Privacy Notice

01The essentials

Each point is developed further below.

02Controller and address

The party responsible for processing your personal data («responsable») is Walter Javier Serrudo, an individual trading under the brand AISOLVES. AISOLVES is the trade name of Walter Javier Serrudo. In this notice, «AISOLVES», «we» and «the controller» refer to him.

• Address for notices: Calle Mutualismo 67, interior 201, Colonia Escandón II Sección, Alcaldía Miguel Hidalgo, C.P. 11800, Mexico City, Mexico.
• Person in charge of personal data, who handles your requests (article 29 LFPDPPP): Walter Javier Serrudo, at aisolvespro@gmail.com, subject «Datos personales».
• More identification details: legal notice (Spanish).

AISOLVES has two different roles:

• Controller of the data of whoever visits the website, requests the report or writes to us on WhatsApp, Instagram or email, and of the accounts of AISOLVES OS users.
• Processor («encargado») of the data of our clients' customers inside AISOLVES OS. There, each client business is the controller, and we only process that data following its instructions (see 10).

03What data we process, case by case

For each case we say what data is processed, why, and whether the purpose is necessary or secondary (see 04). Unless we say otherwise, consent for the necessary purposes is tacit: we make this notice available before collecting your data and you can object (article 7 LFPDPPP). For the secondary ones we ask you to choose first.

3.1 When you open any page of the site Active

To show you a page, your browser has to request it from a server, and each request carries your IP address and your browser details (the «user-agent»). It happens when the page loads, before you choose anything in the panel:

• Vercel hosts us: it receives the address you request, your IP and your browser, and keeps technical logs, including the errors of our server functions, for 1 day (Pro plan). It is our processor (see 07).
• Before mounting the panel, the website asks our server whether you are visiting from the European Economic Area. Our server reads the country Vercel associates with your IP, answers only that, and stores neither your IP nor your country (see 3.11).
• The fonts (Montserrat, IBM Plex Mono and IBM Plex Sans) and the 3D library of the home page (Three.js) are served from our own domain, like these pages: no third party is involved when you open them.

These requests install no cookies and send nothing about your behaviour. Necessary purpose: showing you the website you ask for and protecting it.

3.2 While you browse, before you decide Active

The home page computes a few metrics in your browser to show you, in the consent panel and in the magnifier, what a website can know about a visit: seconds on the page, time with the tab visible, scroll percentage and speed, cursor speed and number of movements (of the position, only the last one, in memory, to compute the speed) and the section you are in. It also reads the browser type and the domain of the page you came from. The page does not look up your IP or try to infer your company.

None of this leaves your browser or is stored on your device: it lives in the tab's memory and disappears when you close or reload it. If on your phone you choose to enable the tilt effect, the device orientation is used the same way, only to move the panel. The only thing stored on your device is what you choose: your answer to the panel and the language, for 12 months (see cookies). Necessary purpose: showing you how the service we offer works, before you decide.

If you choose «Essential only» or if you revoke, the page also stops computing these metrics: it removes its scroll, cursor, click and tab-visibility listeners, stops its clock and deletes from memory what it had computed, including the origin of your visit and, if you arrived through a personal link, your Instagram username and your name (3.3). If you come back with that choice remembered, it applies it before setting any listener: it computes nothing, not even for an instant. From then on it computes nothing about your visit, not even in memory, until you accept. If you visit us from the European Economic Area, it never computes them (see 3.11).

3.3 What arrives in the link you come through Active

If the link carries campaign parameters, the website reads them to know which channel you came through: utm_source, utm_medium, utm_campaign, utm_content, utm_term, the click identifiers gclid (Google), fbclid (Meta) and ttclid (TikTok), and the ad data (ad_id, adset_id, campaign_id, campaign_name, ad_name, adset_name, placement). From that and the device type the origin of the visit is inferred, which is shown in the panel and in the report.

If you arrive through a personal link we sent you on Instagram, it may carry your Instagram username (ig) or your first name (nombre), or, instead, a random single-use code (r) that says nothing about you. The website removes them from the address bar at that very moment, before loading any tag. It reads your username and your name in memory and only shows them or uses them to fill in the form if you accept measurement; if you choose «Essential only», or visit us from the European Economic Area, it discards them without reading them. It only exchanges the r code for your username and your name, on our server, if you accept measurement, and the code then stops working; if you do not accept, it does not use it and it expires after 30 days. To stop abuse, when exchanging it we count the attempts from each IP for one hour, with an encrypted hash of the IP (not the IP). With ig and nombre, the full address, as it arrives, first goes through Instagram's link redirector (Meta), through the tool we use to send you the link if it is not sent by hand, and through our hosting (Vercel), which may keep it in its technical logs; with the r code, only the code goes through them (see 3.10 and 09).

Purposes: reading them in your browser to show you the origin of your visit is necessary; using them to measure and sending them to third parties is secondary and depends on your choice (see 3.4).

3.4 If you accept measurement («Accept and enter»)

Active Inside your browser, and only from the moment you accept:

• Your path: sections viewed, time and depth in each one and reading moments (an estimate: slow scrolling for at least 1.5 seconds).
• A log of up to 200 events: clicks on buttons with their text, three clicks in less than 0.6 seconds anywhere on the page (the «rage click»), spending more than 2.5 seconds over a pricing plan, the gesture of leaving the page through the top, and interactions with the 3D viewer on the home page (rotating it or changing the view), which count as signals and raise the score.
• Your score from 0 to 100 and its band (see 06).
• A random visit identifier (V-XXXX-XXXX) that only serves to match the report with what was measured. It does not identify a person.

All of this lives in the tab's memory: it is deleted when you close it and, if you revoke, immediately. The score only leaves your browser if you request the report: it travels with your code to our server, reaches you in the report and is noted with your conversation in the inbox (see 3.5 and 3.6); and if you ticked the sales contact box, it also goes with your record, marked as unconfirmed, to our CRM.

Secondary purpose (commercial prospecting). Express consent: your path is not measured or scored until you press «Accept and enter», and «Essential only» sits at the same level. Your browser remembers your choice for 12 months (key ais-consent: only what you chose, the date and the panel version). On your next visits measurement starts without asking you again, until you revoke, that period ends or we change the panel. If you choose «Essential only», that is remembered too, and the page computes nothing, not even the metrics in 3.2.

