Privacy Notice

1.1. [DATO PENDIENTE: nombreLegal] ("Project Dolphin", "we", "us"), with tax ID [DATO PENDIENTE: rfc] and address at [DATO PENDIENTE: domicilio], Mexico, is the controller of your personal data.

1.2. For any matter related to your personal data, you may contact our privacy officer at [DATO PENDIENTE: correo].

2.1. Identification and contact data: name, email address and profile photo shared by Google when you create an Account. We do not request a phone number or password.

2.2. Account data: Google identifier (sub), creation date and, if you upload one, your own profile photo.

2.3. User Content: photos, text, fonts and settings you upload or enter in the Editor, associated with a design and a token.

2.4. Cart, order and billing data: selected Templates, amounts, currency, payment status, Mercado Pago order identifier, date and, where applicable, the cardholder name captured by the Brick and sent to Mercado Pago for the order; we do not store it in our database. If you request an invoice, we also collect your tax ID, tax regime and CFDI use. The PDF may include your email or the Order/design token in its metadata; if you share the PDF, the identifier travels with it and we cannot delete copies already downloaded.

2.5. Technical data: IP address, browser and device type, pages visited, cookies and security logs. Webhook logs contain the order identifier and status, not card data.

2.6. Analytics and advertising data: in this version we do not use Google Analytics, GTM or advertising cookies. When they are enabled, we will ask for consent in a banner and update this Notice.

2.7. We do not collect sensitive personal data. Do not include sensitive data in your designs without the consent of the people involved; if you do, you are responsible for having that consent. We do not store card numbers, security codes or expiration dates; those data are processed directly by Mercado Pago.

2.8. Review data: if you publish a review, we process your rating, comment, name, profile photo (your own or Google's) and the photos you attach, along with the date and the accepted version of the Terms. Your name, avatar, comment and photos are public on the product page; your email is not published.

3.1. Primary purposes (necessary for the service):

1. Create and manage your Account.
2. Save and reopen your designs, photos, text and fonts.
3. Manage the cart and create Orders.
4. Process payments and verify their status with Mercado Pago.
5. Enable PDF downloads and purchase history.
6. Publish and moderate reviews, including their name, avatar and photos.
7. Handle questions, claims, infringement reports and support requests.
8. Prevent fraud, abuse and attacks, and comply with legal obligations.
9. Issue invoices and comply with tax obligations.
10. Send download links to Accounts, when email is enabled.

3.2. Secondary purposes (not necessary for the service):

There are no active secondary purposes in this version. When analytics or advertising are enabled, we will ask for consent and update this Notice. We do not send marketing communications without consent.

3.3. You may object to secondary purposes by writing to [DATO PENDIENTE: correo]. Objection does not affect primary purposes.

4.1. By using the Site and providing your data, you accept this Notice. For secondary purposes, we will request your consent where required by law.

4.2. We do not use your data for automated decisions that produce significant legal effects.

5.1. We do not sell your personal data.

5.2. We share data with providers that help us operate the Site:

1. Google (login; analytics only when enabled).
2. Mercado Pago (payment processing and fraud prevention).
3. Cloudflare (file storage in R2).
4. Railway (application and database hosting).
5. YouTube/Google (embedded videos, only when played).

When analytics, advertising or email delivery are enabled, their providers will be added to this list and consent will be requested where applicable.

5.3. Some providers are outside Mexico. By using the Site, you accept these transfers necessary for the service. You may object to transfers that are not necessary; some features may become unavailable.

5.4. Providers process data under their own policies and, where applicable, as processors on behalf of Project Dolphin.

6.1. We retain your data while you have an Account and until you request deletion of your Account or designs. On deletion: we verify your identity, mark your Orders as guest access, send you their links, anonymize your Account and retain Orders and tax receipts; we do not delete designs referenced by Orders.

6.2. We retain Order and receipt data for up to 5 years to comply with tax, accounting and consumer obligations, or for the period required by law.

6.3. Session cookies last 14 days; guest cart and order cookies last 30 days. You can delete them earlier in your browser.

6.4. Design, photo and font files may remain in R2 while versions or Orders reference them, even if you remove them from your current design, so that purchased downloads continue to work.

6.5. Security and webhook logs are retained for the time necessary to prevent fraud and comply with legal obligations.

6.6. Reviews and their photos are retained while they are published. If you delete your review, the row and photos are deleted, except for temporary copies in caches or backups that are deleted according to our retention periods. If you delete your Account, your reviews are deleted in cascade.

7.1. You have the right to access, rectify, cancel and object to the processing of your data, and to withdraw your consent.

7.2. To exercise these rights, write to [DATO PENDIENTE: correo] with your name, email, a clear description of your request and, if necessary, documentation proving your identity. We will respond within a maximum of 20 business days, extendable once in accordance with the law.

7.3. If you are not satisfied with our response, you may contact the National Institute for Transparency, Access to Information and Personal Data Protection (INAI).

8.1. We apply reasonable technical and organizational measures: HTTPS/TLS, signed session cookies, HttpOnly, SameSite=Lax and Secure in production, access control for the database and R2, secrets outside the code and file validation.

8.2. We do not store card data. Payment data is captured and processed in Mercado Pago's environment.

8.3. No system is 100% secure. If we detect an incident affecting your rights, we will notify you as required by law.

9.1. In this version we use our own necessary cookies for the Site to function and technical cookies from Google (login), Mercado Pago (payment) and YouTube (only when you play a video). We do not use analytics or advertising cookies. When they are enabled, we will ask for consent in a banner and update this Notice.

9.2. You can accept, block or delete cookies in your browser settings. If you block necessary cookies, login, guest cart and guest orders may stop working.

9.3. When analytics are enabled, you can install the Google Analytics opt-out add-on or use Google's consent mode.

Cookie table

GA4, GTM and advertising cookies are not used in this version. They will be added to this table when the consent banner is implemented.

9.4. Links to third-party sites (Google, Mercado Pago, YouTube) are governed by their own policies. We do not control their cookies.

10.1. The Site is not directed to minors under 18. We do not knowingly collect data from minors. If you are a minor, use the Site only with the authorization and supervision of your parent or guardian.

10.2. If we detect a minor's data without authorization, we will delete it. If you are a guardian and believe a minor provided us with data, write to [DATO PENDIENTE: correo].

11.1. We may modify this Notice due to legal, technical or business changes. We will publish the new version with its effective date and, if the change is material, notify you by email or through a prominent notice.

11.2. Continued use of the Site after the effective date means you accept the new version.

12.1. Privacy officer: [DATO PENDIENTE: correo].

12.2. Address: [DATO PENDIENTE: domicilio]. Hours: [DATO PENDIENTE: horario].