not finished.
• Running the program: to enrol students, give them access to the learning platform, record attendance, receive and review deliverables, and measure progress.
• Placements: to keep makers' professional profiles current, match them to real roles, invite them to screening calls, present approved shortlists to companies, follow interviews and offers, record the hire and the fee, and follow up on onboarding, satisfaction and retention for the first 90 days.
• Companies and partners: to handle the request or enquiry you sent, schedule calls, prepare proposals, invoice and collect fees, and keep the commercial record.
• Referrals: to attribute an applicant to the person or campaign that sent them, which carries no weight in the admission decision.
• Communications: to send you the messages your process requires and, where allowed, invitations to programs, workshops and events (see section 9).
• Improvement and reporting: to understand in aggregate how the site and the program perform — conversion of the application form, attendance, placement rates — and to report those figures, without identifying anyone, to our team, funders and allies.
• Our team: to grant and withdraw dashboard access, audit sensitive actions, and track internal goals.
• Security and the law: to keep the services secure, prevent fraud and abuse, answer the authorities, and keep the records commercial and tax law require.

We do not sell your data, rent it, or let anyone use it for their own advertising. We do not use it to train artificial intelligence models. If we ever want to use it for a purpose not listed here, we will ask you first.

We obtain your authorization in a way we can prove later:

• by your submitting a form that links to this policy;
• by an explicit checkbox, such as the data notice on the hiring request form, which we store together with its date and version;
• by a signed participation agreement or enrolment, with its date and version;
• by your accepting an invitation to the learning platform and setting your password;
• by your explicit confirmation, for example to be presented for a specific role.

The law does not require authorization to process data that is public, data needed to perform a contract or a pre-contractual relationship you started with us, data requested by an authority in the exercise of its functions, or data processed for historical, statistical or scientific purposes. We rely on those exceptions only where they genuinely apply — for example, to keep the record of a placement fee, or to answer a court.

You can withdraw your authorization at any time (see section 17). Withdrawing it does not undo what we did lawfully before, and it does not apply to data we must keep because of a legal or contractual duty.

Parts of our work are automated so that a small team can serve many people. You have a right to know which:

• Matching makers to roles. When a company sends a role, the system scores each eligible profile against it with a fixed, published formula: role, required and desired skills, seniority, industry, evidence of experience, availability, how recent the profile is, languages and salary fit. Age, gender, nationality and admissions scores are never inputs. The highest-scoring makers may receive an automatic WhatsApp invitation to a screening call.
• Classifying profiles and roles. To make matching consistent we use an artificial intelligence provider, TypeSafe, to tag job descriptions and maker profiles against a closed list of roles, skills and industries. It receives only bounded, professional fields — never your name, contact details, demographics, employers, links, screening answers, admissions score or CV file. Classification of maker profiles stays off unless our management has accepted a data processing agreement with that provider. Optionally, and only with a separate approval by our management, it may receive a short excerpt of your CV from which emails, phone numbers, links and long numbers have been removed; that excerpt is not stored.
• Admissions scores. Our admissions partner Nodi evaluates applications and shares its score and evaluation with us.
• Follow-up risk. After a hire, the answers to our check-ins are classified as healthy, watch or critical, and silence is flagged, so our team knows whom to call first.
• Reminders and deadlines. Invitations, reminders and the expiry of links run on a schedule.

None of these decides anything about you on its own. A person on our team decides admissions, which profiles are presented to a company, and every step involving a hire or a fee; automated scores only order the work. If you think an automated step treated you unfairly, write to us and a person will review it.

We write to you by email and, where you gave us a number, by WhatsApp. Our WhatsApp messages use templates approved by Meta and are sent from an official business account. We do not store the content of the replies you send us there, only whether a message was delivered and any preference you express.

Messages about your process — the confirmation of your application, an admissions decision, an invitation to a screening call, a reminder about a call you booked, a placement check-in, your monthly profile update, access to the learning platform — are part of the service you asked for. You cannot opt out of them and keep the process open, but you can close the process at any time.

Invitations and promotional messages — programs, workshops, events, and opportunities for founders in our community — you can stop at any time by replying STOP on WhatsApp or by replying to any of our emails. Once you do, we move what we still need to tell you to email.

Calls with companies and makers. We schedule kick-off and screening calls through Google Calendar with a Google Meet link, so the names and emails of the invitees reach Google. After a call, we read from Google Meet whether it took place, how many people joined and for how long — not who they were. Kick-off calls with companies may be summarised or transcribed by Google Meet's note-taking tool, and we keep a link to those notes in the request. Google Meet shows everyone in the call when note-taking is on, and anyone can ask us to turn it off. Screening invitations never name the company, to protect its confidentiality.