Not active today Meta Pixel, Conversions API, Google Analytics 4 and Google Ads. They will not be activated until the consent panel lets you accept or refuse analytics (Google Analytics) and advertising (Meta and Google Ads) separately, with the transfer clause of section 08, names Meta and Google, explains that your email is sent hashed, and records what you choose. That is how the website is programmed: even if their identifiers are configured, the tags do not load without that choice, and our server forwards nothing to the Conversions API without its own switch, only accepts submissions from this website, and only the events and data in this list. Before activating them, in addition: the Meta Pixel will run without its automatic configuration, which sends clicks and page data on its own (the website already turns it off); we will turn off automatic advanced matching in Meta Events Manager, which would read the form fields; and we will turn off Google Analytics enhanced measurement (clicks, scroll, forms, searches, videos and downloads) or declare its events here: the website does not load Google Analytics until that is done. When they are activated, and only with your acceptance:

• Their scripts will only be downloaded after you accept. Before that, Meta and Google receive nothing from this page, not even your IP.
• Meta Pixel and Conversions API. The events PageView, ViewContent (when you reach the pricing section), AIS_LeadSignal (your score and band, each time the band changes), Lead (if you request the report: the score and, if you gave us your email, your email converted in your browser with a hash function, SHA-256) and Contact (if you open the WhatsApp chat) are sent to Meta. The hash is not anonymous: Meta compares that value with its users' data to know whether you have an account and attribute the conversion to you. Each event carries an identifier so it is not counted twice, the page address and Meta's browser identifiers (_fbp, _fbc). The copy that goes through our server (Conversions API) adds your IP and your browser, and only goes out if the Meta Pixel actually loaded and ran in your browser: if you refuse it, if a blocker stops it from loading or if your browser sends the Global Privacy Control (GPC) signal, nothing is sent to Meta, neither by the browser nor by the server.
• Google Analytics 4 and Google Ads. The events page_view, view_item, lead_signal (score and band), generate_lead (score), contact and, in Google Ads, the lead conversion are sent. If your browser sends the GPC signal, we do not load them even if you accept them.

Secondary purpose (marketing and advertising). What goes to Meta and Google Ads is a transfer, because they also use it for their own advertising purposes, and it will only happen if you accept it (see 08). What goes to Google Analytics 4 is a disclosure to a processor (see 07).

3.5 If you request the report on WhatsApp Not active today

You write to us first. The form does not ask for your phone number. It asks, if you want, for your name and your email, and has a single box, optional and unticked: «I want AISOLVES to contact me on WhatsApp or by phone to talk about its services (optional).» Above the button that requests the code is the simplified privacy notice.

• The code. When you request the report, your browser sends our server the text of the report, your score, your first name, the language and, only if you ticked the box, its text, its version and your email. Our server stores it for 24 hours with a single-use code, without your IP, and returns a WhatsApp link (wa.me, from Meta) to our number with the message already written: «Hola, quiero el reporte de mi visita a AISOLVES. Código: …».
• You send it, from your WhatsApp. That message is your request and gives us your number (or your WhatsApp identifier). We reply there, within the 24 hours your message opens: first, if it is your first message, with the welcome message, which is our simplified privacy notice; then with the report: score, band, time and depth per section and the origin of your visit. We send nothing to a number that has not written to us: nobody can request the report for someone else's number. When we send you the report we delete its text, your name and your email from the code, and keep for one hour only the delivery status, which is what your browser sees. From then on section 3.6 also applies.
• A code is valid once and for 24 hours. If you send us a used or expired one, we reply that it is no longer valid. After 5 failed codes in a day from the same number we stop replying, so nobody can guess another visit's code. From the same IP at most 5 codes can be requested per hour.
• Sales contact, only if you confirm it. If you ticked the box, after the report we ask you on WhatsApp, in a separate message with two buttons, whether we may call or message you at that number to talk about our services. Only a clear yes to that question counts: the «Sí, contáctenme» (yes, contact me) button, a «Yes» or «I accept» replying to that message, or a sentence saying what you accept («Yes, you can contact me»). A question («Yes?») or any other message does not confirm it, and we note it so that a team member asks you; «No, gracias» (no, thanks) or a clear refusal we treat as an opt-out. Our CRM receives your record, with the number you wrote from, marked as unconfirmed, and we do not call or message you to sell you anything until you confirm it. If you are on our opt-out list we send you the report you ask for, but we do not ask you the question; nor if WhatsApp does not give us your number.
• The proof of your consent —the text of the box, its version and date, the question we asked you and your answer— is kept in a separate append-only register, with a chained hash and a timestamp, locked, while we use it and for 5 more years after it ends: when you withdraw it (with «stop», with «No, gracias» or by asking for cancellation), when our CRM tells us it stopped using it or, at the latest, 12 months after your consent or after the last contact we made with it, which is when our CRM deletes you (see 09); then it is deleted. In that register we also record the date and channel of each contact we make with your permission, and nothing else. The 12-month purge does not touch it. It is up to us to prove that you consented (article 20 of the LFPDPPP Regulations), and 5 years is the period in which the authority can sanction a contact made without permission (article 79 of the Federal Administrative Procedure Law, which article 4 LFPDPPP applies to its sanction procedures). If you later opt out, its date goes in that same register. If you never answer the question, your box is deleted after 30 days.
• If you chose «Essential only», the report carries a score of 0, because your path has not been measured. It cannot be requested from the European Economic Area (see 3.11).

Purposes: sending you the report you request is necessary; the sales contact is secondary and requires your express consent, which you give with the box and confirm on WhatsApp.

The form in the website footer sends nothing by itself: it copies your name and your email into this form and opens it; the «Message» field is discarded. Today the form works as a demonstration: it shows the report and generates no code.

Active The report's «Open chat» button already works: it opens our WhatsApp (wa.me, from Meta), the same link as in the website footer, with no data from your visit in the link: not your score, not the report, not the origin of your visit. What you write to us is up to you, and from then on section 3.6 applies.

