Privacy policy

This policy explains what personal data we process when you visit atlantics.mx, write to us, start a project or work with us in the project portal, what we use it for, who we share it with and how to exercise your rights. We wrote it from what the system actually does. The Spanish version (Aviso de privacidad) prevails.

1. Who is responsible for your data

Rodrigo Aguirre Cardoso, trading as Atlantics ("Atlantics"), with an address at [to be completed], is responsible for processing your personal data.

For any privacy matter, write to svc@atlantics.mx or call +52 55 2857 9181.

2. What data we process

Only what you give us or what is generated when you use the website and the portal. We do not ask for sensitive data.

• Contact: name, e-mail, company, phone, business category, project type, estimated budget and your message.
• Your project: the idea, who would use it, what you want to achieve, the systems you use today, urgency, budget and the document you attach. If you dictate your idea, the voice is turned into text and the audio is not kept.
• Portal account and access: e-mail, name, date of the last access, IP address and browser of each session.
• Project file: analysis, questionnaire, documents, tasks, conversations with the team, quote, proposal and invoices.
• Meetings: e-mail, title and link of the meeting; if recorded, the audio, its transcript and its summary.
• Payments: e-mail, concept and amount. Your card details are entered on Stripe's own page; Atlantics never sees or stores them.
• Contract and online signature: name, position, company, tax ID and e-mail of the signer and, for each signature, IP, browser, date and the document's fingerprint.
• If you ask to talk to a person: preferred channel, phone and note.
• What you write in the website chat.
• Website measurement: a random browser identifier, the pages and steps you go through and where the visit came from (campaign parameters and ad click identifiers).
• Only if you accept advertising cookies: the identifiers that Google, LinkedIn and Meta store in your browser and, when you send your idea, your e-mail hashed with SHA-256 (it cannot be read) and the ad click identifier, which we send to Meta to know which ad brought it.

3. What we use it for

Purposes needed to handle your request and provide the service:

• Answer your message, create your project and prepare the initial analysis and the technical assessment.
• Give you access to the portal and keep your account secure.
• Send you your project's e-mails: confirmations, reminders, proposals and progress. If you left your details in "Start your project" and did not finish, we write to you once, the next day, to pick it up.
• Schedule and hold meetings, and record them when participants are told.
• Quote, propose, contract, sign online, charge and invoice.
• Build, deliver, warrant and support your project.
• Comply with legal and tax obligations and keep the evidence of the contract.

Additional purposes

Unless you object, we also use your data to:

• Measure where interested people come from and improve the website and the portal.
• Only if you accept advertising cookies: measure the results of our ads on Google, LinkedIn and Meta (Facebook and Instagram) and show Atlantics ads to people who already visited the website.
• Occasionally send you content or news from Atlantics related to your industry.

You can object to these purposes at any time by writing to svc@atlantics.mx; it does not change the service you receive. We only publish your project as a case study, even without your name, if you authorize it in the contract.

4. Use of artificial intelligence

Artificial intelligence is part of our service: it helps us organize your idea, prepare the analysis and the assessment, transcribe dictation and meetings, and draft documents. A person on the team reviews everything before you see it as a result.

Today we use OpenAI (United States) and Anthropic (United States), which process the information on behalf of Atlantics: we ask them not to store the responses and, under their business terms, they do not use them to train their models. From the initial form we do not send it your name or your e-mail.

We do not send prospect or client data to AI providers with servers in China.

If your company requires that the information not leave our infrastructure, we agree on it at the start: your project is marked as a "closed client" and AI only runs on Atlantics' own servers or is not used.

5. Who we share your data with

We do not sell or rent your data. We only share it with the providers that help us deliver the service, which process it on behalf of Atlantics and under its instructions:

• Hetzner: servers for the website, the portal and the database (Nuremberg, Germany) and encrypted backups in Finland.
• OpenAI (United States): analysis, drafting and transcription with AI.
• Anthropic (United States): analysis and drafting with AI, and the coding agents that work on your project's code.
• Stripe (United States): card payments.
• Google and Microsoft (United States): Meet or Teams meetings and calendar invitations, when used.
• Meta (WhatsApp): only if you write to us on WhatsApp.
• Google (United States): Google Tag Manager and Google Ads measurement, only if you accept advertising cookies.
• LinkedIn (United States and Ireland): its ad measurement tag, only if you accept advertising cookies.
• Meta (United States and Ireland): its pixel and the conversion we send it from our server, only if you accept advertising cookies.
• Epic Agents: the website chat, an AI agent platform run by the same team, which uses its own AI providers to answer.

E-mail is sent from Atlantics' own servers. Beyond these cases, we would only hand data to an authority that requires it under the law.

6. Cookies and measurement

We use a technical cookie to keep your portal session (up to 7 days) and your browser's storage to keep a random identifier and where your visit came from (90 days). We use it to measure the website ourselves; it is not shared.

Advertising cookies, only if you accept them in the website's cookie notice: we use Google Tag Manager to load the Google Ads conversion tag, the LinkedIn Insight Tag and the Meta pixel. They tell us which ad brought someone who sends an idea and let us show Atlantics ads to people who already visited the website. Google, LinkedIn and Meta also process that data under their own privacy policies.

If you do not accept, none of those tags load and nothing is sent to those platforms, not even from our server. You can change your choice at any time in «Cookie preferences» at the bottom of the website. These tags never load inside the project portal.

You can delete cookies and site data from your browser settings.

7. Meeting recordings

We only record a meeting after telling the participants at the start. The audio is kept for 24 months and then deleted; the transcript and the summary stay in the project file. If you prefer it not to be recorded, tell us and it will not be.

8. How long we keep it

While the relationship lasts and, afterwards, as long as needed to meet legal, tax and commercial obligations or defend our rights. Periods we already apply:

• Meeting audio: 24 months.
• Portal access log: 180 days.
• Backups: 30 days.
• Contract signature evidence and invoices: as long as the law requires to prove the contract and the payments.

9. How we protect it

Encrypted connection on the website and the portal, portal access only through one-time links sent to your e-mail, password and authenticator app code for the team, an access log, encrypted backups and servers managed by Atlantics.

10. Your rights

You can access, rectify, cancel or object to the use of your data (ARCO rights), revoke your consent and limit its use or disclosure. Write to svc@atlantics.mx with:

• Your name and an e-mail or other way to reply to you.
• A copy of an ID or something that proves you are the data subject (or their representative).
• Which data and which right you want to exercise.

We answer within 20 business days at most and, if it applies, carry it out within the following 15 business days. We can also give you a full copy of your project file. If you consider we did not address your request, you can go to the competent personal data protection authority.

11. Changes to this policy

We will publish any change on this page with its date. If the purposes or providers change in a relevant way, we will ask you to accept it again in the portal; we keep which version you accepted and when.