Privacy notice.

01Identity and address of the data controller

[Legal name], operating under the trade name Monarca Lab AI (hereinafter, "Monarca Lab AI" or "we"), with its address at [street, number, neighborhood, municipality, ZIP code, state], Mexico, is responsible for processing your personal data under the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and other applicable regulations.

For any matter related to this notice or your personal data, you can write to [privacidad@dominio], our privacy contact.

02Personal data we collect

We collect personal data directly, when you provide it to us, and automatically, when you browse the site.

We do not request sensitive personal data (health, ethnic origin, beliefs, sexual orientation, biometric data, among others) or financial data through the site. Please do not include them in the message field. If a project requires processing them, it will be governed by contract and with the express consent required by law.

If you share data about third parties with us (for example, colleagues), you declare that you have their consent and have informed them of this notice.

03Purposes of processing

Primary purposes (necessary to handle your request or the contractual relationship):

1. Answering your message and following up with you.
2. Scheduling the first call and understanding your challenge, the information you have and your timelines.
3. Preparing and sending you proposals for models, agents, solutions, custom software, prototypes or missions.
4. Entering into, performing and managing the contract, including access to Model as a Service and our APIs.
5. Invoicing, collecting payments and meeting tax and legal obligations.
6. Keeping the site and the platform secure and running.

Secondary purposes (not necessary to serve you):

1. Sending you information about new services, events or content from Monarca Lab AI.
2. Producing internal statistics on site usage and interest in our services.
3. Asking for your opinion about our services.

If you do not want us to process your data for secondary purposes, write to [privacidad@dominio] with the subject "Secondary purposes". Your refusal will not affect how we handle your request or the services you contract. We will not use your data for purposes other than those described here without obtaining your consent.

04Data processed in our artificial intelligence services

When a client engages us, we process the personal data contained in their information as processors, on behalf of and under the instructions of the client, who remains the data controller. This applies to:

• Enterprise RAG and model adaptation: documents and knowledge bases the client connects to the models.
• Agents, multi-agent orchestration and copilots: data the agents process when performing tasks in the client's systems.
• Document Intelligence and automation: data extracted from invoices, contracts and other documents.
• APIs and integrations: data flowing between the platform and the client's systems (ERP, CRM, among others).

In these cases we commit to:

• Processing the data only to provide the contracted service.
• Not using the client's information to train general-purpose models or for the benefit of third parties, unless expressly authorized in writing.
• Applying the security measures in section 8 and those agreed in the contract.
• Returning or deleting the data when the service ends, as agreed.
• Using model and infrastructure providers only under contract and with equivalent confidentiality obligations.

Specific terms are set out in each project's contract or data processing agreement.

05Transfers and processors

We do not sell, rent or trade your personal data.

To operate, we share data with processors that handle it on our behalf under confidentiality agreements: web and cloud hosting, email, customer relationship management (CRM), billing and artificial intelligence model providers. Some may be located outside Mexico, for example in the United States; in that case we require protections equivalent to those in this notice.

We only transfer data without requiring your consent in the cases permitted by law, including:

• To competent authorities, when required by law or by a duly founded and reasoned order.
• To affiliated companies within the same group operating under the same policies, where applicable.
• When necessary to enter into or perform a contract with you.
• To recognize, exercise or defend a right in legal proceedings.

Any other transfer will require your prior consent.

06ARCO rights, withdrawal of consent and limitation of use

You have the right to Access your data, Rectify it if it is inaccurate, Cancel it when it is no longer necessary and Object to its processing for specific purposes. You can also withdraw your consent or limit the use of your data.

Send your request to [privacidad@dominio] including:

1. Your name and an email address for our reply.
2. A copy of an official ID or, if a representative is acting for you, the document proving that representation.
3. A clear description of the right you are exercising and the data involved.
4. Any document that helps locate your data; for rectification, the correct data and supporting evidence.

We will respond within 20 business days of receiving your complete request. If applicable, we will carry it out within the following 15 business days. The process is free of charge; only shipping or reproduction costs may apply.

To stop receiving marketing communications, simply reply to the email asking us to or use the unsubscribe link.

If you believe your right to data protection has been violated, you can contact the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), the competent authority in Mexico.

07Cookies and similar technologies

We use a functional cookie to remember the language you choose (Spanish or English). We do not use it to identify you, build profiles or show advertising.

[If web analytics is used: We also use [tool name] to obtain anonymous or aggregated browsing statistics, such as pages visited and time on site.]

You can delete or block cookies in your browser settings. If you do, the site may not remember your language.

Our site includes links to third-party sites, such as our LinkedIn profile. Those sites have their own privacy notices, for which we are not responsible.

08Security, retention and changes to this notice

Security. We apply administrative, technical and physical measures to protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing, including encryption in transit, role-based access control and activity logging. If a breach occurs that significantly affects your rights, we will inform you without delay.

Retention. We keep prospects' contact data for up to [24 months] from the last interaction, and clients' data for the duration of the contractual relationship and the period required by tax and commercial laws. After that, we block and securely delete it.

Changes to this notice. We may modify this notice due to legal changes, changes in our services or in our practices. We will publish the current version on this same page with its update date and, if the change is significant, we will let you know by email if we have your email address.

Consent. By sending us your data through the form, you acknowledge that you have read this notice. For sensitive, financial or asset-related data we will ask for your express consent.