The opt-out covers everything: if you ask us not to write to you (see 3.6), we do not ask you the sales question or send you any template, and we tell our CRM so that we do not call you. You can request it by writing to aisolvespro@gmail.com or replying «baja» or «stop» to any of our WhatsApp messages. Your number goes onto our opt-out list (see 13); if you request it by email, a hashed fingerprint of your email is kept (SHA-256, not the email), computed so that the variants of the same Gmail mailbox (with dots, with «+tag» or on googlemail.com) give the same fingerprint, and on other domains without the «+tag». If the CRM does not receive the notice, we retry daily and a team member enters it by hand within [DEADLINE TO ENTER AN OPT-OUT BY HAND: E.G. 48 HOURS]. Email and name are optional; without your WhatsApp message we cannot send you the report.

3.6 If you write to us on WhatsApp

Active Today. The WhatsApp we link on the website (wa.me/message/6QJ2SLFQUFZ6K1) is not yet connected to our inbox. We handle it with [APP OR SERVICE USED TODAY FOR THAT NUMBER, E.G. THE WHATSAPP BUSINESS APP ON AN AISOLVES PHONE], which stores your number, your profile name and the conversation on that device and in its backup: [BACKUP: GOOGLE DRIVE, ICLOUD OR NONE]. WhatsApp LLC carries the messages as our processor, under its terms for the WhatsApp Business app (see 07). Before you write to us, the website shows you our simplified privacy notice next to each link to that WhatsApp: the «WhatsApp →» link on the home page first opens a window with the notice and the button that opens the chat, and the same notice is under the «Open chat» button of the report. It says who the controller is and their address, what data we use and why, that we do not process sensitive data, how to limit its use and exercise your rights, and links to this section. Necessary purpose: handling the conversation you start. Period: 12 months from the last message; we delete them by hand.

Not active today Since whoever writes to us on WhatsApp may not have visited this website, we will set up on that number an automatic welcome message with the same simplified notice, which the WhatsApp Business app sends with your first message (or if you have not written for 14 days), and we will put the link to this notice in its WhatsApp Business profile. They are not set up today: we will say so here, with the date from which we do it, once they are.

Conditional When the number is connected to the WhatsApp Business platform, your messages will reach our inbox, which stores:

• Your WhatsApp number, your profile name and the identifier WhatsApp assigns to your account for our business (BSUID), which Meta sends us with every message. If you have a WhatsApp username, that name too. If you use it to hide your number, WhatsApp may not give us the number (unless we have spoken to you in the last 30 days), and then we recognise and reply to you through that identifier. We keep the identifier even if you have a number, to keep recognising you if you later hide it.
• Your messages with their time: text, data of the files you send (identifier, type, hash, file name and whether it is a voice note), locations you share (coordinates and address), names of contacts you share, catalogue orders and which message you are replying to.
• If you come from a «click to WhatsApp» ad: the click identifier (ctwa_clid) and the ad data (identifier, type, headline, text and link).
• Reactions, replies to buttons and lists, WhatsApp system notices (for example, if you change number, the new number and your new identifier, which move to your record), the number you decide to share with us using WhatsApp's button for that, and the technical reason when a message cannot be displayed.
• The status of the messages we send you (sent, delivered, read or failed, with the reason) and whether Meta charges us for each one and in which category. We do not store the amount.
• If you opt out: the date, the message you asked with or, if the team entered it, that (not which person: the inbox is opened with a shared password), whether it reached our CRM, and your number (or, if we do not have it, your WhatsApp identifier) on the opt-out list (see 13).
• If a message of yours looked like an opt-out without being clear: that message and what the team decided when reviewing it.
• If you requested the report with the website code: the code, the score it carried and, if you ticked the sales contact box, the question we asked you and the date you confirmed it (with the button or a «Yes» to that question) or wrote to us without answering it (see 3.5).
• Our internal management: who the conversation is assigned to, whether it is starred, archived or marked as spam, internal notes and who wrote each reply (the team, Meta's reviewer or our server).

The first time you write to us, the inbox replies with an automatic message that is our simplified privacy notice (article 16, section II, LFPDPPP): who the controller is and their address, what data we use, why, how to limit its use and where this notice is. If that message does not go out (for example, because Meta rejects it), the inbox warns the team and sends it again with each of your messages until it goes out; meanwhile, we do not ask you for data. Then we reply to you, confirm we have read your message and show you that we are typing. After 24 hours from your last message, WhatsApp only lets us write to you with a template approved by Meta: from the inbox we only use templates Meta has approved as utility, to continue the enquiry you opened, never advertising. Since Meta can change the category of an already approved template, we check it with Meta at most one minute before each send, and a template that stops being utility stops going out. We will not send you advertising on WhatsApp without your express consent.

How to opt out. Write «baja» or «stop» to us, or say it in your own words («don't message me anymore», «unsubscribe», «opt out», «ya no me manden mensajes»), and we opt you out at once; likewise if on WhatsApp you ask not to receive advertising from us. If your message sounds like an opt-out but is not clear («no me interesa», «don't write to me before 10»), a team member reviews it, and meanwhile we send you no template. With the opt-out we send you no template and not the sales question, and we tell our CRM so that we do not call you. We send you a single message confirming it, with the Mexico City date and time: it is the record of your entry on our opt-out list (see 13). After that we write nothing more, not even within the 24 hours your own message opened. If you write to us again, we reply to what you ask, never with anything commercial. If you change number, WhatsApp tells us and the opt-out moves to the new number.

What we cannot prevent with usernames: the opt-out is stored with your number and your WhatsApp identifier, but WhatsApp only tells us they belong to the same person when it gives us both. If you opted out writing with a username without giving us your number and later someone gives us your number another way, we will not know it is yours until we write to it: WhatsApp confirms it with that message, and from then on the opt-out also covers your number and our CRM, so at most that one message reaches you. And the other way round: if we record the opt-out only with your number (because you asked by email or by phone) and then you write to us with a username without showing it, we will not know it is you until you give us the number or WhatsApp confirms it. To avoid this, tell us your number on WhatsApp or by email.

