COMPREHENSIVE PRIVACY NOTICE — COUNSELOR APPLICATION

Platicas Profundas Counselors · Mexico
Version MX-2026.10.04 · Last updated: October 4, 2026

1. Data Controller and scope

Vestvired MB, S.A. de C.V., with address at Valle del General number 5816, Lomas del Valle II, Postal Code 31216, Chihuahua, Chihuahua, Mexico, is the controller responsible for processing the personal data of persons who apply for or maintain a Counselor account on Platicas Profundas, as well as communications related to that participation (“Platicas” or the “Controller”).

The person responsible for privacy handles requests at admin@platicasprofundas.com. This Notice is available at platicasprofundas.com, in the Counselor privacy section, and through links in the App. The offering is directed to Mexico, although data may be processed in other countries.

If you also use a User account, that processing is governed by the corresponding notice. This document does not replace the privacy obligations that apply to you regarding information about other persons that you access as a Counselor.

2. Categories of data

Identification, contact, and account. Name, email address, photograph, account identifier, date of birth, age, gender, language, country, state, time zone, and the contact information you provide, such as telephone number, address, or emergency contact when included in an enabled channel.

Participation application and profile. Biography, accompaniment topics, languages, experience, stated training, degrees, certifications, documents and files provided, identification when necessary for verification, review statuses and results, clarification requests, observations, approvals, rejections, and change history.

Activity. Availability, reservations, dates, duration and modality, attendance, connections, changes, cancellations, no-shows, notes, ratings and reviews given or received, reports, flags, operational measures, and communications with support.

Contributions and financial connection. Connected Stripe account identifier, connection data, verification and enablement status, pending requirements communicated by the provider, transaction identifiers, amount, currency, fees, reported net amount, refunds, disputes, and transaction statuses. Bank information and verifications required by Stripe are provided through its flows; Platicas processes the data communicated by the provider that is necessary to enable and administer the feature, not your bank password.

Technical data. Authentication methods and statuses, verification, technical access or notification identifiers and tokens, IP address and other available connection data, device, operating system, App version, language, permissions, usage events, errors, and performance.

Communication content. Voice and image transmitted in the Session; temporary audio and technical transcript when the AI feature is authorized; the note intended for your account and references to your contributions in the User’s summary. Content you provide in emails, requests, voluntary responses, and incident evidence may also be processed.

Compliance. Legitimate evidence of acceptance, authorizations, verifications, actions, and rights requests. The existence of a category does not mean that all data within it is mandatory or collected in every case.

3. Sensitive data and identity documents

Your biography, documents provided, and conversations may reveal religious, philosophical, or moral beliefs; health; ethnic origin; political opinions; sexual life or sexual preference; or other intimate data that may give rise to discrimination or serious risk. Identity documents may contain a photograph, signature, or other elements requiring special protection. You must not send sensitive information that is unnecessary for the requested purpose.

When processing sensitive data requires consent, it will be obtained expressly and in writing through a signature or a mechanism that allows the manifestation to be authenticated. General acceptance of Terms or a technical device permission does not by itself constitute sufficient authorization for any sensitive data or recording.

If you choose to include sensitive information in a profile intended to be shown to Users, its publication must be specifically disclosed and authorized. Providing a verification document does not authorize its publication as promotional material.

A Counselor’s consent regarding the Counselor’s own data does not replace the User’s consent or authorize additional uses of information about other persons. Financial or patrimonial data is processed with express consent unless an applicable legal exception exists.

4. Sources and legal bases

Data is obtained directly from you when you apply to participate, complete your profile, provide documents, use the App, or communicate with us; from the technology services involved; from Stripe with respect to the contribution feature; and from Users with whom you interact through reviews, reports, and other relevant information.

We may verify relevant statements using lawful sources and receive information from authorities within the scope of their powers. Authorization is not presumed to investigate your private life indiscriminately or to collect background information unrelated to the purpose of verification.

Processing is carried out with the applicable consent or when a specific legal exception applies, such as fulfillment of rights and obligations under a legal relationship, a legal provision, or an emergency in the circumstances provided by law.

5. Primary purposes

We process information necessary to receive and evaluate applications, verify identity and requirements, administer approvals and clarifications, create and protect accounts, recover access, maintain profiles, and show Users the elements intended for selection and reservation.