Classes. Live sessions of the program may be recorded so students who missed them can catch up. Recordings are published as links — on YouTube, Google Drive or a similar service — shared with the students of the cohort, and may show your image, voice and name if you take part. The use of recordings and images beyond the cohort, including for promotion, is governed by section 13 of the Terms, including how to ask not to appear.

We share your data with our own team on a need-to-know basis, and with these providers, each acting on our instructions and for no purpose of its own:

• Vercel — hosting for the website, its server code and its scheduled tasks.
• Supabase — our database, private file storage for CVs and deliverables, and sign-in for students and our team.
• Resend — the emails we send: names, addresses and the content of each message.
• Kapso and Meta (WhatsApp Business) — phone numbers, first names and the content of approved templates.
• Google Workspace — calendar invitations, Meet links, call attendance and meeting notes.
• PostHog — product analytics on how the site is used, without names, emails or form answers.
• Nodi — our admissions partner. It shares application data with us; we do not send data back to it.
• TypeSafe — classification of roles and professional profiles, under the limits in section 8.
• Video and file hosting (YouTube, Google Drive or similar) — class recordings, which we link to rather than host.

If, at times, our application form is hosted by an external form provider, that provider also receives your answers, and we name it on the form itself.

We also read aggregate metrics from our own Instagram account through Meta's tools; we do not store the identities or comments of people who interact with it.

Most of these providers store and process data outside Colombia — mainly in the United States, and also in other countries where they operate. That is a transfer or transmission of personal data abroad under Colombian law.

We use providers that offer contractual data protection commitments and security standards at least equivalent to those Colombian law requires, and we limit what each one receives to what its job needs. By authorizing the processing of your data under this policy, you authorize these transfers.

With companies, if you are a maker. While we look for candidates, a company sees no identifying information about you. We share your name and professional profile with a company only when we have a recorded basis to do so — your signed participation agreement, your explicit confirmation for that role, or a membership agreement with the organisation you belong to — and only for the role in question. Companies must keep those profiles confidential and use them only to evaluate the role (see section 9 of the Terms). We never share your admissions score, screening answers or salary history with a company. After a hire, we share with you and the company only what the follow-up needs.

With mentors and facilitators of the program, the data of the students in their own cohort that they need to teach and give feedback.

With funders and allies, only aggregate figures that do not identify anyone, unless you agree to share your story with your name.

With authorities, when the law obliges us, and to defend our rights or those of others.

In a reorganisation. If Makers merges with or transfers its program to another organisation, your data may pass to it under this same policy, and we will tell you before it does.

We use a small number of browser technologies, each for a stated reason:

• Essential. Your application draft and the key to resume it, kept in your browser's local storage; the session that keeps you signed in to the learning platform or the dashboard; and a short-lived security cookie when our team connects a calendar.
• Functional. Preferences such as language, theme or a collapsed sidebar, and your name and class on the learning platform so the page loads faster.
• Attribution. For 30 days we remember the campaign link, referral code and referring website that brought you to us, so we can tell which channels work when you apply.
• Analytics. PostHog sets cookies to measure, in aggregate, which pages get read, where people abandon the form, which buttons get pressed and how fast pages load. It is served through our own domain so ad blockers do not distort the numbers, not to hide it from you. We do not record your screen, we do not capture what you type, and we do not attach your name, email, phone number or form answers to an analytics event. Links that carry a private token have it removed before anything is measured, and our dashboard, scheduling, screening, company workspace and follow-up pages are not measured at all.

We do not use advertising cookies or share browsing data with ad networks. You can block or delete cookies and local storage from your browser settings; the site will still work, but you will lose any unsubmitted draft.

We keep data only while it serves the purpose it was collected for, and then for the period the law requires. After that we delete it or anonymise it so it no longer identifies anyone.