The files you send are not stored on our servers: they are downloaded from Meta when a team member opens the conversation, and their browser caches them for five minutes. Meta only allows downloading them for 7 days from arrival; after that they can no longer be viewed.

If you delete or edit a message on WhatsApp, what happens in the inbox depends on how our number is connected, because WhatsApp only reports deletions and edits to numbers in coexistence mode (the WhatsApp Business app and the API at the same time):

• In coexistence, if you delete a message for everyone (WhatsApp allows it for two days), WhatsApp tells us and we empty its text and file in the inbox.
• If the number is connected only to the API, WhatsApp does not tell us you deleted it, and the message stays in the inbox until the period in section 09 expires or you ask us to cancel it (see data deletion).
• Of edits, at most we know you edited a message, without knowing which one or the new text, and the original stays as it arrived. If WhatsApp delivers the new text to us, we replace the previous one without keeping it.

Twelve months after the last message of the conversation, yours or ours, your contact, your conversations, your messages and the data of the ad you came through are deleted. A daily automatic process will do it; before connecting the number we will check that it works.

So that the inbox loads fast, the team member's tab keeps a copy of the conversation list, the open threads and the drafts. That copy is deleted when the inbox tab is closed, on logout, or when the session ends (12 hours), even if the tab stays open in the background.

During Meta's review of our app, a Meta reviewer may enter the inbox with their own temporary password, which is withdrawn afterwards. The reviewer only has access to test conversations, with our own numbers: the system does not let them see, open or reply to any other.

Purposes: handling the conversation you start, respecting your opt-out and continuing to recognise you if you change number or stop showing it are necessary. Knowing which ad started the conversation is secondary (measuring our advertising): that data arrives with your first message, and if you refuse, tell us and we delete it from your record; from then on we do not store it again, even if you write to us again from an ad and even if we have already deleted your conversation (because of the 12-month period or because you asked for cancellation): we keep your objection separately, with the key of your number, your WhatsApp identifier and an encrypted hash of your email (see 09).

3.7 If you write to us by email Active

We receive your address and what you write to us at aisolvespro@gmail.com, to reply to you. It is a free Gmail account: Google (Google LLC) provides the mailbox under its general consumer terms and processes the account data as a controller, under its privacy policy; it is not our processor, which is why it is not among the disclosures to processors in section 07. Google only acts as a processor in the services on its list of services with a data processing agreement, such as Google Workspace, and the free Gmail account is not on it. What you write to us by email therefore goes through Google and stays in that mailbox: that is why we do not ask you by email for copies of official IDs or other documents (see 11). If we move to an email service with a processing contract, we will update this notice. Necessary purpose: handling your enquiry. Period: see 09.

3.8 Access to the inbox Conditional

Only the AISOLVES team uses the inbox. To protect it, we count the login attempts from each IP address: we store an encrypted hash of the IP (not the IP) and the number of attempts for one hour from the last one, in our temporary store (Upstash) or, if it is not available, in the inbox database. After ten failed attempts in an hour it locks, and if there is nowhere to count them the inbox lets no one in. The session is kept in a technical cookie that lasts twelve hours (see cookies). Necessary purpose: the security of your data (article 18 LFPDPPP).

3.9 If you use AISOLVES OS In development

For the people who will use AISOLVES OS on behalf of our clients we will process, as controllers:

• Account: email, name, profile picture, password stored only as an Argon2id hash, language, time zone, last login date, and the account and role they work with.
• Sessions: hash of the session token, IP, browser and expiry. The session lasts 30 days by default and access is renewed every 15 minutes.
• Audit log: who performed which sensitive actions (for example, exporting or deleting contacts), on what, when, from which IP and with which browser. This log cannot be modified or deleted from the application.
• Usage: whether Meta charges each WhatsApp message of the account and in which category, so the client sees its usage. Today the system does not store the amount (it leaves it at zero). The recipient number stored with each record is data of our client's customers, and we process it on the client's behalf (see 10).

Necessary purposes: giving access to the service the client hired, securely, and performing the contract with the client. You have no contract with us: the business you work for does, so we process this data with your tacit consent (article 7 LFPDPPP). We will make the simplified privacy notice available to you, with the link to this one, in the invitation to AISOLVES OS and at your first login, before your account is created (article 16, section II), and you can object by writing to us. The audit log is also a security measure (article 18). The client also undertakes to inform you of this notice.

3.10 If we talk to you on Instagram Conditional

The website is ready for personal links. In an Instagram direct message conversation we may send you a link to this website carrying your Instagram username and your first name, to recognise you when you arrive and fill in the form if you accept measurement. The link may carry them in plain view (?ig= and ?nombre=) or, instead, a random single-use code (?r=) that we keep with your username and your name for up to 30 days, and that the website only exchanges for them if you accept measurement (see 3.3).

• When: only in conversations you start: if you write to us or ask for information on one of our posts.
• Where your username and name come from: your Instagram profile and the conversation itself, which we see in our Instagram account (Meta).
• Which tool we use to send those links: [INSTAGRAM MESSAGING TOOL, E.G. MANYCHAT, OR «BY HAND»]. If it is a third party, it processes that data as our processor.
• What the website does with them: as explained in 3.3. The full address, with your username and name, first goes through Instagram's link redirector (Meta), through that tool if it is not by hand, and through our hosting (Vercel), which may keep it in its technical logs.
• How we inform you: our Instagram account bio links to this notice, and our first reply in the conversation carries the simplified notice (who the controller is and their address, why we use your data and how to limit its use) with the link to this page. We do this from [DATE THE BIO LINK AND THE FIRST REPLY ARE SET UP].
• Purposes: handling your conversation is necessary; recognising you when you come back through the link we gave you only happens if you accept measurement (secondary).
• Period: the Instagram conversation, 12 months from the last message, and we delete it by hand; on the website, as long as the tab lasts.

