Terms of Service

01Parties and scope

These terms govern the relationship between Walter Javier Serrudo, an individual («persona física»), with address at Calle Mutualismo 67, interior 201, Colonia Escandón II Sección, Alcaldía Miguel Hidalgo, C.P. 11800, Mexico City, Mexico, who operates under the trade name AISOLVES («AISOLVES»), and the company or professional that hires his services («the client»). AISOLVES is the trade name of Walter Javier Serrudo.

• A contract for your business or professional activity. We contract with companies and professionals who integrate our services into their business. When you accept a proposal you declare that you are contracting for your business or professional activity, and you give us your RFC (Mexican tax ID) and your tax details for the CFDI invoice.
• The Federal Consumer Protection Law cannot be waived. If it turns out that you are contracting as a consumer, that law protects you even if these terms say otherwise, and its rights cannot be waived (article 1). In addition, if your business integrates the service but is a micro-business or an individual, you can file complaints with the Federal Consumer Protection Agency (PROFECO) or ask for its arbitration when the amount of the transaction does not exceed the limit the law updates every year, which in 2026 is MXN 760,889.82 (articles 99 and 117). Nothing in these terms limits those rights.
• Where we work. We provide our services to companies and professionals in Mexico and Latin America. We do not contract with businesses established in the European Economic Area, nor for services aimed at people who are there or that monitor their behaviour; if that is your case, tell us before contracting.

02Contract documents

The contract is made up of, in this order of priority:

1. The proposal or order the client accepts, with the scope, the price, the frequency of charges and the deadlines.
2. These terms.
3. Annex I (data processing) and Annex II (sub-processors), which prevail over everything above on personal data protection.

The terms the client accepts directly with Meta and with WhatsApp to use the WhatsApp Business platform are a separate contract between the client and them. Nothing said here can contradict them.

03How to contract

• We send you a proposal. The contract is concluded when we receive your acceptance (article 80 of the Commercial Code), in writing: with your signature, by email or with the acceptance button of our systems. A data message has the same effects as a signed paper, provided it can be attributed to you (articles 89, 89 bis and 93 of the Commercial Code and 1803 and 1811 of the Federal Civil Code).
• Before accepting you can ask us to correct any error in the proposal.
• We contract in Spanish.
• We keep a complete copy of the accepted contract for 10 years (article 49 of the Commercial Code) and send it to you. When acceptance is given from our systems, its record —who accepted, which version of the text, with its hash, and when— will go to an append-only register, with a chained hash and a timestamp, which the database does not allow to be modified or deleted before 10 years. It is not the preservation record of NOM-151-SCFI-2016, which requires the seal of a certification service provider; if a contract requires it, we will agree it in its proposal.
• These terms are published at this address before contracting, and you can save or print them. The version that applies is the one in force on the date of your acceptance, identified by the date above.

04Agency services

Signal-loss audit, instrumentation (Meta Pixel and Conversions API, Consent Mode v2, analytics, behavioural scoring and routing to WhatsApp), campaigns and the other services described in the proposal. The specific scope, deliverables and deadlines are those of the proposal.

• Access. You give us access by partner invitation from your own Meta business portfolio and your Google accounts. You keep ownership of the assets, pixels, ad accounts and data, and what we install in them stays with you if the relationship ends.
• Results. We undertake to provide the service with professional diligence, not to achieve a specific cost per lead, number of conversions or sales.
• Duration. Monthly retainer with no minimum term, which you can cancel at any time (section 10), unless the proposal says otherwise.
• Your website and your data. If we install measurement on your website or work with your contacts, you are the controller of that data: it is up to you to have your privacy notice, inform your visitors and customers and obtain their consent where needed, including the transfer clause if you send data to Meta or Google. We process that data as processors, under Annex I.
• Your advertising. You are the supplier who advertises. If we send advertising to your consumers on your behalf, we are also «the company that sends advertising on behalf of the supplier», and each message must identify both of us and PROFECO (article 17 of the Federal Consumer Protection Law). We will not send advertising to anyone who asked not to receive it or is registered in the Public Registry to Avoid Advertising (REPEP), except with their express consent given to you.

