COMPREHENSIVE PRIVACY NOTICE — USER APPLICATION

Platicas Profundas · Mexico
Version MX-2026.10.04 · Last updated: October 4, 2026

1. Data Controller and privacy contact

Vestvired MB, S.A. de C.V., with address at Valle del General number 5816, Lomas del Valle II, Postal Code 31216, Chihuahua, Chihuahua, Mexico, is the controller responsible for the processing of personal data relating to the User application and the customer service channels of Platicas Profundas (“Platicas” or the “Controller”).

The person responsible for handling privacy matters and data-subject rights receives requests at admin@platicasprofundas.com. The Notice is available at platicasprofundas.com, in the User privacy section, and through links in the App.

This Notice applies to persons who use the User App, make inquiries, or interact with website features related to that service. Processing related to participation as a Counselor is explained in a separate notice. The commercial offering is directed to Mexico; this does not mean that data is hosted exclusively in the country.

2. Personal data processed

Depending on the features used and the information provided, we process the following categories:

Identification, contact, and profile information. Name, email address, account identifier, profile photograph, date of birth, age, gender, country, state, language, time zone, and the contact information you provide in enabled fields or when requesting support.

Authentication and technical operation. Authentication provider and status, email verification, technical access or notification identifiers and tokens, access sessions, IP address and other connection data available to the services used, device, operating system, App version, language, settings, usage events, errors, and performance. Credentials and verifications are managed through the corresponding authentication systems. If you use third-party sign-in, we receive the data authorized for that connection, not your password for that third party.

Reservations and interactions. Selected Counselor, favorites, availability viewed, date, time, duration and modality, preparatory notes, attendance, connections, rescheduling, cancellations, statuses, incidents, reviews given or received, reports, and communications with support.

Financial information. Amount, currency, identifiers and status of payments, voluntary contributions, refunds, disputes, reconciliation data and receipts; billing information when requested; history and source of Session Credits and refund requests. The processor may communicate descriptive information about the payment method and fraud-prevention signals. Full card numbers and security codes are entered in the processor’s interface, not in the App profile.

Voice, call image, and content. Audio and video transmitted to conduct the Session; when the AI feature is authorized, temporary audio, processing transcript, the User summary, and the derived note for the Counselor. We also process information that you voluntarily include in notes, reviews, surveys, emails, complaints, or incident evidence.

Compliance records. Rights requests, support actions, security incidents, relevant verifications, and evidence of contracting, instructions, and consents obtained through the applicable mechanisms.

Not all of this data is collected in every transaction. You must not send passwords, full card information, or unnecessary intimate information to support or to the Counselor.

3. Sensitive data and legal basis for processing

The conversation, notes, and derived texts may reveal religious, philosophical, or moral beliefs; health; ethnic origin; political opinions; sexual life or sexual preference; or other aspects of the intimate sphere whose improper use could lead to discrimination or serious risk. Although Platicas is not a medical service, this information may constitute sensitive personal data.

Processing is based on the consent that applies or on an exception expressly provided for under Mexican law, such as data necessary to perform a legal relationship, comply with a legal obligation, or protect a person in an emergency, when the applicable circumstances are actually present.

For sensitive data requiring consent, express written consent must be obtained through a mechanism that allows your manifestation of consent to be authenticated, with information about its purpose. Microphone permission, silence, a generic terms checkbox, or the mere act of entering the App does not replace that specific consent.

Financial or patrimonial data requires express consent, unless an applicable legal exception exists. Refusing to provide data that is indispensable may prevent the specific transaction. Rejecting a secondary purpose or the optional AI feature does not require you to accept that processing in order to use other features that can be provided without it.

4. Sources of information

We collect data directly from you when you create an account, use features, converse, or contact support; automatically through the App and the technology services used; and from authentication, communication, or payment providers with respect to the transactions in which they participate.

We may also receive information from the Counselor with whom you interact, from persons who submit an incident report, and from competent authorities. Information obtained from third parties is used only when there is a legal basis and for the applicable purposes. You must not provide sensitive or identifying information about other persons without a legitimate need and sufficient authorization or legal basis.