• Applications: up to one year after you apply, in our Talent Network, so we can consider you for later intakes — unless you ask us to delete it sooner. If you are admitted, your application becomes part of your maker record.
• Unfinished drafts: until you submit the application or delete the draft.
• Maker records and talent pool profiles, including CVs: while you are part of the community and want to be considered for opportunities. Tell us to remove you from the talent pool and we will.
• Learning platform records: while the class is running and for as long as we need them to certify completion and measure the program, or until your enrolment is deleted, which also deletes your deliverables and your account.
• Hiring and partnership records: while the relationship lasts, and afterwards for up to ten years, the period Colombian commercial law sets for keeping commercial books and their supporting documents.
• Records of a presentation or a hire: kept as written, because they are the evidence that a fee was earned. They cannot be altered afterwards, by us or by anyone.
• Our team's access and audit records: while the person works with us, and afterwards for as long as an access audit or a legal claim may require.
• Promotional messages: until you opt out.

These are commitments the system is actually built on, not aspirations:

• Your browser never reads our database directly. Every read and write goes through our server. The key that ships in the website has no access to any table holding personal data, and row-level security is enabled on all of them.
• Private links are unguessable and expire. Links to book a call, update your profile, answer a check-in or manage a company request carry a secret token, and we store only a fingerprint of it, never the token itself.
• Drafts are addressed by a secret key, not by your email. Knowing your address is not enough to read, change or delete your draft.
• Files are private. CVs and deliverables cannot be downloaded by URL. Our team opens one through a link that expires in five minutes, and every opening of a CV is recorded.
• Access is personal and re-checked on every request, against a list we control and with permissions limited to each person's role, so withdrawing access takes effect immediately. Revealing a company contact's details requires management approval and lasts one hour.
• Sensitive actions are logged — granting or removing access, exporting personal data, changing sensitive settings — in a record that cannot be edited.
• Personal data is never written to our application logs.
• Data travels encrypted. Credentials for connected services are stored encrypted. Forms are validated, size-limited and rate-limited, and secrets stay on the server.

No system is perfect. If a security incident puts your data at risk, we will tell you without undue delay, explain what happened and what we are doing about it, and report it to the SIC as the law requires.

As the owner of your data, under article 8 of Law 1581 of 2012 you have the right to:

• know what data we hold on you, and access it free of charge at least once a month and whenever this policy changes in substance;
• update and correct it when it is partial, inaccurate, incomplete or misleading;
• ask for proof of the authorization you gave us;
• be told how we have used your data;
• withdraw your authorization or ask us to delete your data, when there is no legal or contractual duty to keep it;
• object to promotional messages and ask a person to review an automated step;
• complain to the SIC about a breach of the law, once you have first gone through our procedure in the next section.

These rights can be exercised by you, by your heirs, by a representative or attorney, or by whoever another person has stipulated in your favour.

Two limits worth stating plainly. Deleting your application means we can no longer consider you for a cohort or an opportunity. And where the law or a contract obliges us to keep a record — an invoice, the record of a placement — we keep that record and delete the rest.

Write to team@makers.ngo, or reply to any email from our team, with your full name, the email or phone number you used with us, what you are asking for, and how you want us to reply. If you act on behalf of someone else, attach proof that you can. To protect you, we may ask you to confirm your identity before handing over or deleting data; we will not ask for more than that needs.

Queries (to know what we hold or how we used it): we answer within 10 business days of receiving them. If we cannot, we tell you why before that deadline and answer within 5 more business days.

Claims (to correct, update or delete data, withdraw authorization, or report a breach of this policy): we answer within 15 business days of receiving them. If we cannot, we tell you why and answer within 8 more business days. If a claim is incomplete, we ask you within 5 business days for what is missing; if two months pass without an answer from you, we consider the claim withdrawn. While a claim is open, we mark the data in question as "claim in progress".

If you are not satisfied with our answer, you can take the matter to the Superintendencia de Industria y Comercio at sic.gov.co.

Most of our community lives across Latin America. Colombian law governs this policy, but where the data protection law of the country you live in gives you a right this policy does not — for example, data portability under Brazil's LGPD — you can exercise it through the same procedure, and we will honour it where that law applies to us. You can also complain to the data protection authority of your country.

Our services are for adults. We do not knowingly collect data from anyone under 18, and when we find that we have, we delete it. If you are between 14 and 17 and want to build with us, the program for you is Next, which has its own policy. If you are a parent or guardian and believe we hold data about your child, write to team@makers.ngo and we will remove it.

We update this policy when what we do changes — a new form, a new provider, a new field we store. Every version carries its effective date and version number at the top of this page.

If a change affects the purposes for which we use data you already gave us, or the identity of the controller, we tell you by email before it applies and, where the law requires it, ask for your authorization again.

For anything about your data, write to team@makers.ngo. The rules for using our services are in the Usage Policy, and the terms that govern them are in the Terms and Conditions.