05AISOLVES OS

In development AISOLVES OS is a platform access service to serve your customers on WhatsApp from a shared inbox, with contacts, conversations, ad attribution and delivery statuses. We provide the service for as long as the contract lasts; we do not assign or license the software to you (section 11). It cannot be contracted yet. Before offering it we will publish in these terms the country of its infrastructure (section 09), the list of sub-processors (Annex II) and the default retention periods, and the system will allow the complete cancellation of data (Annex I, item 13). When it is offered, the features available at any time will be those described in the proposal; if a version is a trial or evaluation for a limited time, the proposal will say so.

• Accounts and users. You register your users and assign them a role. You are responsible for what they do with their access and for keeping their credentials safe, and you will tell us as soon as you learn of unauthorised access.
• Support. AISOLVES provides support for AISOLVES OS and first-line support for the WhatsApp platform. What we cannot solve ourselves we escalate to Meta. Channel: aisolvespro@gmail.com and our WhatsApp. Do not include personal data of your customers in your queries through those channels; if a specific conversation needs to be reviewed, we will review it inside AISOLVES OS, with your authorisation.
• Availability. Unless the proposal sets a service level, we do not commit to a specific availability. We may interrupt the service for maintenance, giving advance notice when possible.

06WhatsApp: what Meta requires

AISOLVES is applying to become a Meta Tech Provider. When Meta approves it and AISOLVES OS is offered, this will have consequences that you accept when contracting:

• Your account, your contract with Meta. You will connect your own WhatsApp Business account to AISOLVES OS with Meta's Embedded Signup (not yet available). Before using WhatsApp through us you must accept the Meta Terms for WhatsApp Business Platform, which for a business outside the United States and Canada are entered into with Meta Platforms Ireland Limited, and the WhatsApp Terms for WhatsApp Business Platform, which outside the European Economic Area are entered into with WhatsApp LLC and governed by California law. We will not give you access until you have done so. Meta processes your messages under those terms.
• Authorisation. By connecting your number you authorise us to act on your behalf before Meta to operate your WhatsApp Business account within AISOLVES OS: sending and receiving messages, managing templates and receiving your account's notifications.
• Only on your behalf. We access the data that comes from Meta's platform only on your behalf and following your instructions, keep it separate from other clients' data and do not use it for anything else. We keep a list of our clients with their contact details. We prohibit you from using the data you obtain through us in a way that breaches Meta's terms, as those terms require us to.
• Meta can veto a client. If Meta prohibits us from providing WhatsApp service to a client, we will comply immediately, without any liability for AISOLVES.
• We are answerable to Meta together. Meta's terms make AISOLVES responsible to Meta for its clients' use of the platform. That is why the obligations in section 07 are essential and breaching them allows the service to be suspended.
• Data requests. If Meta informs us of a request from a person about the processing of their platform data, including the exercise of their rights, we will pass it on to you without delay. If a WhatsApp user makes a verifiable request to you, Meta's terms may require you to notify Meta.
• We are not Meta. AISOLVES does not act as Meta's agent or representative, and gives no warranties on its behalf about the WhatsApp Business platform.
• If Meta withdraws our access. If our relationship with Meta as a Tech Provider ends, the WhatsApp features of AISOLVES OS will stop working. We will tell you as soon as we know, and you will be able to keep using your WhatsApp Business account directly with Meta or with another provider.
• If we stop providing the service. We will delete the Meta platform data we process on your behalf, after the extraction period in section 09.

Meta terms that apply: Meta Terms for WhatsApp Business Platform (version of 23/09/2026), WhatsApp Terms for WhatsApp Business Platform (effective 23/09/2026), WhatsApp Business Messaging Policy, Meta Global Processor Terms (incorporated by section 1.4 of the Meta Terms for the platform when Meta processes data as the client's processor), Tech Provider Terms and Meta Platform Terms (sections 3.d and 5.b, on deletion, client list and data requests). Meta updates them often: the version in force prevails.