3.11 If you visit us from the European Economic Area

AISOLVES offers its services to companies in Mexico and Latin America. We do not offer services in the European Economic Area (the 27 countries of the European Union, Iceland, Liechtenstein and Norway) and we do not measure those who visit us from there. That is why, before mounting the consent panel, the website asks our server whether you are visiting from there. Our server knows it from the country our hosting (Vercel) associates with your IP, answers only that, and stores neither your IP nor your country. If you are in the EEA, or if your country cannot be determined, the website does not measure your visit, computes no score, loads neither Meta Pixel nor Google and does not let you request the report, and tells you so with a notice; our server does not accept the report, the sales sign-up or the events for Meta from there either. We do this so as not to monitor the behaviour of people who are in the Union, which would subject us to the European Union's General Data Protection Regulation (article 3(2)), in a market where we do not work.

What it does not prevent: a VPN or a trip. If you visit us from the EEA with a connection that looks like another country, the website will measure you if you accept the panel; and if you are from Mexico and travelling in Europe, it will not measure you. If you write to us on your own from the EEA on WhatsApp or by email, we reply all the same, without scoring you.

04Necessary and secondary purposes

The law requires us to distinguish the purposes that give rise to our relationship with you and are necessary from those that are not, and to give you a way to refuse the latter before we process your data (article 15, section III, LFPDPPP and article 14 of its Regulations). We use your data only for these purposes; for any other we will first ask for your consent (article 11 LFPDPPP).

Refusing a secondary purpose does not stop you from requesting the report, writing to us or hiring us.

05Sensitive and financial data

• We do not process sensitive personal data (data affecting your most private sphere, such as your health, ethnic origin, beliefs or sex life) and we do not ask you for it. The score does not use it or try to infer it. If you send it to us on your own in a conversation, we use it for nothing other than replying to you and we cancel it if you ask us. Processing it would require your express written consent (article 8 LFPDPPP), and we do not ask for it because we do not need it: please do not send it to us.
• Tax and payment data, only of those who hire us: your RFC (Mexican tax ID), your name or company name, your tax regime and your postcode, which the tax invoice (CFDI) must include (article 29-A of the Federal Tax Code), and the details of the payment we receive. We process them to perform the contract and our tax obligations, which does not require your consent (article 9, sections I and IV, LFPDPPP). We do not ask for card or bank account numbers on WhatsApp.

06The interest score: automated processing

If you accept measurement, your browser computes a score from 0 to 100 that estimates your interest in our services. It is automated processing that evaluates your behaviour on the website without human intervention, and that is why we inform you of it (article 112 of the LFPDPPP Regulations). Before you accept, the score is always 0.

What it measures and how much it weighs

Bands: COLD (under 25), MQL·warm (25 to 44), WARM (45 to 64), HOT (65 to 79) and SQL (80 or more).

What consequences it has

• We show it to you in the panel, in the magnifier and in the report.
• If you confirm you want us to contact you, it helps us decide how soon we do it. A person makes that decision.
• Not active today When we activate Meta and Google, and only if you accept advertising and the transfer, the score and band are sent to them as events to measure campaigns and build behavioural advertising audiences.

The score produces no legal effects on you and does not significantly affect your interests: it is not used to deny you a service, a price or a contract, and you can always write to us or ask us for whatever you want, whatever your score. Even so, we explain its logic and you have these rights:

• To refuse before it is computed («Essential only») and to object afterwards, at any time (see how). You also have the right to object under article 26, section II, LFPDPPP if some day automated processing affected you significantly.
• To access the data it was computed with and rectify it if inaccurate, and to ask that a person reconsider any decision in which it was used (article 112 of the Regulations). Write to aisolvespro@gmail.com.

Safeguards

• It is computed in your browser, only after you accept, and deleted when you revoke or close the tab. It only leaves it if you request the report: it travels with your code, reaches you in the report on WhatsApp (carried by Meta) and is noted with your conversation in the inbox; and if you ticked the sales contact box, it goes with your record to our CRM, which keeps it for the period in the «Sales contact» row of section 09. When we activate Meta and Google, and only if you accept advertising, it will also go in their events.
• It does not use the content of what you write, sensitive data, or any data from your WhatsApp conversations: only how you move around the page and what you declare in the form.
• No decision about you is made with it alone.
• We will not activate Meta or Google, the report code, adding contacts to the CRM, or the score in AISOLVES OS without first carrying out a risk analysis of that processing, as part of the security measures required by the Regulations (articles 60 and 61), and we will summarise its conclusions here.

07Disclosures to processors

A «remisión» is the disclosure of data to a processor: someone who processes it only on our behalf and following our instructions, without using it for themselves. It does not require your consent (article 53 of the LFPDPPP Regulations), but we tell you about it. With each processor there is a contract or terms that bind them to the above; when a cloud service is contracted by adhesion, we only use providers with data protection policies, confidentiality, security measures and deletion at the end of the service (article 52 of the Regulations).

Our email mailbox is not a processor. Google (Google LLC) provides the free Gmail account aisolvespro@gmail.com under its general consumer terms and processes the account data as a controller, under its privacy policy; it is not our processor. We explain it in 3.7.

Several processors are outside Mexico. Disclosing data to them does not change your rights: we remain the controller towards you, and if a processor used your data for another purpose or transferred it without our instructions, it would become liable as a controller (article 53 of the Regulations). If you ask us for cancellation or withdraw your consent, we tell them so that they do the same (article 21 of the Regulations).

08Transfers and acceptance clause

The law defines a transfer as «any communication of personal data inside or outside Mexican territory made to a person other than the data subject, the controller or the processor» (article 2, section XX, LFPDPPP). Whoever receives it takes on our same obligations (article 35). Meta (Meta Pixel and Conversions API) and Google Ads cannot be our processors because they also use that data for their own purposes; that is why what reaches them will be a transfer. We do not sell data.

Requests from authorities

We only hand over personal data to an authority that asks for it through a reasoned and legally grounded request («fundado y motivado») from a competent authority (article 9, section VII, and article 36 LFPDPPP). For each request we: review its lawfulness and that it comes from an authority competent to make it; challenge it through legal channels if it is unlawful or disproportionate; hand over the minimum data needed to comply; document the request, what we reviewed and what we handed over; and notify the person concerned, or the AISOLVES OS client if the data is theirs, unless the law or the order itself forbids it. To date we have received none.

