Privacy notice

AOSYSTEMS SOFTWARE AND ARTIFICIAL INTELLIGENCE, S.A. de C.V., operating under the brand Metixon («Metixon», «we», «us»), is the data controller for the personal data you provide when using the website and platform at metixon.com (the «Service»).

This notice is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its related regulations.

Controller

AOSYSTEMS SOFTWARE AND ARTIFICIAL INTELLIGENCE, S.A. de C.V.

Mexican tax ID (RFC)

ASA260331I27

Address

Urbina 2859, Melchor Ocampo, Ciudad Juárez, Chihuahua, C.P. 32380, México

Responsible department

Personal Data Department

Contact email

privacy@metixon.com

As a Metixon account holder, we process the following categories of data:

• Identity and contact: name, email address, organization name and time zone.
• Authentication: password (we only store an Argon2id hash, never the plain password), two-step verification secret if you enable it, and session metadata (date, IP address and browser of each sign-in).
• Billing: plan, payment history and any tax details you give us. Your card details are collected and stored directly by Stripe; Metixon never receives or stores them.
• Platform usage: projects, settings, member invitations and the technical logs needed to run and protect the Service.
• Support: the content of the messages you email us.

We do not request sensitive personal data. Please do not include it in your messages or in the events you send to the platform.

We use your data for the following purposes, which are necessary to provide the Service:

• Creating and managing your account, your organization and your team's access.
• Authenticating you and protecting your account against unauthorized access.
• Processing the free trial, charges, renewals and overages of your plan.
• Measuring event usage and enforcing your plan's limits.
• Sending operational emails: verification, password recovery, quota alerts, billing and changes to the Service or to this notice.
• Handling support and privacy requests.
• Complying with tax and legal obligations and with requests from competent authorities.

We may also use your contact details to:

• Send you product news, tutorials and Metixon offers.
• Invite you to satisfaction surveys.

These purposes are not necessary for the Service. To opt out, email privacy@metixon.com or use the unsubscribe link included in each of these emails. Opting out does not affect your account or subscription.

When a customer installs the Metixon SDK on their website or app, the SDK sends browsing data about their visitors to collector.metixon.com: page views, events and conversions defined by the customer, referrer URL and campaign (UTM) parameters, browser, operating system, device type, language and a random visitor and session identifier.

For that data, the customer is the controller and Metixon acts as a processor: we process it only to provide the analytics service to the customer, following their instructions, and we do not use it for our own purposes or sell it. If you are a visitor to a website that uses Metixon, please direct your requests to the owner of that website; if they reach us, we will forward them.

To minimize personal information at the source:

• IP addresses are not stored: they are turned into a salted one-way hash and only used to estimate country and city with a geolocation database that runs on our own servers, without querying third parties.
• The SDK does not use cookies; it keeps its identifiers in the visitor's browser local storage.
• Customers can require consent before anything is recorded (requireConsent and optIn()) and honor Do Not Track and Global Privacy Control signals.

The customer is responsible for informing their visitors in their own privacy notice and, where the law requires it, for obtaining their consent.

To run the Service we rely on the following providers, who process data on our behalf as processors, under contract and only for the service listed:

Some of these providers are located outside Mexico, so your data may be stored or processed in the United States or other countries. In every case we require security and confidentiality measures equivalent to those in this notice.

Beyond that, we only share personal data without your consent in the cases allowed by Article 37 of the LFPDPPP, for example when ordered by a competent authority or when needed to perform our contract with you. We do not sell your personal data.

Under Mexican law you have the right to access your data, rectify it if it is inaccurate, cancel it when you believe it is not needed for the purposes in this notice, and object to its processing for specific purposes (ARCO rights).

You can exercise many of these rights yourself from Account: there you can correct your details, download a JSON copy of your information and delete your account. For anything else, send your request to privacy@metixon.com including:

1. Your name and your account email, so we can reply.
2. A government-issued ID, or your representative's ID and proof of representation.
3. A clear description of the data and the right you want to exercise.
4. Any document that helps us locate your data.