07Acceptable use

When you use AISOLVES OS or the messaging we manage for you, you undertake to:

1. Prior permission (opt-in). Only write to people who have given you their number or their WhatsApp username and have agreed to receive messages from your business on WhatsApp. The permission must name your business and make clear that it is for WhatsApp. WhatsApp calls need a separate permission. Keep proof of each permission: it is up to you to prove it.
2. Templates. Only start conversations with templates approved by Meta and use each template for the category it was approved for. Without a template, you can only reply within the 24 hours following each message from the person.
3. Opt-outs. Immediately honour any request not to receive more messages, whether it comes through WhatsApp or another channel, and remove that person from your lists.
4. You are the supplier to your consumers. If your contacts are consumers, you are responsible for complying with the Federal Consumer Protection Law towards them: telling them free of charge, within 30 days at most, whether you hold information about them and with whom you shared it (article 16); identifying in each advertising message your name, address and phone or email, those of whoever sends it on your behalf and those of PROFECO (article 17); not sending advertising to anyone who asked not to receive it or is registered in the Public Registry to Avoid Advertising, unless they have given you their express consent, which prevails over the registry only for you and which they can withdraw (articles 18 and 18 BIS of that law and 60 of its Regulations); and not passing their information to other suppliers without their express authorisation (article 76 BIS). AISOLVES is your technology provider, not the advertiser. If your contacts are outside Mexico, also comply with the law of their country.
5. A person within reach. If you use automated replies, always offer a quick and clear way to talk to a person.
6. Your business profile. Keep your WhatsApp Business profile with customer service contact information (email, website or phone), accurate and up to date; make sure the display name has a clear relationship with your legal name; and do not impersonate another business or mislead about who you are.
7. Data that must not be requested. Do not request or share on WhatsApp full card numbers, bank account numbers or identity document numbers; do not process sensitive data without the express written consent required by article 8 of the LFPDPPP or beyond what Meta's terms allow; and do not pass data from one customer's conversation to another customer.
8. Prohibited sectors. Do not use WhatsApp for the products and activities prohibited by WhatsApp's messaging policy and commerce policy: among others, weapons, drugs, alcohol and tobacco, medical and healthcare products, protected species and live animals, hazardous materials, body parts or fluids, real, virtual or fake money, real-money gambling, adult content, dating, multi-level marketing, payday loans, debt collection, bail bonds and fraudulent services; and do not use it for political parties, candidates or campaigns. Nor may the WhatsApp Business platform be used by law enforcement agencies, military services or national security and intelligence agencies, or by entities that offer services related to politics, political candidates or campaigns, private companies that provide voting solutions and systems for elections, or exclusive government service providers.
9. Minors and regulated sectors. If your activity is in one of the regulated sectors Meta allows in some countries (for example, alcohol, over-the-counter medicines or online gambling), do not send those messages to anyone under 18, filter by age and country with technical and organisational measures, and hold the licences the law requires.
10. WhatsApp data. Respect the restrictions of Meta's terms on that data, including: not using any data about a person that you obtain from WhatsApp, other than the content of the conversation, for anything other than what is reasonably necessary to message that person; not using it to track, build or augment profiles of WhatsApp users; not sharing, selling or licensing it; and not using it to train artificial intelligence models beyond the fine-tuning exclusive to your business that Meta allows.
11. Artificial intelligence providers. Do not use WhatsApp through AISOLVES OS to offer artificial intelligence or machine learning technologies (language models, generative AI platforms, general-purpose assistants or similar) when they are the primary function of what you offer, rather than incidental, except in the countries where Meta allows it (Meta Terms for WhatsApp Business, 4.7).
12. No resale, no third parties and no Meta brands. Do not resell the WhatsApp Business platform or charge third parties for its use; do not allow third parties to integrate, access or use it through your account, except as provided in these terms; and do not use any Meta or WhatsApp name or brand, unless Meta allows you to under another agreement. Meta's Tech Provider Terms (section 5) require us to prohibit this expressly.
13. Your privacy notice. Have your full privacy notice published, give your contacts the simplified one when you collect their data on WhatsApp (article 16 of the LFPDPPP) and send it to us, because as your processor we must respect it. You are the controller of their data.
14. The score, without decisions that affect anyone. Do not use AISOLVES's behavioural score to make, without human intervention, decisions that produce unwanted legal effects on a person or significantly affect their interests, rights or freedoms (article 26, section II, of the LFPDPPP).
15. The basics. Do not send spam, illegal content or malicious software, do not try to access other clients' data and do not use the service to infringe third parties' rights.