We also process it to administer availability and commitments; facilitate Sessions; record attendance, changes, and statuses; manage notes, reviews, reports, and flags; handle support and requests; apply safety and participation rules; and send operational communications about documents, reservations, incidents, and applicable changes.

With respect to voluntary contributions, we process data to connect the account, communicate statuses, show transactions, reconcile operations, and handle refunds, disputes, or fraud prevention. We may use relevant data for tax or regulatory obligations that legally apply to Platicas, auditing, responses to authorities, recognition or defense of rights, and retention of necessary evidence.

Technical data is used to operate, diagnose, and protect infrastructure, prevent improper access, and resolve failures. When the AI feature is authorized, processing the audio and delivering the texts to each participant is a purpose inherent to that feature. It is not authorization to routinely listen to all conversations or use them as general performance monitoring.

Failure to provide indispensable information may prevent review of an application or provision of a specific feature. This does not make promotional or secondary purposes a condition of participation.

6. Secondary purposes and opt-out options

We may use non-sensitive data for communications about news and voluntary participation opportunities; surveys and experience studies; non-essential recommendations; and usage analysis to evaluate features and improve the product beyond necessary technical maintenance.

You may refuse from the outset or withdraw your authorization by writing to admin@platicasprofundas.com, with the subject line “Limit data use,” your account email, and the purpose you reject. Refusal does not by itself affect admission or continued access to the main features. For promotions, you may also use the unsubscribe mechanisms applicable to the communication.

Use of your image, testimonial, or identifiable information for an external campaign requiring authorization is not considered accepted merely because you create a profile. Processing sensitive information for secondary purposes requires the specific information and consent that are legally required.

7. Visible profile, reviews, and recipients

Your name, photograph, biography, languages, accompaniment topics, experience, authorized descriptive credentials, general information, ratings, and availability may be shown to persons using the exploration and reservation features. Other persons’ reviews may be associated with your profile and the corresponding interactions.

Profile images are served through publicly accessible image addresses. Do not include documents, financial data, or information that needs to remain strictly confidential in them. Documents provided for review do not, for that reason alone, become part of your visible profile.

The User in a Session knows your identity and what you communicate during the call and may receive an AI summary that reflects your contributions. If the User receives or carries out an authorized transaction, the User may know the contact or identification data shown by the flow for that transaction. This does not provide general access to your account, credentials, or banking information.

Authorized personnel may process applications, documentation, and operational records for the disclosed purposes. The existence of administrative functions does not mean that every team member has access to all information or that all documents are reviewed in every case.

8. Temporary recording and AI-generated texts

If the feature is not enabled, audio or video is transmitted to conduct the Session without, for that reason, creating a recording intended to generate summaries. Providers may process technical data necessary to maintain the communication.

With activation by the User and the necessary consents of the participants, audio is captured, a technical transcript is processed, and a summary for the User and a separate note for the Counselor are generated. Both may contain references to your voice, statements, and data disclosed in the conversation. Your note is not the exact file of the User’s private summary.

Capture may begin when the first participant connects, including the waiting interval inside the room. Video is not stored for this feature. Processing may use specialized infrastructure and providers located outside Mexico, including in the United States.

Audio is deleted through periodic processes after processing or when it is no longer necessary for justified retries. It is not instantaneous deletion when a text is displayed and is not a guarantee of simultaneous deletion of every legitimate provider record. The transcript is a technical input, not a permanent file offered to the Counselor.

The texts are retained associated with the recipient’s account for the authorized purpose. They may contain errors and do not constitute clinical records or official transcripts. Disabling a preference or revoking consent for future captures does not automatically delete prior texts.

An individual deletion button for each AI-generated text is not currently offered. To exercise rights concerning your data, including data that may appear in a summary associated with another person, use the procedure in this Notice. The request is analyzed with respect to your data and concurrent rights, not solely according to who owns the account containing the text.

Recording requires valid authorization; it is not considered consented to merely because the User selected the feature. For a revocation concerning a capture in progress, stop communicating information and contact privacy for handling. A preference control is not presented as a guarantee that a capture already begun will stop immediately.

