Privacy policy
Version 0.1 · Last updated: October 17, 2026
This is a translation for convenience. If it differs from the Spanish version, the Spanish version prevails.
Today we only run the waitlist, so the only data we collect is what you give us there (section 2.1). This policy also describes how we will handle data once the app launches, and we will update it before then.
1. Data controller
Gana (ganarewards.com), being incorporated as a company in Colombia. Contact for anything related to your personal data: [email protected]. This policy is issued under Colombian Law 1581 of 2012 and its regulations.
2. What data we process
2.1 Waitlist (today)
Your email address, the language and page you signed up from, your browser type (user agent) and the date.
2.2 App (at launch)
- Identity and contact: phone number and, for withdrawals, name, national ID number (cédula) and the destination account (Nequi, Daviplata or bank).
- Activity on Gana: which missions you are shown and in what order, which you open, completed events, rewards, reversals, withdrawals and investments, with date and time.
- Device and connection: IP address, country, device and browser type, and technical identifiers used to prevent fraud.
- Third-party data: confirmations from advertisers and mission providers that you completed an action, and identity-verification results when required.
We do not process sensitive data or data about minors. Surveys you answer inside third-party missions are handled by each survey provider under its own policy.
3. What we use it for
- Creating and protecting your account, and showing you the missions available to you.
- Verifying with advertisers that you completed a mission, and paying you.
- Preventing and detecting fraud and abuse.
- Meeting legal, accounting and tax obligations.
- Ordering missions by what is most likely to suit you, and measuring and improving the service.
- Training and evaluating statistical and machine-learning models (for example, to order missions or detect fraud) using pseudonymized or anonymized data. Results may be used in services Gana provides to third parties, always in aggregate and without identifying you.
- Contacting you about your account and, if you agree, about Gana news. You can unsubscribe from news at any time.
4. Who we share it with
- Advertisers and mission providers (for example, survey and offer networks): an internal ID, the click ID and, where a provider requires it to prevent fraud, your IP and country. We do not give them your name, phone number or ID number.
- Payment providers, to send you your money, and identity-verification providers, when required.
- Infrastructure providers (hosting, database, email) who process data only on our behalf.
- The partner broker, only if you choose to invest and with your express authorization at that moment.
- Authorities, when the law requires it.
We do not sell your personal data.
5. International transfers
Some providers (for example Cloudflare for this site, and hosting and mission services) process data on servers outside Colombia, such as the United States or the European Union. By using Gana you authorize that transfer, which we make to providers applying appropriate security measures.
6. Your rights
As the data subject you can, at any time and free of charge:
- Access, update and correct your data.
- Request proof of the authorization you gave us.
- Find out how we have used your data.
- Revoke your authorization or ask us to delete your data, except where the law requires us to keep it.
- File complaints with Colombia's Superintendence of Industry and Commerce (SIC), after contacting us first.
How: write to [email protected] from the email or phone linked to your account. We answer queries within 10 business days (extendable by 5) and claims within 15 business days (extendable by 8), as the law sets out.
7. How long we keep it
- Waitlist: until launch and one year after, or until you ask us to delete it.
- Money movements (rewards, reversals, withdrawals): as long as the law requires for accounting and tax records.
- Activity data: while you have an account; after that only in pseudonymized or anonymized form.
8. Security and cookies
We use encrypted connections (HTTPS), access control and audit logs. This site uses no advertising or tracking cookies; fonts load from Google Fonts, which receives your IP address when they do. The app will use one session cookie needed to keep you signed in.
9. Changes
If we change this policy in a significant way, we will tell you before the change applies. The current version is always on this page.