The sanctions WhatsApp imposes on your account for quality or for breaching its policies (warnings, template or message blocks, account removal) are your account's and do not give rise to any liability for AISOLVES.

References: WhatsApp Business Messaging Policy (version of 23/09/2026), Meta Terms for WhatsApp Business (4.1 and 4.7, version of 23/09/2026), Tech Provider Terms (section 5, version of 31/07/2026), WhatsApp display name, Federal Consumer Protection Law, its Regulations and LFPDPPP. The version in force always prevails.

08Prices, payment, invoicing and recurring charges

• Our services. The price is the one in the proposal. The prices we publish on the website are indicative («from»), are in US dollars (USD) and do not include VAT, which is added at 16% and passed on expressly and separately in the invoice (article 1 of the Value Added Tax Law). The form and deadline of payment are those set in the proposal.
• Currency. If you pay in Mexico, you pay the equivalent in pesos at the exchange rate of the place and date of payment; if you pay from abroad by transfer in dollars, you pay in dollars (article 8 of the Monetary Law of the United Mexican States).
• Invoicing. We issue a digital tax receipt (CFDI) for each payment we receive. To issue it in your name we need your RFC, your name or company name, the postcode of your tax address, your tax regime and the use you will give the CFDI (article 29-A of the Federal Tax Code); without them, we issue it to the general public.
• Withholdings. If you are a legal entity, you apply the withholdings the law requires on what you pay us and give us the receipt: [WITHHOLDINGS OF A LEGAL-ENTITY CLIENT, TO BE CONFIRMED BY THE ACCOUNTANT: 1.25% INCOME TAX ON THE PAYMENT WITHOUT VAT (LISR, ART. 113-J) AND, ONLY IF THE SERVICE IS AN INDEPENDENT PERSONAL SERVICE AND NOT A BUSINESS ACTIVITY, TWO THIRDS OF THE VAT (LIVA, ART. 1-A; RLIVA, ART. 3); STATE WHAT APPLIES TO CONSULTING AND WHAT TO AISOLVES OS].
• Clients outside Mexico. [VAT TREATMENT OF CLIENTS OUTSIDE MEXICO (16% OR 0% RATE FOR EXPORTS, LIVA ARTS. 16 AND 29), TO BE CONFIRMED BY THE ACCOUNTANT].
• Meta charges you for WhatsApp messages. When Meta approves the application (section 06), AISOLVES will be a Tech Provider without a credit line with Meta: it will not invoice, resell or charge any fee for the use of the WhatsApp Business platform. After connecting your number you add your own payment method in WhatsApp Manager, and Meta charges you directly for the messages. Until you add it you will not be able to send or receive messages through AISOLVES OS, not even to reply to someone who writes to you (Meta, Tech Providers; Meta, «Add a payment method»). The taxes on those charges are a matter between you and Meta.
• What you see in AISOLVES OS. AISOLVES OS records whether Meta charges each message and in which category, not the amount: what it costs you is shown in Meta's invoice.
• Non-payment. If an invoice of ours remains unpaid, we may suspend the service after notifying you and giving you a reasonable period to pay.

Recurring charges

The monthly agency retainer and AISOLVES OS are charged periodically. Even if you contract as a company, we apply to you the rules that the Federal Consumer Protection Law requires for recurring charges since its amendment of 12 December 2025 (article 76 BIS, sections VIII and IX):

• You will know in advance. The proposal states prominently that the service involves recurring charges, their frequency, their amount and the date of each charge. If the charge is going to be automatic to your card or account, it will say so as well (article 54).
• Only with your express consent. We make no recurring charge without you having accepted it expressly and in an informed way, separately from accepting the proposal.
• Renewal notice. If the contract renews automatically, we notify you by email at least 5 calendar days in advance, and you can cancel it without any penalty.
• Immediate cancellation. You can cancel at any time by writing to aisolvespro@gmail.com or on WhatsApp, and when AISOLVES OS is offered, also from its own panel. The cancellation takes effect immediately: we make no further charge (section 10).