09How long we keep data

When a period ends, or when you ask for cancellation, we first block the data: we set it aside and stop using it, and keep it only to deal with the liabilities that could arise from the processing, for the applicable limitation period; then we delete it. If you asked for cancellation, we tell you through the same channel you used, at the moment we delete your data, before deleting the conversation, which is where we would write to you (articles 10 and 24 LFPDPPP and 107 of its Regulations). The periods for the data we process on behalf of clients in AISOLVES OS are in section 10.

10AISOLVES OS: the data of our clients' customers

In development AISOLVES OS is the CRM our clients will use to serve their own customers on WhatsApp. It is not yet offered to clients. For that data, each client business will be the controller: it decides what it uses it for and how long it keeps it, and it is the one that must give you its own privacy notice. AISOLVES will be its processor and will only process the data following its instructions, under the processing agreement that is part of our Terms (Annex I, Spanish) and articles 49 to 55 of the LFPDPPP Regulations.

What data will be processed on the client's behalf

• Contacts: name (the WhatsApp profile name), phone, email, picture, which of the client's staff handles them, sales stage, client-defined fields, language, time zone, time of their last message, and the first and last source touch (channel, ad type, ad headline and identifier, ctwa_clid and landing page).
• Identities: phone and WhatsApp ad click identifier, with the ad data. The system provides for other identifiers not used today; if they are activated, we will update this notice.
• Messages: text, file data, replies to buttons and lists, edits with the previous text (when WhatsApp delivers them, which only happens with numbers in coexistence), delivery statuses with their time, whether Meta charges them and in which category, and which of the client's users sent each one. The files themselves are not stored: Meta only allows downloading them for 7 days from arrival.
• Usage log: each message's recipient number, whether Meta charges it and in which category. It is kept even if the message is deleted (see Annex I of the Terms, item 13).
• Event log of each account, which includes the text of received messages and the phone of new contacts.
• Technical copies: the notices WhatsApp sends, as they arrive, for seven days, so they can be reprocessed.

The interest score is not on this list. It will not be offered in AISOLVES OS without the risk analysis in section 06. If it is offered, it will be computed only with behaviour on the client's website, with consent, and with what the person declares, and never with messages, delivery statuses, reads or other WhatsApp data: this is our own rule, stricter than Meta's terms.

Our commitments as processor

• Processing the data only on the client's instructions and for the purposes it sets; applying security measures; keeping it confidential; not transferring it except on its instruction, authorised subcontracting or an authority's requirement; and deleting it when the relationship ends (article 50 of the Regulations).
• Each client's data is kept separate from the rest: each row belongs to an account, and the database prevents one account from reading another's.
• We will not use that data for our own purposes: no cross-client statistics, no training of artificial intelligence models, no advertising audiences, and we will not share it between clients. If we did, we would become controllers with all their obligations (article 53 of the Regulations). Meta's terms also prohibit it for the data coming from its platform.
• If you are a customer of a business that uses AISOLVES OS and want to exercise your rights, contact that business. If you write to us, we will pass your request on and help it respond.
• Each business connects its WhatsApp number with its own WhatsApp Business account, and Meta processes those messages under the terms the business accepts with Meta. In the WhatsApp API, Meta keeps messages for 30 days at most.
• If the client business is outside Mexico, we still apply the security measures required by the LFPDPPP Regulations (article 4). We do not offer AISOLVES OS to businesses established in the European Economic Area or for targeting people who are there.

What is missing before opening it

With the current code, AISOLVES OS does not yet allow fully deleting a contact's data: deleting a contact marks it as deleted, and the event log and the previous text of deleted or edited messages are kept. We will not process real data of our clients' customers until the system can fully honour a cancellation and applies the retention periods each client sets. The technical details are in Annex I of the Terms.

11ARCO rights and how to exercise them

You or your representative can exercise these rights, known in Mexico as ARCO, at any time (articles 21 to 26 LFPDPPP). Exercising one does not prevent exercising another.

• Access: knowing whether we process your data, which data, and the conditions of its processing.
• Rectification: correcting it if it is inaccurate, incomplete or out of date.
• Cancellation: having us stop holding it, after a blocking period (see 09 and data deletion).
• Objection: having us not use it, or stop using it, for a specific purpose —such as commercial prospecting or the score— or when its use harms you; and against automated processing that significantly affects you.

How to submit your request

1. Where: by email to aisolvespro@gmail.com, subject «Derechos ARCO», or through our WhatsApp. It is free; only reproduction or shipping costs could be charged if you ask for physical copies (article 34 LFPDPPP).
2. What to include (article 28 LFPDPPP): your name and a way to notify you of the answer; the right you want to exercise or what you are asking for; the data it refers to, except for access; anything that helps us find it (the phone or email we know you by, your report code, your Instagram username); and, if you ask for rectification, the correction and what supports it.
3. If you act through a representative, we will verify your identity, theirs and the representation, through a public instrument, a power of attorney signed before two witnesses or your appearance in person (article 89, section II, of the Regulations).
4. How you prove it is you: the mechanism we set is that you confirm the request from the same WhatsApp number or email we know you by (article 89 of the Regulations). If that is not possible, or if you ask for access to data that cannot be safely linked to that number or email, you can sign your request with your advanced electronic signature (e.firma), which exempts you from sending a copy of your ID, or show us the original of your official ID on a video call, which we do not record and of which we keep no copy. We do not ask for copies of IDs by email or on WhatsApp: our mailbox is a Gmail account that Google processes under its own terms (see 3.7).
5. Acknowledgement: we confirm receipt with its date, from which the deadlines run. If something is missing, we will ask you for it once within the following 5 business days, and you will have 10 business days to send it (article 96 of the Regulations).

