Privacy Notice

In compliance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and the Privacy Notice Guidelines.

1. Who is responsible for your personal data

Miguel Zúñiga Rodríguez, an individual with business activity (hereinafter «poléo», «we»), with address in Mexico City, C.P. 02800, is responsible for processing your personal data.

For any privacy matter, contact us at soporte@poleo.app.

2. What personal data we collect

We collect the data you provide when you register and use the system:

• Identification and contact: name, email, phone (if you provide it), and your business name.
• Account: password (stored encrypted; we never see it in plain text), role, and the stores and users you create.
• Billing and payment: the tax details you enter (RFC, legal name) and your subscription payment history. Your card details are processed directly by Stripe; poléo never stores them or has access to them.
• Usage: technical session information (access date, in-system activity) to operate the service and provide support.

Sensitive data: poléo does not collect sensitive personal data.

3. How we use your data (purposes)

Primary purposes (necessary to provide the service)

• Create and manage your account and your business within the system.
• Operate the point of sale, inventory, reports, and other features you subscribe to.
• Process your subscription charges and issue receipts.
• Provide technical support.
• Send you service communications (email verification, billing notices, important changes).

Secondary purposes (not necessary; you may opt out without affecting your service)

• Send you information about new features, improvements, or poléo promotions.

If you don't want us to use your data for secondary purposes, email soporte@poleo.app and we'll stop.

4. Your customers' data (you as controller)

poléo is a tool for your business. The data you capture about your own customers (for example, in credit or wholesale sales) is yours: you are the controller of that data toward your customers, and poléo acts solely as a processor, handling it on your behalf and following your instructions, without using it for its own purposes.

5. Who we share data with (processors and transfers)

To operate, poléo relies on technology providers that process data on our behalf (processors), under confidentiality and security obligations:

• Supabase / Amazon Web Services — database and application hosting.
• Stripe — subscription payment processing.
• Resend / Amazon SES — system email delivery.
• Cloudflare — security (anti-bot verification at signup).
• Vercel — website and application hosting.
• Facturama — invoice (CFDI) issuance, when you enable that feature.

We do not sell or rent your personal data. We do not make transfers requiring your consent, except those required by a competent authority under the law.

6. Access by our support team

To help you resolve issues, our support team may access your business data within the system, in read-only mode. Each access is logged and we notify you inside the application when it happens. Our staff is bound by confidentiality and only enters when necessary to support you.

7. Cookies and similar technologies

We use browser local storage to keep your session signed in and remember preferences (for example, your language). The signup security feature (Cloudflare Turnstile) may use cookies to distinguish humans from bots. We do not use third-party advertising cookies.

8. Your ARCO rights

You have the right to Access your data, Rectify it if inaccurate, Cancel it when you believe it is no longer needed, and Object to its processing (ARCO rights). You may also withdraw your consent.

To exercise them, send your request to soporte@poleo.app including: your name, the email you registered with, and which right you wish to exercise. We will respond within a maximum of 20 business days. Exercising these rights is free.

9. How to limit the use of your data

You can request that we limit the use or disclosure of your data by writing to soporte@poleo.app. If you close your account, we keep your data for a retention period of 30 days (in case you wish to reactivate) and then delete it, except what the law requires us to keep (for example, tax receipts).

10. Changes to this Notice

We may update this Privacy Notice. We will publish the current version at poleo.app/en/privacy with its update date; if the change is significant, we will notify you by email or within the application.

11. Consent

By registering and using poléo, you acknowledge that you have read this Privacy Notice and grant your consent to the processing of your data as described herein.