Privacy notice

The controller (responsable) of your personal data, in the cases described in the section “Our two roles”, is [RAZÓN SOCIAL] (“Promptusphere” or “we”), with its address at [DOMICILIO].

For anything related to your personal data, write to us at [CORREO DE PRIVACIDAD].

Promptusphere processes personal data in two different capacities, depending on whose data it is:

• As controller (responsable), we process the data of Businesses and their Staff (for example, whoever creates the account and the people they invite), and of visitors who write to support or use the anonymous AI try-out on the website. This notice applies in full to that data.
• As processor (encargado), we process the data a Business collects from its own customers through requests, public forms and portals. In that case the Business is the controller: it decides what data to ask for and why, and it must have its own privacy notice. We process that data only on behalf of the Business, following its instructions and solely to provide the Service to it.

If you are a customer of a Business that uses Promptusphere, please direct your questions and requests about your data to that Business first. If you send a request to us, we will forward it without delay to the relevant Business and let you know we did.

The Business also decides whether to send data to other destinations, for example through exports or webhooks it sets up towards its own systems. Those transfers happen on the Business's instructions and under its responsibility.

If a Business processes data of minors (for example, in school enrollments), it is responsible for obtaining consent from the parent or legal guardian. The Service is not directed at minors, and Staff must be of legal age.

Businesses and their Staff

• Identification and contact: name, email address and, if we ask for it, phone number.
• Work data: Business name, your job or function, and your role in the workspace (owner, admin or member).
• Subscription and billing: plan, subscription status, payment history and billing details captured by Stripe. Your card details stay with Stripe: Promptusphere never sees or stores your full card number.
• Usage and security: activity logs in the Service, IP address, browser and device type, and date and time of access.
• Support: the messages you send us and any information you include in them.

Business customers (as processor)

• Identification and contact: name, email address and phone number if the Business asks for it.
• Request content: answers, files, payment receipts you upload, comments, chosen options and quantities, and approvals or corrections, with their date, time and the version they refer to.
• Usage and security: IP address, browser and device data, and portal access logs, including the verification codes sent.

Visitors

• Support: name, email and the content of your message if you write to us.
• Anonymous AI try-out: the text you paste into the try-out and technical data (IP address and browser data) to prevent abuse. Please do not include personal data in that text.

Sensitive personal data

We do not ask for sensitive personal data, meaning data the law considers to affect the most intimate sphere of a person or whose misuse could lead to discrimination or serious risk, such as health status, ethnic or racial origin, genetic information, religious, philosophical or moral beliefs, political opinions or sexual preference.

Businesses must not use the Service to collect sensitive personal data from their customers.

Primary purposes

These are necessary for your relationship with us and to provide the Service:

• Creating and managing accounts, workspaces, roles and access.
• Letting the Business share requests with its customers and letting them respond.
• Sending access codes, invitations, reminders and Service notices.
• Storing versions, changes and approvals, with their date, time and version, so the Business and its customer know what was approved.
• Charging for the subscription and managing payments, credits and cancellations.
• Providing support and answering your messages.
• Protecting the Service: preventing abuse and fraud, isolating each workspace's data and limiting automated requests with Cloudflare Turnstile and rate limits.
• Complying with legal obligations and responding to requests from competent authorities.

Secondary purposes

These are not necessary for the Service, but help us improve it and keep you informed:

• Sending you product news by email.
• Occasionally inviting you to surveys about your experience.

If you do not want us to use your data for these secondary purposes, you can refuse at any time using the unsubscribe link in each such email or by writing to [CORREO DE PRIVACIDAD]. Refusing does not affect the Service or your relationship with us.

We do not use Business customers' data for any secondary purposes of our own.

We do not sell or rent personal data. To provide the Service we rely on providers that process data on our behalf, as processors, under contracts that require them to use it only for that purpose and to protect it. Some are outside Mexico, mainly in the United States and in other countries where their data centers operate.

These communications to processors are remisiones and do not require your consent under the law.

We may also transfer data to competent authorities when a law, a treaty or a judicial or administrative order requires it, or when it is necessary to establish, exercise or defend a right in legal proceedings. Under the law, these transfers do not require your consent. We do not make transfers that would require it; if that ever becomes necessary, we will ask you first.