5. Primary purposes

Necessary data is used to identify and administer the account; authenticate access and recover credentials; verify age of majority and eligibility; display profiles, favorites, and available options; organize reservations and provide audio or video communication; record attendance, changes, and statuses; and administer notes and reviews associated with interactions.

It is also used to process and reconcile payments, contributions, and refunds; issue, apply, restore, or correct Session Credits; handle billing, disputes, and chargebacks; prevent duplication, abuse, and fraud; send operational communications; respond to requests, complaints, and incidents; and enforce conduct and security rules.

Relevant technical data is processed to maintain and diagnose the service, control access, investigate failures, and protect information. We may conduct audits, maintain necessary evidence, comply with obligations, respond to authority requests, and assert or defend rights.

When you request and authorize the AI feature, generation, delivery, and retention of the summary for you and of the note for the Counselor are purposes inherent to that optional feature. They do not constitute authorization for advertising based on the content of the conversation.

6. Secondary purposes and opt-out

Separately from what is necessary to provide the service to you, we may use non-sensitive data to send you our own news and promotions; conduct voluntary surveys; evaluate product experience and preferences; develop non-essential recommendations; and analyze usage to develop and evaluate new features.

You may refuse these uses from the outset or withdraw your authorization by writing to admin@platicasprofundas.com with the subject line “Limit data use,” and stating your account email and the purpose you reject. For promotions, you may also use the unsubscribe mechanism included when applicable. You do not need to explain why you refuse and will not lose access to the main features as a result.

When a communication, technology, or transfer requires express authorization, it will not be carried out merely because you did not submit an objection. Sensitive Session information is not used for these secondary purposes under implied authorization.

7. Temporary audio, summaries, and note for the Counselor

Without the AI feature enabled, audio and video are transmitted for real-time communication; the Platform does not, for that reason, create a recording intended to generate summaries. Communication providers may process the technical data necessary to transport and maintain the call.

With the feature enabled and the required consent, audio is captured, a technical transcript is processed, and two separate texts are generated: the summary associated with your account and the note associated with the Counselor for that Session. The Counselor’s note may include topics and data about you extracted from the conversation. It is not access to the exact file of your summary, but it does involve processing and communicating Session content to the corresponding participant.

Capture may begin when the first participant enters and may include audio within the room during the waiting period. Video is not stored for this feature. Processing may be performed through providers and servers outside Mexico, including in the United States.

The audio is temporary and is deleted through periodic processes when processing is completed or when it is no longer necessary for justified recovery attempts. There may be execution intervals and technical retries: instantaneous deletion and simultaneous deletion of all records that a provider must legitimately retain are not promised. The transcript is used to process the texts; it is not offered as a permanent file to the User.

Disabling the preference prevents future captures that have not begun, but does not delete prior summaries, notes, or processing. The preference control must not be confused with a mechanism for immediately stopping a capture in progress. For a revocation relating to a Session in progress, stop communicating information and use the privacy contact to process it.

There is currently no button to manually delete each individual summary. You may request cancellation or rectification of your data through the procedure in this Notice, without needing to close your entire account. Personal data relating to you that may appear in linked records will also be reviewed, without disregarding the rights of other persons or legally required retention obligations.

8. De-identified analytics and future uses

We may generate statistics and indicators through effective de-identification that prevents a person from being identified through the structure or content of the data and without reasonably available means of association. That information may be used for research, improvement, development, system evaluation, planning, reports, and commercial exploitation of statistical results.

Preparation of de-identified information must respect the legal basis and limits of the original processing; it does not authorize prior reuse of an identifiable recording for an incompatible purpose.

Replacing a name with an identifier, deleting an email address, or grouping a small number of identifiable cases is not sufficient to consider information anonymous. As long as it can be associated with a person, it remains protected as personal data. This Notice does not authorize reidentifying information presented as de-identified in order to circumvent its restrictions.