09Your data, export and change of provider

The data you put into AISOLVES OS, and your contacts' data, is yours. In addition to what Annex I says:

• What you can take with you. Today AISOLVES OS lets you export your contacts with their fields, in JSON, but without their identities or origin. The rest —contacts' identities and origin, conversations and messages (text and file data), stages and custom fields, your account's event log and the audit log— AISOLVES prepares for you on request, also in JSON, a commonly used structured format, within the transition period.
• Files. The files your customers send you can only be downloaded from Meta for 7 days after they arrive, and AISOLVES OS does not store them. If you want to keep them, download them within that period.
• What you can ask for. To switch to another provider, move your data to your own infrastructure or have us delete it.
• Deadlines. You can ask at any time. The transition lasts at most 30 days, and after that you have at least 30 more days to extract your data. When that period ends, we delete it, within the limits the system has today, which we will resolve before offering it (Annex I, item 13).
• Backups. The database provider's backups are overwritten in [BACKUP PERIOD OF THE CHOSEN PROVIDER]: what is deleted disappears from them when that period ends.
• Cost. We do not charge for changing provider or for extracting your data.
• Where the infrastructure is. Before offering AISOLVES OS we will publish here the country or region of its infrastructure.

10Cancellation, suspension and termination

• On your side, whenever you want. You can cancel any service at any time, with immediate effect for charges: we do not charge you for any further period. What you have already paid covers the service until the end of the current period; if you prefer us to stop providing it earlier, tell us. A proposal with a fixed-price project may set payment milestones for what has already been delivered.
• Immediate suspension. We may suspend your access to WhatsApp or to AISOLVES OS, without notice, if Meta orders us to, if you seriously breach section 07, or if your use endangers security, other clients or our status as a Meta Tech Provider. We will tell you the reason, unless the law or Meta prevents it.
• On our side. We may terminate the contract for a serious breach not remedied after notice, or without cause with 30 days' notice, unless the proposal says otherwise; in that case we refund the paid part of the period we do not provide.
• On termination. The export periods in section 09 apply, your data is deleted or returned under Annex I, and outstanding amounts are paid.

11Intellectual property

AISOLVES keeps all rights over AISOLVES OS, its code, the scoring engine, its methods and its materials. AISOLVES OS is provided as a service: for as long as the contract lasts we give you access to the platform to use it in your activity, without assigning or licensing to you the software, its copies or its code, and without you being able to use, copy or exploit it outside the service. You keep your data, your assets, your pixels, your ad accounts and what we install in them.

12Confidentiality

Each party will keep secret the other's non-public information it learns through the contract, will use it only to perform the contract and will protect it as its own, during the contract and afterwards, for as long as it remains confidential. This does not apply to what must be disclosed by law or by order of an authority. For personal data, confidentiality never ends (article 20 of the LFPDPPP).

13Personal data protection

• For the data of your contacts and your website visitors, you are the controller and AISOLVES your processor, under Annex I and the Federal Law on the Protection of Personal Data Held by Private Parties. The same applies to what your users do within your account: which conversations they handle and which messages they write. You guarantee that you have your privacy notice and the consent needed to process that data and to give it to us.
• For the accounts, sessions and audit log of the people who use AISOLVES OS on your behalf, and for invoicing, AISOLVES is the controller, under its privacy notice. You undertake to tell those people that they will use AISOLVES OS and where that notice is.