You have the right to access your personal data, rectify it if it is inaccurate or incomplete, cancel it when you consider it is not needed for any purpose, and object to its processing for specific purposes. You can also withdraw any consent you have given us.

To exercise any of these rights, send an email to [CORREO DE PRIVACIDAD] with:

1. 011. Your full name and your account email, which we will also use to reply.
2. 022. The right you want to exercise.
3. 033. A copy of a valid official ID or, if you act on behalf of someone else, the document proving your authority and the IDs of both of you.
4. 044. A clear description of the data your request refers to and anything that helps us locate it. If you ask for a rectification, state the change and, where applicable, attach supporting documents.

We will respond within the periods set by law: we will reply within a maximum of 20 business days from receiving your complete request and, if it is granted, we will carry it out within the following 15 business days. If your request is incomplete, we will ask for the missing information and the period will run from when we receive it. These periods can only be extended in the cases the law allows, and we will tell you if that happens.

We will send our reply by email and, if you asked for access, deliver your data in an electronic file in a common format. Exercising these rights is free; we could only charge shipping or reproduction costs the law allows.

Please note that we cannot always act on a cancellation, objection or withdrawal immediately, for example if we must keep certain data due to a legal obligation. If you withdraw consent for primary purposes, we may be unable to keep providing the Service.

If your data was collected by a Business as controller, exercise your rights with that Business. We will forward any request we receive to it and help it respond.

• Use the unsubscribe link in our product news and survey emails.
• Write to [CORREO DE PRIVACIDAD] to ask us to stop using your data for a secondary purpose. We will add you to our internal exclusion list.
• If you own a workspace, you can revoke access, delete customer data and set retention periods from the application.

Service notices, such as access codes, request reminders or billing notices, cannot be turned off while you use the Service, because they are part of it.

We only use the cookies and technologies needed for the Service to work and stay secure:

We do not use advertising or cross-site tracking cookies. If we use analytics, it is Cloudflare Web Analytics, which measures visits in aggregate and does not use cookies.

You can block or delete cookies in your browser settings (usually under privacy or security). If you block the necessary cookies, you will not be able to sign in or use the customer portal, and the site will not remember your preferences.

We keep data while the workspace is active and for as long as needed for the purposes in this notice. The Business controls the retention of its customers' data:

• It can set how long completed requests are kept: 90 days, 1 year, 3 years or until it deletes them.
• It can delete a customer's data, revoke their portal access, export their information and delete its workspace.

When the free trial ends without a subscription or the subscription is cancelled, the workspace becomes read-only for 30 days, with export available. We then send a deletion notice to the owners and, 14 days later, delete the data.

Our backups (point-in-time recovery of the Cloudflare database and nightly exports) are deleted automatically on their own rotation cycle, so deleted data may remain in them for a limited time until they expire. We use backups for no purpose other than recovering from failures.

We keep some billing and payment records for as long as tax and commercial laws require, even after a workspace has been deleted. We keep the anonymous AI try-out text and security logs only as long as needed to operate the Service and prevent abuse.

We apply reasonable administrative, technical and physical measures to protect data against damage, loss, alteration, destruction or unauthorized use, access or processing, including:

• Encryption of communications in transit (HTTPS) and encryption of stored data in our provider's infrastructure.
• Role-based access control in each workspace and customer sessions limited to their own requests, with access codes that expire.
• Isolation of each workspace's data in every query.
• Verified signatures on the webhooks we receive from our providers and on the ones we send to Businesses.
• Type verification of uploaded files, which are always delivered as downloads, never as web pages.
• Restricted administrative access with additional authentication, and abuse prevention with Turnstile and rate limits.

No system is completely secure. If a security breach significantly affects your rights, we will inform you without delay so you can take action, as required by law.

We may update this notice due to changes in the law, the Service or our providers. We will publish each version on this page with its last updated date. If a change is important, we will also email workspace owners before it takes effect.

If you believe your right to personal data protection has been violated, you can go to the competent authority for personal data protection, which under the law currently in force is the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance). We ask that you write to us first at [CORREO DE PRIVACIDAD] so we can try to resolve it.