This Notice does not grant general authorization to sell conversations or identifiable data, train general-purpose models using intimate content, or provide personal profiles to third parties for their advertising. A different future processing activity that requires consent must be described and authorized in advance through the corresponding mechanism. We may develop new features and make use of genuinely de-identified information in accordance with these conditions.

9. Information visible to other persons

The Counselor for your reservation may receive identifying and contextual information available to prepare for and conduct the Session, such as your name, photograph, general profile data, schedule, and preparatory note; the Counselor also knows what you communicate during the call and may receive the Counselor’s AI note. This does not give the Counselor your credentials or full card information.

Reviews and profile elements displayed in interaction features may be visible to their recipients. Profile photographs are served through publicly accessible image addresses; you should not upload an image that needs to remain strictly confidential. This does not mean that the rest of your account, documents, or conversations are public.

When you make a voluntary contribution, the Counselor and Stripe may know the identifiers, amounts, statuses, and other data necessary to receive and administer it. Donor anonymity is not offered vis-à-vis the recipient or the processor.

We do not grant the Counselor permission to sell, publish, commercially reuse, or contact you outside the authorized purpose using your data. If you experience misuse, you may report it.

10. Providers and international infrastructure

To operate, we use providers of hosting and databases, authentication, communication, AI processing, email, notifications, payments, monitoring, and support. The infrastructure includes services such as Supabase, Vercel, Agora, OpenAI, Firebase, and Sentry, in addition to payment processing through Stripe and email delivery services.

When a provider acts on behalf of Platicas, its processing is limited to authorized instructions and purposes and must be subject to the applicable security and confidentiality obligations. A provider may have its own activities governed by its own notice, for example regarding its verifications, fraud prevention, or financial compliance; to that extent, it acts under its own responsibility.

Data may be stored or processed outside Mexico. We may replace providers or locations without changing the authorized purpose and while complying with applicable legal measures and requirements. Use of external infrastructure does not release Platicas from the obligations that apply to it as Controller.

11. Transfers of personal data

In addition to processing carried out by providers on our behalf, there may be communications to other controllers:

Participants and payment processor: data necessary for the selected Session, its authorized notes, and the requested financial transactions, with the legal basis and consent that apply.

Authorities and defense of rights: data relevant to comply with a valid provision or order and for actions necessary for the administration of justice and the recognition, exercise, or defense of rights. Information unrelated to what is required is not provided based on a generic justification.

Companies within the same corporate group: when the legal exception for common control and operation under the same internal processes and policies applies, or when the required authorization has been obtained.

Business continuity: in a merger, acquisition, or transfer, necessary data may be communicated in accordance with the legal basis applicable to the case. Negotiations with investors or potential purchasers do not by themselves constitute a consent exception. Evaluation may be carried out using de-identified information or through other legally permissible mechanisms.

Emergencies: when there is a legal basis to protect a person’s life, integrity, or property. This possibility does not imply call monitoring or a promise to detect emergencies.

The recipient must be informed of the applicable purposes and obligations. For transfers that are not exempt and require consent, a valid manifestation allowing acceptance or rejection of the transfer will be obtained beforehand. This Notice does not treat all future transfers as accepted in bulk.

12. Retention, blocking, and deletion

Data is retained only for the periods necessary for the disclosed purposes and applicable legal obligations. Records that must be retained after their ordinary use ends are blocked or restricted in accordance with law and are subsequently deleted or de-identified.

Audio follows the temporary cycle described in Section 7. Summaries and notes are retained for consultation and continuity of the feature while a current purpose exists, without prejudice to rights requests and reviews of necessity. A perpetual archive of texts is not promised, nor is their retention authorized without a purpose that justifies it.

Records of payments, refunds, credits, outstanding obligations, and contractual acceptance may require different retention. Commercial documents subject to Article 49 of the Commercial Code must be kept for the legal minimum period of ten years; this does not make audio or all intimate Session information documentation that must be retained for ten years.

Incident and legal-defense records are retained according to their necessity, limitation periods, and applicable provisions. For information relating to breach of contractual obligations, the corresponding legal limit of seventy-two months from the breach will be observed. Other documents subject to their own legal retention obligation are analyzed separately.

