Plazela
Back to home

Privacy Notice

This Privacy Notice describes how Plazela processes your personal data, in compliance with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).

Data controller:
Plazela
Domicile:
Mazatlán, Sinaloa, México
Contact:
legal@plazela.com
On this page
  1. 1. Data controller
  2. 2. Personal data we process
  3. 3. Purposes of processing
  4. 4. Processors and transfers
  5. 5. ARCO rights and withdrawal of consent
  6. 6. Cookies and storage technologies
  7. 7. Analytics on published sites
  8. 8. Data retention
  9. 9. International users
  10. 10. Minors
  11. 11. Changes to this Notice
  12. 12. Effective date

1. Data controller

The controller responsible for processing your personal data is the party identified, with the domicile and contact email, shown in the header of this document.

For any matter related to your personal data, you may write to the contact email shown above.

2. Personal data we process

We do not collect sensitive personal data.

Account data: email address, name, avatar, and sign-in provider (Google, email/password, or OTP).

Security data: IP address, user agent, approximate country, and session and audit logs.

Business data: the information you provide or import to generate your site — address, phone numbers, hours, photos, and public Google reviews (including the reviewer's name).

Billing data: Mexican tax ID (RFC), legal business name, tax regime, postal code, and CFDI usage code, plus your subscription identifiers. Your payment card data is received and processed directly by Stripe — we never receive or store it.

Waitlist data: email address and country, when you sign up for our waitlist.

The content and prompts processed by AI providers to generate your site.

3. Purposes of processing

Primary purposes (necessary for the Service): managing your account, generating and publishing your site, processing payments and issuing your CFDI, preventing fraud and protecting platform security, providing support, and complying with legal obligations.

Secondary purposes (you may opt out without affecting the Service): sending you product communications, and contacting you if you signed up for our waitlist.

To opt out of secondary purposes, write to us at the contact email shown above.

4. Processors and transfers

We share your personal data with the following processors, who act on the controller's behalf under contractual obligations equivalent to this Notice:

Stripe, Inc. (United States) — payment processing.

Facturapi (Mexico) — issuance of Mexican digital tax invoices (CFDI).

Cloudflare, Inc. (United States) — infrastructure, content delivery network (CDN), and aggregate metrics.

Google LLC (United States) — authentication (OAuth), Google Places import, and AI processing where applicable.

Anthropic PBC and OpenAI, L.L.C. (United States) — AI processing of your business content to generate your site.

We do not sell your personal data to third parties.

Under Mexican law, you have the right to Access, Rectify, and Cancel your personal data, and to Object to its processing (ARCO rights), and to withdraw any consent you may have given.

To exercise these rights, send your request to the contact email shown above, verifying your identity. We will respond within a maximum of 20 business days (per Mexican law).

While your request is pending, you may ask us to limit the use or disclosure of your data.

The competent authority for data protection matters in Mexico is the Secretaría Anticorrupción y Buen Gobierno.

6. Cookies and storage technologies

We use only essential cookies — session and CSRF (cross-site request forgery) protection cookies, set as HttpOnly — and browser local storage to save drafts in the site-creation wizard.

We do not use advertising or third-party analytics cookies. For that reason, we do not show a cookie-consent banner: we only use what is strictly necessary to operate the Service.

7. Analytics on published sites

For each published site, we generate our own aggregate metrics (for example, QR code scans and clicks on contact information), without storing the visitor's IP address.

The owner of each published site is solely responsible for any data they collect from their own visitors, per the “Published sites and their visitors” section of our Terms and Conditions.

8. Data retention

We retain your personal data while your account remains active.

After your account is closed, we retain data for the periods required by law — for example, tax obligations (approximately 5 years) and security logs — and then block and delete it.

9. International users

European Union: if you sign up for our waitlist from the European Union, we process your email and country based on your consent. You have rights analogous to those under the General Data Protection Regulation (GDPR), exercisable through the same channel as ARCO rights. We do not currently offer the paid Service in the European Union.

California: we do not sell or share your personal data as defined under the California Consumer Privacy Act (CCPA). You have analogous rights, exercisable through the same channel.

10. Minors

The Service is not directed at individuals under 18, and we do not knowingly collect personal data from minors.

11. Changes to this Notice

We will publish any changes to this Notice on this page, indicating the last-updated date. Material changes will be notified through the contact channels we have on file for you.

12. Effective date

This Notice is effective as of the date shown in the header of this document.