Deadlines and answer

• We communicate our decision within 20 business days at most from receiving your request and, if it is granted, we make it effective within the following 15 business days. We can extend each deadline only once, for the same period, if the circumstances justify it, and we will tell you within the deadline itself (article 31 LFPDPPP and 97 of the Regulations).
• We reply through the same channel you wrote to us on. We provide access by making a readable electronic file (JSON) available to you through a single-use link on our own domain, which we send you through that same channel (article 32 LFPDPPP): the file is encrypted until you download it, the link stops working once downloaded and expires after 7 days, and we do not send it to you as an email attachment. If you prefer, we show it to you in a video call. We confirm cancellation through the same channel at the moment we delete your data (see data deletion).
• We can only refuse in the cases set by law (for example, if identity is not proven or if the data is not in our possession), and we will always tell you the reason, with the relevant evidence (article 33).
• We keep a record of your request and how we handled it for 5 years, locked, only to be able to prove that we complied (see 09). Those we handle from the inbox (access, cancellation and objection to ad measurement) go into its register of records, without a copy of your data.

We keep nothing from your visit to the website unless you request the report or the measurement tags are active: if we have no data about you, we will tell you. Portability: the LFPDPPP does not provide for it as a right, but if you ask us we give you a copy of the data you gave us in a commonly used format (JSON).

If you receive advertising from us as a consumer, you can also ask us, free of charge, whether we hold information about you, which, and with whom we have shared it; we reply within 30 days at most (article 16 of the Federal Consumer Protection Law).

If you are not satisfied with our answer, or we do not reply, you can go to the authority (see 19).

12Withdrawing your consent

You can withdraw the consent you gave us at any time, with no retroactive effect (article 7 LFPDPPP), through a simple, free mechanism and at least through the same channel you gave it (article 21 of the Regulations):

• Measurement and score: «How to revoke» in the home page footer and then «Revoke · essential only». Your path, your score and the origin of your visit (with your Instagram username and your name, if you arrived through a personal link) are deleted at once, the page stops computing anything about your visit, and your browser remembers that you revoked.
• Sales contact: write «stop» or «baja» on WhatsApp, press «No, gracias», or write to us by email. We opt you out, tell our CRM and keep a record of the withdrawal.
• Advertising with Meta and Google, when it exists: from the same panel.

If you ask us to confirm that we have stopped processing your data, we confirm it expressly. If we had disclosed it to a processor, we tell them about the withdrawal. You cannot withdraw what the law requires us to keep, such as the proof of your consent or invoices.

13Limiting the use or disclosure of your data

Besides the ARCO rights and withdrawal, you can limit the use of your data with these options (article 15, section IV, LFPDPPP):

• Our opt-out list. It is our own exclusion list (article 110 of the Regulations). Joining it is free: write «stop» or «baja» on WhatsApp, say it in your own words, or ask by email. The record of your entry is the message we send you on WhatsApp with the Mexico City date and time; if you asked by email, we give it to you by email. From then on we send you no templates, do not ask you the sales question and do not call you; if you write to us again, we reply. If you ask to receive messages again, we remove you from the list.
• The Public Registry to Avoid Advertising (REPEP) of Mexico's Federal Consumer Protection Agency, at repep.profeco.gob.mx, to avoid advertising by phone. We only call or message to offer services to those who expressly confirmed it; that consent prevails over the REPEP only for AISOLVES and you can withdraw it whenever you want (article 60 of the Federal Consumer Protection Law Regulations).
• On the website: «Essential only» in the panel, and your browser's privacy settings (see cookies).

14Cookies and tracking technologies

This website uses technologies that obtain data automatically while you visit it. We tell you so in the consent panel itself, at the moment you arrive, with what is obtained and how to turn it off (article 14 of the LFPDPPP Regulations):

• Browser local storage (ais-consent and ais-lang): stores your choice and your language, for 12 months. It is necessary to respect your decision.
• The panel metrics before you decide (3.2) and the measurement of your path, the latter only if you press «Accept and enter», in the tab's memory. «Essential only» or «Revoke · essential only» turn both off: the page stops computing them and deletes them.
• Not active today Third-party web beacons and cookies: the Meta Pixel (_fbp, _fbc) and Google Analytics and Google Ads (gtag.js), only if you accept them separately. If your browser sends the Global Privacy Control (GPC) signal, they do not load even if you accept them.
• In the inbox and in AISOLVES OS, technical session cookies, only for the team and our clients' users.

The full list, with their duration and how to delete them, is in cookies and tracking technologies.

15Meta platform data

What data we receive through Meta's WhatsApp Business platform, where it comes from, what we use it for, where it is, how long it lasts and how it is deleted. We only process it to provide the service: in the inbox, to handle our own conversations; in AISOLVES OS, on behalf of the business that connects its number and following its instructions.

In the AISOLVES inbox Conditional

In AISOLVES OS In development

AISOLVES OS is not yet offered to clients and processes no real data. This table describes what the current code stores when a number is connected in testing and what is planned for when it opens.

We do not use this data for our own purposes, to build or augment profiles of WhatsApp users, to train artificial intelligence models or for advertising audiences, and we do not share it between clients. If Meta notifies us of a person's request about their data, we pass it on without delay to the relevant business. If we stop providing the service, we delete the Meta platform data.

To ask us to delete data we receive from Meta, follow the instructions in data deletion. How we respond if an authority asks us for data: 08.

16Security and breaches

We maintain administrative, technical and physical security measures to protect your data against damage, loss, alteration, destruction or unauthorised use, access or processing (article 18 LFPDPPP):

• The website and the inbox are served only over HTTPS.
• Meta and WhatsApp tokens live on the server, never in the page.
• We check the signature of every notice WhatsApp sends us before storing it.
• When the tags are active, your email will be converted in your browser into a SHA-256 hash before being sent to Meta, and our server only accepts that format. It is not anonymisation: it stops it travelling in clear, but Meta can compare it with its users' data.
• The report code and the sales sign-up are only accepted from this website, never from the European Economic Area, and have limits per IP and per number; nobody can sign up a number that is not theirs. The Conversions API also has its own switch on the server, only admits the events and data declared in 3.4, and forwards nothing if your browser sends the GPC signal or if the event does not carry the identifier set by the Meta Pixel itself (_fbp), that is, if the pixel did not actually run in your browser.
• The copy of your data we give you when you ask for access is stored encrypted (AES-256-GCM) with a key that exists only in the link we send you; it works once, is deleted when downloaded, if you ask for cancellation or after 7 days, and does not go through AISOLVES's devices.
• The proof of consents, contract acceptances and rights requests is in a register the database does not allow to be modified, recorded with another date or deleted before its period ends (09), where each row carries the hash of the previous one: if someone changed a row, we would know which one.
• The inbox session is signed in a cookie the page's code cannot read, and login attempts are limited to ten failed ones per hour and per IP; if there is nowhere to count them, the inbox lets no one in. The inbox copy lives only in the tab and is deleted when it is closed. Meta's reviewer only reaches test conversations.
• In AISOLVES OS: passwords stored as Argon2id hashes, session tokens stored as hashes, WhatsApp credentials encrypted with AES-256-GCM, per-client data separation in the database itself and an audit log that cannot be altered.
• Whoever processes data with us keeps it confidential, also after their relationship with AISOLVES ends (article 20 LFPDPPP).