We will reply within 20 business days of receiving a complete request and, if it is granted, carry it out within the following 15 business days. These periods may be extended once by the same length when justified, and we will let you know.

You may withdraw your consent at any time using the same procedure as for ARCO rights. We may not always be able to act on it immediately, for example when a law requires us to keep certain data, and withdrawing consent for necessary purposes means we can no longer provide the Service.

Besides unsubscribing from promotional emails, residents of Mexico can sign up for the Public Registry to Avoid Advertising (REPEP) of the Federal Consumer Protection Agency (PROFECO). You can also email privacy@metixon.com to be added to our internal exclusion list.

On metixon.com we only use technical cookies that the Service needs to work:

• Session: keep you securely signed in (HttpOnly).
• Language: remember whether you prefer the site in Spanish or English.

We do not use advertising cookies or third-party tracking cookies. At checkout, Stripe may use its own cookies to prevent fraud, under its privacy policy. You can delete or block cookies in your browser, but without the session cookies you will not be able to sign in.

For the SDK our customers install on their websites, see «Data about visitors to our customers' websites».

• Account data: while your account is active. When you delete it, it is deactivated immediately and its data is erased from active systems; backups are overwritten in their regular cycles.
• Analytics data: for the retention period of the customer's plan (90 days on Starter, 12 months on Pro, 24 on Business and 36 on Enterprise); after that it is deleted automatically.
• When you cancel your subscription: your information remains available for export for at least 30 calendar days.
• Billing: for as long as tax and commercial laws require (in Mexico, at least five years).

We maintain administrative, technical and physical measures to protect your data against damage, loss, alteration, destruction or unauthorized use, including:

• Encryption in transit (HTTPS/TLS) on the website, the API and the collector.
• Passwords stored with Argon2id and optional two-step verification.
• Visitor IP addresses hashed before being stored.
• System access limited to staff who need it, and regular backups.

If a security breach significantly affects your rights, we will inform you without delay so you can take action.

We may update this notice because of legal changes or changes to the Service or our providers. We will post the current version on this page with its update date and, if the change is significant, notify you by email or within the platform before it takes effect.

If you believe your right to personal data protection has been violated, you may contact the competent Mexican authority for personal data held by private parties (currently, the Ministry of Anti-Corruption and Good Governance). We ask that you first email privacy@metixon.com so we can try to resolve it.

This section supplements the notice for residents of California and other states with consumer privacy laws (such as Colorado, Connecticut, Virginia, Utah and Texas), to the extent those laws apply to us.

Categories we have collected in the last 12 months: identifiers (name, email, sign-in IP address), commercial information (plan and payment history), internet activity (platform usage) and limited inferences of approximate location. Sources, purposes, recipients and retention periods are described in the sections above.

We do not sell or share personal information for cross-context behavioral advertising, and have not done so in the last 12 months. We do not use sensitive personal information to infer characteristics about people.

Depending on your state, you have the right to:

• Know what personal information we hold about you and get a portable copy.
• Correct inaccurate information and request its deletion.
• Opt out of sale, targeted advertising or profiling.
• Not be discriminated against for exercising these rights.
• Appeal our decision if we deny your request.

Send your request to privacy@metixon.com. We will verify your identity using your account email and respond within 45 days, extendable once where the law allows. You may use an authorized agent, who must provide proof of your authorization. We honor the Global Privacy Control signal as an opt-out request.

For data about visitors to our customers' websites we act as a service provider or processor; requests about that data should be directed to the customer.

The Service is intended for businesses and professionals who are of legal age. We do not knowingly collect data from anyone under 18 to create accounts. If we find an account opened by a minor, we will delete it.

By creating an account and using the Service, you acknowledge that you have read this notice. For the additional purposes, we understand you consent unless you tell us otherwise. If you have questions, email privacy@metixon.com. See also our Terms and conditions.