14Liability

• Each party is liable for its own breaches.
• You are liable for the content of your messages, your contacts' permissions, your advertising and your use of the service, and you will hold AISOLVES harmless against claims, sanctions or blocks by third parties, authorities or Meta caused by a breach of section 07.
• We are not liable for interruptions, changes or decisions of Meta, WhatsApp or other platforms we do not control.
• Except in cases of wilful misconduct or gross negligence, AISOLVES's total liability under the contract is limited to what the client has paid it in the twelve months before the event giving rise to the claim.
• That limit does not apply to AISOLVES's breaches of Annex I (data processing) or of confidentiality (section 12), or to the sanctions arising from them, which have their own limit of [OWN LIMIT FOR DATA AND CONFIDENTIALITY]. Within that limit, AISOLVES will hold the client harmless against third-party claims and sanctions caused by those breaches.
• AISOLVES's liability insurance: [INSURANCE COVERING THESE RISKS, IF ANY, OR «NONE»].
• If the Federal Consumer Protection Law protects you, these limitations do not apply insofar as that law prohibits them (article 90).

15Changes to these terms

If we change these terms we will notify you by email at least 30 days in advance. If you do not agree, you can cancel the contract before the change applies, without penalty. Changes imposed by Meta or by a law may apply within the period they set. No change alters the price or the recurring charges you already accepted without your express consent.

16Governing law and courts

These terms and each contract are governed by the Commercial Code and the other federal laws of the United Mexican States and, where they do not provide, by the Federal Civil Code (articles 2 and 1050 of the Commercial Code). If the client is outside Mexico, the parties expressly choose this law (article 13, section V, of the Federal Civil Code).

For any dispute, the parties submit to the competent courts of Mexico City, AISOLVES's domicile, and waive any other jurisdiction that may correspond to them by reason of their present or future domicile (article 1093 of the Commercial Code). This submission does not limit the complaints or arbitration before PROFECO to which you are entitled (section 01).

References: Commercial Code, articles 2, 38, 49, 80, 89, 89 bis, 93, 1050 and 1093 (diputados.gob.mx); Federal Civil Code, articles 13, 1803 and 1811 (diputados.gob.mx); Federal Consumer Protection Law, articles 1, 16, 17, 18, 18 BIS, 54, 76 BIS, 90, 99 and 117 (diputados.gob.mx); Federal Tax Code, articles 15-B and 29-A (diputados.gob.mx); Income Tax Law, articles 113-E, 113-G and 113-J (diputados.gob.mx); Value Added Tax Law, articles 1, 1-A, 16 and 29 (diputados.gob.mx) and its Regulations, article 3 (diputados.gob.mx); Monetary Law, article 8 (diputados.gob.mx); NOM-151-SCFI-2016 (dof.gob.mx).

A-IAnnex I · Data processing agreement

This annex is the instrument Mexican law requires for the relationship between the controller and the processor (articles 49 to 55 of the Regulations of the Federal Law on the Protection of Personal Data Held by Private Parties). The client is the controller and AISOLVES the processor. It is accepted together with the proposal, in writing, also in electronic form.

1. Subject matter, duration and purpose

AISOLVES will process on the client's behalf the personal data needed to provide AISOLVES OS and the agency services that involve accessing the client's personal data. The processing consists of collecting, recording, organising, storing, consulting, sending and receiving messages, attributing contacts to ads, exporting and deleting data, so that the client can serve its customers on WhatsApp and measure the origin of its contacts. If the client contracts the behavioural score, once the risk analysis has been done, it will be calculated only with behaviour on its website, with consent, and with what the person declares; never with the text, delivery statuses, reads or other WhatsApp data, under an AISOLVES rule stricter than Meta's terms. It lasts as long as the contract, plus the return and deletion period of item 10.

2. Types of data and data subjects

• Data: identification and contact data (name, phone, email, profile picture); content of communications (messages, file data, shared locations and contacts); attribution data (click identifiers and ad data); commercial data (stage, custom fields, person handling it); usage data (delivery statuses and whether Meta charges each message); and, if measurement is contracted, browsing data on the client's website and the score calculated only with it, within the limit of item 1.
• Data subjects: the client's customers and prospects and visitors to its website. Of the client's users in AISOLVES OS, only what they do within the client's account (assignments and authorship of messages); their accounts, sessions and audit log are processed by AISOLVES as controller (section 13 of the terms).
• No sensitive data will be processed unless the client receives it from its contacts; in that case, the express written consent required by article 8 of the LFPDPPP is obtained by the client, and the client undertakes not to request it on WhatsApp beyond what the law and Meta's terms allow.

