Privacy Notice

The controller (responsable) of your personal data is Ana Silvia Juarez Gutiérrez, an individual (persona física) with address at Sendero Edam Oriente 5, Fraccionamiento La Esmeralda, San Miguel de Allende, Guanajuato, México, C.P. 37893. «Avenza» is the trade name under which she operates.

The personal data officer who handles ARCO rights requests, under article 29 of the Mexican Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), can be reached at [email protected].

Avenza processes data about two groups of people who are not in the same position, and confusing them would make this document useless.

All of Avenza’s purposes are necessary to provide the service. They are:

• creating and maintaining your account, authenticating you — with the account confirmation, password recovery and email change emails — and controlling who accesses what within your business;
• receiving the messages your customers send over WhatsApp, storing the conversation and displaying it in the inbox;
• if you connect the number you already use in WhatsApp Business: bringing your history into the inbox, using the names in your address book to name your customers and showing there what you reply from your app;
• generating automatic replies with the AI assistant from the knowledge you have loaded;
• sending those replies back over WhatsApp;
• notifying you on your phone, if you accept it, when a customer is waiting for a reply;
• measuring your monthly AI usage in order to apply your plan’s limits;
• keeping backups of the database so the service can be recovered if it is lost;
• answering whatever you write to the contact address.

There are no secondary purposes. Your data is not used for advertising, for building commercial profiles or for product analytics, and it is neither sold nor transferred to anyone for third parties’ own purposes. That is why this notice offers no box to opt out of secondary purposes: there are none.

The assistant runs on a model from an external provider, which means part of the conversation leaves Avenza’s infrastructure. It is worth being precise about what leaves and what does not.

• Your customers’ phone numbers are not sent to it.
• What is sent is the customer’s profile name, the conversation history and the knowledge you have loaded about your business.
• If the business connected the number it already uses in WhatsApp Business, its history and what it sends from its app are part of the conversation and are sent to it just like the rest of it, even if they are chats from before using Avenza.
• The photos the customer sends are sent to it too, as images, so the assistant can see them. Each photo is sent only once, and only while the business’s plan has photo allowance left; without it, the conversation is handed over to a person on the team.
• Voice messages are not sent to it, nor to any other provider, and they are not transcribed: the assistant asks the customer to write what they meant.

Avenza does not store the photos or the voice messages. For each file it keeps only the identifier WhatsApp gives it, the file type, its name and a SHA-256 fingerprint, a code that identifies the file without containing it. To send a photo to the assistant, it is downloaded from WhatsApp at that moment.

Of the assistant’s usage, Avenza stores the consumption, not what was written: the model used and the number of text units processed. The text sent to it is not stored as a separate record.

Avenza cannot say that it does not share data with third parties, because the service would not work without them. This is the complete list of providers that process personal data on behalf of Avenza or of the business:

• Supabase, Inc. (United States) — infrastructure: the database, authentication and functions where everything described above lives. The data is stored in the United States, in the Ohio region (us-east-2).
• Anthropic, PBC (United States) — the artificial intelligence model that generates the assistant’s replies, with the scope set out in section 5. It processes the data in the United States.
• Meta — WhatsApp Business: every message comes in and goes out through it, and through it come the history, the address book and what the business sends from its app when it connects the number it already uses in WhatsApp Business.
• Google — for those who sign in with their Google account; through Firebase Cloud Messaging, to deliver phone notifications on Android; and through Gmail, the mailbox where the emails sent to [email protected] are received, including ARCO rights requests.
• Expo (650 Industries, Inc., United States) — sends the phone notifications. It receives the phone’s token, the notification’s title and text and the internal identifiers that open the conversation; never the customer’s name or their messages.
• Resend, Inc. (United States) — sends the account emails from [email protected]: account confirmation, password recovery and email change. It receives your email address and the content of those messages.
• Cloudflare, Inc. (United States) — manages the avenza.app domain and forwards the emails that arrive at [email protected], so it processes whatever you write to that address.

Because several of these providers are in the United States, your data is processed outside Mexico. All of them process the data on behalf of whoever is the controller, so these communications do not constitute transfers within the meaning of article 2, section XX of the Law. Beyond this list, there is no one else.

Each business is isolated from the rest. The system prevents, at the database level, one account from reading another business’s data, and that isolation is enabled on every table without exception.

The WhatsApp channel credentials do not live in an ordinary column: they are kept in a separate encrypted store that the application cannot write to directly.

New passwords must be at least 8 characters long, with letters and numbers, and changing your password while signed in requires entering the current one. Both rules are enforced by the server, not just the app. Anyone who has forgotten theirs recovers it by email, and an older password that does not meet the rule still works for signing in, although the app asks for it to be changed.

What this notice will not claim is that all your data is encrypted. Verifiable encryption covers those credentials and the own backups described in section 6; the rest depends on the infrastructure provider’s encryption at rest, which Avenza cannot verify by itself and therefore does not present as its own guarantee.

If you have an Avenza account, you can at any time:

• switch off the assistant, entirely or in a specific conversation, so that it stops generating replies;
• edit or delete the business knowledge you have loaded, which is what gets sent to the AI model;
• disconnect the WhatsApp channel, after which no new messages come in;
• switch off phone notifications in Settings → Notifications, or not grant the notification permission when the phone asks for it;
• delete your account, with the scope set out in section 6.

There is no advertising or analytics to switch off, as described in section 3.

You have the right to access your personal data, to rectify it when it is inaccurate, to cancel it and to object to its processing — the rights known in Mexican law as ARCO.

If you have an Avenza account, you exercise these rights by writing to [email protected]. State which right you wish to exercise and provide what is needed to prove your identity; in the case of rectification, state also what needs correcting.

Avenza will communicate the decision taken within a maximum of twenty business days of receiving the request, and if the request succeeds it will be given effect within the fifteen business days following that communication. Both periods may be extended once by an equal period where the circumstances justify it, under article 31 of the Law.

If you are a customer of a business that uses Avenza, you exercise your rights with that business, for the reasons explained in section 2. The data deletion page sets out what Avenza can do today in that case.

When an end customer’s data is deleted, their identifier is recorded on a suppression list. Without it the deletion would not last: the system recreates the customer’s record as soon as another message from them arrives, and the person would reappear with their name and phone number.

The list also applies when a business connects the number it already uses in WhatsApp Business: for anyone who asked for their data to be deleted, Avenza creates none of what section 3 describes — not their history, not their name from the address book, and not what the business sends them from its app.

From that follows an uncomfortable consequence this notice prefers to state rather than hide: in order never to store someone’s phone number again, their phone number has to be stored. The list keeps the WhatsApp identifier — which is the number — the channel, the business it belongs to and the date. It does not keep the name, the notes or the messages: only the minimum needed to recognise that this person must not be let back in.

The second consequence is more serious. Today a suppression cannot be lifted. There is no way to undo it. Someone who requests the deletion of their data from a business that uses Avenza will not be able to write to that business through Avenza again, not even if they change their mind. It is a decision with no way back and must be taken in that knowledge.

This notice may change, especially as the points flagged as pending are closed. The version in force is always the one published on this page, with its effective date at the top, and that is where any change will be communicated. Phone notifications are only used to flag customers waiting for a reply, not to announce changes to this document.

If you believe your right to the protection of personal data has been infringed, you may turn to the Secretaría Anticorrupción y Buen Gobierno, the authority provided for in article 2, section XV of the Law.