Requesting account deletion prevents continued use of its features and activates the corresponding closure processing. It does not by itself delete every technical copy, financial transaction, or third-party right. Nor does it legitimize retaining unnecessary data indefinitely. Backup copies and restricted records are handled according to the applicable retention cycle and are not freely reused for ordinary purposes after cancellation.

13. ARCO rights and procedure

You may request Access, Rectification, Cancellation, or Objection by sending an email to admin@platicasprofundas.com. Include your name, a means for receiving the response, elements to establish identity and, when applicable, representation. State the right you wish to exercise and the information that helps locate the data; for rectification, state the correction and supporting documentation. A general access request does not require you to know every stored data item in advance.

Identity verification will be proportionate to the request. Do not send additional sensitive documents until you are told the means and need for verification. The response will be communicated through the means you indicate, with appropriate security measures.

We will communicate the determination within a maximum of 20 business days from receipt of the request, in accordance with law. If granted, it will be made effective within the 15 business days following the communication. Each period may be extended once for an equal period when circumstances justify it and notice is given in accordance with law.

Exercise of these rights is free of charge, except for reproduction or delivery costs permitted by law. A total or partial denial must be based on a legal ground and communicated with its basis. Cancellation may require prior blocking and does not apply to the extent there is a valid legal obligation to retain data; a mere commercial interest in keeping it is not sufficient.

14. Revocation and limitation of uses

You may revoke consent or limit use or disclosure by writing to the privacy contact and identifying your account, the purpose, and the scope of the request. Your identity will be verified when necessary, and the request will be handled using the legally applicable mechanisms and time periods, without imposing requirements that make exercise impossible.

Revocation does not have retroactive effect and does not require interruption of processing that must continue under a different legal basis. If it affects a feature that requires that data, we may cease providing it; refusal of promotional uses does not prevent the main service. No indefinite extension is assumed due to technical difficulties.

15. Security and authorized access

Protection requires administrative, physical, and technical measures proportionate to the data and risks, including access control, authentication, permission management, and incident handling. Authorized personnel and providers may access information to the extent necessary for their functions and subject to confidentiality.

Absolute security does not exist. If a breach significantly affects your property or moral rights, you will be informed immediately in accordance with law, with the information necessary for you to take protective measures. This clarification does not replace the Controller’s prevention and response obligations.

16. Technologies, permissions, and automation

The App uses third-party software components, local storage, and session technologies for authentication, preferences, communication, payments, notifications, and diagnostics. The website may use equivalent technologies depending on the feature consulted. You can manage permissions and storage from your device or browser; blocking elements that are necessary may affect the corresponding feature.

Microphone and camera permissions serve the selected call or capture features; image or file permissions serve the items you choose to provide; and calendar integration serves the operations you request with your calendar. Technical permission does not replace consent to a data-processing purpose. Any future non-essential advertising or tracking technology must be disclosed and made subject to the control or consent required by law before activation.

Automated rules exist for reservation statuses, attendance, credits, notifications, and security controls. A classification may be clarified with support. You may exercise objection when the legal conditions apply to automated decisions that significantly affect your interests or rights. AI-generated texts do not constitute a diagnosis.

17. Minors

The service is not directed to persons under 18 years of age. They must not create accounts or use another person’s account. If we become aware of data relating to a minor, the account will be reviewed, the appropriate use will be restricted, and deletion or strictly necessary retention will be addressed in accordance with law. You may report such cases to the privacy contact.

18. Updates and competent authority

Updates are published with their version and date through Platicas privacy channels. Material changes will be communicated through the appropriate means. A different purpose that requires new consent will not be applied merely by publishing another notice and will not be retroactively legitimized.

You may contact the Secretariat of Anti-Corruption and Good Governance, or the authority that is legally competent, for personal-data protection procedures provided for under applicable law. Contacting Platicas first is not a prerequisite for exercising the rights that the law grants you before an authority.