3. AISOLVES's obligations

1. Process the data only in accordance with the client's instructions, including as regards its disclosure to third parties.
2. Refrain from processing it for purposes other than those instructed: no cross-client statistics, no model training, no advertising audiences. If it did, AISOLVES would become a controller, with all its obligations (article 53 of the Regulations).
3. Implement the security measures of item 7.
4. Keep confidentiality and ensure that those who process the data have committed to it, also after their relationship ends (article 20 of the LFPDPPP).
5. Delete or return the data once the relationship is over or on the client's instruction (item 10).
6. Refrain from transferring the data, unless the client so determines, the disclosure arises from an authorised subcontracting (item 5) or a competent authority requires it through a reasoned and legally grounded request. In the latter case, AISOLVES will review its lawfulness, challenge it through legal channels if it is unlawful or disproportionate, hand over only the minimum necessary, document the request and its response, and tell the client beforehand if the law allows (privacy notice, 08).
7. Help the client, with the tools of AISOLVES OS, to handle its data subjects' ARCO and withdrawal requests (item 9).
8. Notify the client of security breaches (item 8).
9. Respect the client's privacy notice, which the client will send it (article 13 of the LFPDPPP).
10. Make available to the client the information needed to demonstrate compliance and allow audits (item 11).
11. Inform the client immediately if, in its opinion, an instruction infringes data protection law.

4. The client's obligations

Have its privacy notice and give it to its data subjects in the appropriate form, process the data with the consent required —express and written for sensitive data—, obtain and keep its contacts' permissions (section 07 of the terms), give instructions in writing, send AISOLVES its privacy notice and supervise the processing. Towards its data subjects, the controller is the client.

5. Subcontracting

• The client authorises AISOLVES in advance to subcontract the services in Annex II, which will process the data in the name and on behalf of the client (articles 54 and 55 of the Regulations).
• AISOLVES will notify the client at least 30 days in advance of any addition or replacement. If the client objects on reasonable grounds and no solution is found, it can cancel the contract.
• AISOLVES will impose on each sub-processor by contract the same data protection obligations and will be answerable for it to the client. If the cloud service is contracted by adhesion, it will only use providers that comply with article 52 of the Regulations.
• Meta (Meta Platforms Ireland Limited) processes WhatsApp messages under the terms the client accepts directly with Meta when connecting its number. It is not a sub-processor of AISOLVES.

6. Clients and providers outside Mexico

If the client is not in Mexico, AISOLVES, as a processor in Mexico, applies the security measures of the Regulations all the same (article 4). The sub-processors in Annex II may process the data outside Mexico; that disclosure between processors, on the client's behalf, is not a transfer. AISOLVES does not provide this service to clients established in the European Economic Area or to target people who are there (section 01 of the terms).

7. Security

Current measures of AISOLVES OS: separation of each client's data in the database with row-level security; WhatsApp credentials encrypted with AES-256-GCM; passwords stored as an Argon2id hash; short-lived session tokens and renewal with a protected cookie; verification of the signature of WhatsApp notifications; an audit log the application cannot alter; and encrypted connections. AISOLVES will keep the list of security measures, with its inventory and risk analysis, and will review it to maintain a level of security appropriate to the risk (article 18 of the LFPDPPP and 60 and 61 of the Regulations).

8. Security breaches

AISOLVES will notify the client of any security breach affecting its data without delay and, at the latest, within 48 hours of confirming it, so that the client can inform its data subjects immediately when the breach significantly affects their property or moral rights (article 19 of the LFPDPPP). The notice will include, at least: the nature of the incident; the personal data compromised, with the approximate number of data subjects and records; the recommendations for data subjects; the corrective actions taken immediately; and the name and contact details of the AISOLVES person who will assist the client (article 65 of the Regulations). If it cannot give all the information at once, it will give it in phases, without further delay. Afterwards it will analyse the causes and correct what is necessary. If it affects data coming from Meta's platform, AISOLVES will also notify Meta as its terms require.

