Legal document · Version 2.0

Privacy Policy

Privacy Notice · Effective from: July 7, 2026 · Suplifai

In short (this does not replace the full text)

1. Data Controller

Suplifai ("the Controller"), domiciled for the purposes of this Notice in Mexico City, Mexico, is responsible for processing your personal data in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) in force and other applicable regulations.

Channel to handle requests, exercise your rights, and receive notices: legal@suplifai.com

2. Personal Data We Collect

We collect the following data, depending on the context of the relationship:

Contact and business data (Clients):

  • Full name, email address, phone number.
  • Company name and line of business, tax ID (RFC).
  • Role and area within the organization.

Technical and usage data:

  • IP address and device data when accessing the backoffice.
  • Activity logs within the platform.
  • Timestamp and version of acceptance of the Terms & Conditions.

Data processed on behalf of the Client (AI end customers):

  • WhatsApp, Instagram, or Web conversations initiated by the Client's end customers.
  • Inventory and pricing information from the Client's system.

With respect to this data, the Client is the Controller and Suplifai acts as Processor, handling it solely under the Client's instructions. For details, see our Data Processing Agreement (DPA).

We do not collect sensitive personal data. Please do not share through these channels any data that is not necessary for support (for example, health or financial data).

3. Purposes of Processing

Primary purposes (necessary for the service):

  • Create and manage your account on the platform.
  • Provide and operate the contracted Digital Collaborators.
  • Billing and compliance with contractual obligations.
  • Technical support and incident handling.

Secondary purposes (you may object without affecting the service):

  • Communications about new Suplifai features or products.
  • Invitations to events, webinars, or referral programs.

To object to secondary purposes, write to legal@suplifai.com stating "Opt-out communications".

4. Data Transfers and Remittances

Suplifai does not sell personal data. To provide the service, we remit or transfer data, to the extent necessary, to the following categories of third parties:

  • Meta Platforms, Inc. — Operation of WhatsApp Business API and Instagram, when the Client uses those channels.
  • Cloud infrastructure providers — Storage and processing, under confidentiality and security obligations.
  • Language and AI processing providers — Generation of the Digital Collaborators' responses, under agreements that limit the use of the data to service delivery.
  • Competent authorities — Only where required by law or an authority's order.

These providers act as Processors and handle the data solely in accordance with our instructions. Details of international transfers are described in the DPA.

5. Your Rights (ARCO) and Revocation

You have the right to Access, Rectify, Cancel, or Object to the processing of your personal data (ARCO rights), as well as to revoke the consent you have granted us.

To exercise them, send a request to legal@suplifai.com with:

  • Full name and the email through which you relate to us.
  • A clear description of the right you wish to exercise.
  • A document proving your identity (or representation, where applicable).

We will respond to your request within a maximum of 20 business days and, if it is well-founded, make it effective within the following 15 business days, in accordance with the LFPDPPP in force.

6. Automated Decisions and Artificial Intelligence

Suplifai's Digital Collaborators are based on Artificial Intelligence and may generate responses, quotes, and follow-ups automatically.

In accordance with the LFPDPPP in force, you have the right to object to decisions that significantly affect you and are based solely on automated processing (including profiling), as well as to request the intervention of a person.

Our flows are designed to escalate to a human agent when the AI cannot resolve with certainty. To exercise this right or request human review, write to legal@suplifai.com.

7. Cookies and Tracking Technologies

Our website uses cookies for the following purposes:

  • Essential: Necessary for the site to function. They cannot be disabled.
  • Analytics: Allow us to measure traffic and improve the experience (Google Analytics or equivalent). They require your consent.
  • Marketing: To show relevant ads on other platforms. They require your consent.

You can manage your preferences from the consent banner or your browser settings.

8. Data Retention

We retain your personal data for the duration of the relationship and for an additional period of 5 years to comply with tax and legal obligations. End-customer conversation data is deleted or anonymized within 90 days after termination of the contract, unless the law requires longer retention.

9. Security

We implement technical and organizational measures to protect your data, including: encryption in transit (TLS 1.2+), encryption at rest, role-based access control (RBAC), audit logging, least privilege, and periodic security reviews.

10. Authority and Complaints

If you believe your right to the protection of personal data has been infringed, you have the right to file a complaint with the competent authority for the protection of personal data in Mexico.

11. Changes to this Notice

Suplifai may update this Privacy Notice. We will notify material changes by email at least 15 days in advance. The current version will always be available on this page, with its update date.

12. Contact

For any question related to the processing of your data:

📧 legal@suplifai.com

Response time: maximum 5 business days.