If there is a security breach that significantly affects your property or moral rights, we will inform you immediately, on WhatsApp or by email, so you can defend your rights (article 19 LFPDPPP), with at least: what happened, what data was compromised, what we recommend you do, what we did to fix it and where you can find out more (article 65 of the Regulations).

If you find a security vulnerability, write to aisolvespro@gmail.com with the subject «Seguridad».

17Minors

Our services are aimed at companies and professionals. If you are under 18, do not send us your data. If we learn that we received it from a minor without the authorisation of their legal representative, we will cancel it.

18Changes to this notice

If what we do with your data changes, we will update this notice before the change (article 15, section VI, LFPDPPP):

• Where: at this same address, /privacidad (and this translation at /privacy), with the new «Last updated» date and version number at the top. We will email you the previous version if you ask.
• Changes we will ask you about: if the identity of the controller changes, if we want to process new data or for new purposes that require your consent, or if we want to make a new transfer that requires it. On the website, the panel will ask you again even if it remembers your previous choice; if you are in a conversation with us on WhatsApp or by email, we will tell you through that channel.
• What we already know will change: before activating Meta Pixel, the Conversions API, Google Analytics, Google Ads, the report code or adding contacts to the CRM, and before opening AISOLVES OS to clients. And when the authority publishes the new rules on personal data held by private parties, on which it has been working since January 2026.

19Authority and protection of your rights

The authority for personal data held by private parties is the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno; article 2, section XV, and articles 38 and 39 LFPDPPP), which replaced the INAI. Within it, its Personal Data Protection Unit and the Directorate General for Personal Data in the Private Sector handle proceedings against private parties (articles 30-B and 30-F of its Internal Regulations). Its website: gob.mx/buengobierno.

• If you are not satisfied with our answer to an ARCO request, you can file a rights protection request within the 15 business days after we communicate it to you; if we do not answer, from when our deadline expires (article 40 LFPDPPP).
• You can file it in a free-form document or with the forms or electronic system the Ministry provides, with your name, ours, your address for notices, the date of our answer and the facts (article 41). The Ministry decides within 50 business days at most, extendable once (article 42), may seek conciliation (article 49), and its decision can be challenged through an amparo proceeding (article 51).
• The Ministry can also verify, on its own initiative or at a party's request, that we comply with the law (article 54).

20Legal basis and reference documents

• Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette (DOF) on 20 March 2025, in force since 21 March 2025, last amended in the DOF of 14 November 2025: diputados.gob.mx. Enacting decree: dof.gob.mx.
• LFPDPPP Regulations (DOF 21 December 2011), among them articles 51 and 52 on processors and cloud computing and 89 on identification: diputados.gob.mx. Privacy Notice Guidelines (DOF 17 January 2013): dof.gob.mx. They were issued under the 2010 law; the 2025 law did not repeal them and no new regulations have been published, so we follow them in everything that does not contradict the law in force.
• Amendment of the Internal Regulations of the Ministry of Anti-Corruption and Good Governance (DOF 21 March 2025), articles 30-B and 30-F: dof.gob.mx. Dialogues to update the framework for personal data held by private parties (28 January 2026): gob.mx.
• Federal Consumer Protection Law, articles 16, 17, 18 and 18 BIS: diputados.gob.mx. Its Regulations, article 60: diputados.gob.mx. REPEP: repep.profeco.gob.mx.
• Federal Administrative Procedure Law, article 79 (the power to sanction lapses after five years), applicable under article 4 LFPDPPP: diputados.gob.mx.
• Commercial Code, articles 38 and 49: diputados.gob.mx. Federal Tax Code, articles 29-A and 30: diputados.gob.mx.
• Meta: Meta Terms for WhatsApp Business Platform: facebook.com (last modified on 23 September 2026), sections 1.4 and 7.7. Meta Global Processor Terms: facebook.com. For the WhatsApp Business app: WhatsApp Terms for WhatsApp Business App: whatsapp.com, and WhatsApp Business Data Processing Terms: whatsapp.com. Meta Business Tools Terms (Pixel and Conversions API): facebook.com. Meta Platform Terms: developers.facebook.com. Business-scoped user IDs (BSUID): developers.facebook.com. Reply buttons: developers.facebook.com. wa.me links with a message: faq.whatsapp.com.
• Meta, technical details: Meta Pixel without automatic configuration: developers.facebook.com. Automatic advanced matching: facebook.com. WhatsApp files, 7 days: developers.facebook.com. Edited and deleted messages, only in coexistence: edit and revoke. Message retention in the WhatsApp API, 30 days at most: developers.facebook.com. Template categories: developers.facebook.com. WhatsApp Business app greeting message: faq.whatsapp.com.
• Google: services in which Google acts as a processor, with its data processing agreement (free Gmail is not among them): business.safety.google/services. Google's role in Analytics and Ads: business.safety.google. Google Analytics enhanced measurement: support.google.com. Dots and aliases in Gmail addresses: 7436150, 22370 and 81126.
• Vercel: log retention by plan: vercel.com. Commercial use only on the Pro and Enterprise plans: vercel.com. IP country (x-vercel-ip-country): vercel.com. Data Processing Addendum: vercel.com.
• European Economic Area (3.11): Regulation (EU) 2016/679, article 3(2): eur-lex.europa.eu. EDPB Guidelines 3/2018 on territorial scope: edpb.europa.eu.