9. Data subjects' rights

If a data subject contacts AISOLVES, AISOLVES will pass the request on to the client without delay and will not answer it on its own unless the client instructs it to. AISOLVES will help the client to answer it within the legal deadlines (20 business days to communicate the decision and 15 to make it effective, article 31 of the LFPDPPP) with the tools of AISOLVES OS (consultation, export, rectification and deletion).

10. End of processing

When the contract ends, and after the extraction period in section 09 of the terms, AISOLVES will delete the data or return it to the client or to the provider it indicates, as the client chooses. If a law requires the data to be kept, it will be returned to the client. AISOLVES may only keep, blocked, the information needed to deal with the liabilities arising from the processing while they can be claimed.

11. Audits

AISOLVES will make available to the client the information needed to demonstrate that it complies with this annex and will allow audits and inspections by the client or an auditor it appoints, with reasonable notice, during business hours and under confidentiality.

12. Meta platform data

AISOLVES processes the data that comes from Meta's platform only on the client's behalf and according to its instructions, keeps it separate from other clients' data and does not use it in its own interest or that of third parties: no cross-client statistics, no training of artificial intelligence models, no advertising audiences.

13. What the client should know about the current system

So that the client can meet its own obligations, this is what the code of AISOLVES OS does today:

• Deleting a contact marks it as deleted: the row is kept so that it can be undone.
• Each account's event log stores the text of every message received and the phone of every new contact, and the application cannot modify or delete it.
• WhatsApp only reports that a person has deleted or edited a message if the client's number is connected in coexistence mode (the WhatsApp Business app together with the API); with the number only on the API, the deleted message stays whole in the system. When the deletion notice arrives, the system keeps the previous text in a field the inbox does not show. Edits are not applied today: the edit notice only exists in coexistence, and WhatsApp currently delivers it as a message that cannot be displayed.
• The usage log stores whether Meta charges each message, its category and the recipient's number, but not the amount (it leaves it at zero) or the country, and it is kept even if the message is deleted.
• The files contacts send are not stored: they can only be downloaded from Meta for 7 days after they arrive.
• The export the application offers today covers only contacts, without their identities or origin.
• The copies of WhatsApp notifications, with phones, names and texts, are deleted after 7 days. Finished queue jobs, also after 7 days. Those that fail permanently are kept with their content until they are reviewed.
• Each contact has a consent field, but today nobody fills it in and sending does not check it: managing permissions is the client's responsibility (section 07).
• WhatsApp credentials are encrypted with an environment key that today does not rotate automatically.
• Disconnecting a number marks it as disconnected and keeps Meta's access token, encrypted.
• There are no automatic retention periods for contacts, conversations, messages, events, sessions or audit.

That is why AISOLVES OS is not offered yet. Before processing real client data, AISOLVES undertakes that the system will:

1. Allow a contact's data to be truly deleted, also from the event log, the previous text of deleted or edited messages, the stored notifications and the queue jobs.
2. Delete permanently failed jobs after 30 days.
3. Delete Meta's access token when a number is disconnected.
4. Apply the retention period each client sets; by default, 12 months from the last message of each conversation.
5. Allow a user's account to be deleted, and keep the audit log for two years.

A-IIAnnex II · Sub-processors

Public list of the services AISOLVES subcontracts to process its clients' personal data. Changes are notified 30 days in advance (Annex I, item 5).

• AISOLVES OS: none yet, because it does not yet process client data. Before offering it we will publish here each sub-processor —at least the hosting provider of the application and of its database— with its country or region and its data processing agreement.
• Agency services: we work within the client's own accounts (its Meta business portfolio, its Google accounts, its website). If an engagement needs another provider that processes the client's personal data, we will add it here before using it.

Meta is not listed: it processes WhatsApp messages under the terms the client accepts directly with it (Annex I, item 5). Nor are the support channels (AISOLVES's email and WhatsApp): they must not receive personal data of the client's customers (section 05).