9. De-identified indicators and development

We may generate genuinely de-identified statistical information to measure availability, demand, operation, experience quality, abuse prevention, research, development, and feature evaluation. Results that do not allow persons to be identified may be used in reports, planning, improvements, and statistical products, including for commercial purposes.

Preparation of de-identified information must respect the legal basis and limits of the original processing; it does not authorize incompatible reuse of identifiable content before de-identification.

Replacing a name with an identifier or grouping a small number of recognizable cases is not sufficient. As long as there is a reasonable possibility of associating the data with a person, the corresponding restrictions remain. This Notice does not provide general authorization to commercialize identifiable data or reidentify de-identified information.

Intimate Session and document content is not authorized in bulk for training general-purpose models, third-party campaigns, or new incompatible purposes. When new processing that requires consent is proposed, it will be disclosed and obtained beforehand; it will not be applied retroactively.

10. Processors and providers

The infrastructure uses providers of hosting, databases, authentication, communication, AI processing, email, notifications, payments, monitoring, and support. It includes services such as Supabase, Vercel, Agora, OpenAI, Firebase, and Sentry, as well as Stripe for the contribution feature and email delivery services.

Providers acting on our behalf must process data according to instructions, authorized purposes, and applicable confidentiality and security requirements. We may replace them or modify processing locations while complying with legal requirements and without improperly changing the disclosed purpose.

Data may be processed or stored outside Mexico. Use of third parties does not release Vestvired from its responsibility as data controller.

Stripe and identity providers may act as independent controllers with respect to their own verifications, compliance, and services. Their notices and terms govern those processing activities. A provider’s independence does not authorize Platicas to share data unrelated to the applicable purpose and legal basis.

11. Transfers to other controllers

We may communicate to Users the profile and interaction data necessary to select you and conduct the Session, including authorized derived texts; and to Stripe and other financial participants the data necessary for the transactions you request and their fulfillment.

Relevant data may also be communicated to authorities pursuant to a valid obligation or request and for actions necessary for the administration of justice and the recognition, exercise, or defense of rights. In emergencies, what is necessary may be communicated to those who must intervene when there is a legal basis; this does not imply a monitoring or rescue service.

Transfers within a corporate group require the legal conditions of common control and the same internal processes and policies or the required authorization. In a reorganization, acquisition, or transfer of the business, the specific legal basis applicable to the case will be used. The mere existence of interested investors does not authorize transfer of your file to them; de-identified data or other legally permissible mechanisms may be used.

The corresponding purposes and obligations will be communicated to the recipient. Non-exempt transfers that require consent must have a prior valid manifestation of acceptance or refusal. They are not considered authorized in bulk by acceptance of the agreement or by failing to respond to an email.

12. Retention and cancellation

We retain data while it is necessary for the disclosed purpose, the relationship, and applicable legal obligations. After ordinary use ends, it is blocked or restricted when appropriate and is subsequently deleted or de-identified.

Application and review documents are retained during evaluation and while there is a justified need for verification, participation, security, or defense. Rejection of an application or account closure does not authorize indefinite retention of a complete file. Profile information ceases to be used for new offerings when participation ends, without prejudice to records of prior transactions that must legally survive.

Audio follows the temporary cycle described in Section 8. Notes and summaries are retained for authorized purposes and are subject to the rights of the persons mentioned. They are not, by themselves, clinical records subject to mandatory retention, and there is no commitment to perpetual archiving.

Commercial documentation covered by Article 49 of the Commercial Code may require at least ten years of retention; records subject to other obligations are retained for the applicable period. That rule does not automatically extend retention of every intimate document, audio file, or note to ten years.

Data concerning breach of contractual obligations will observe the legal limit of seventy-two months from the breach. It is distinguished from documents subject to an independent legal obligation. Data necessary for a dispute or request is restricted to that purpose for the legally appropriate period.

Deleting the account or uninstalling the App does not extinguish obligations or cause instantaneous deletion across all systems and backups. An independent Stripe account likewise is not closed merely because the Platicas account is deleted. Subsequent retention requires justification and does not authorize new secondary uses.

13. Rights of Access, Rectification, Cancellation, and Objection

You may exercise your ARCO rights before admin@platicasprofundas.com. Provide your name and a means for response, elements to establish identity and, where applicable, representation; identify the right and the data or context that allow it to be addressed. For rectification, state the change and relevant documentation. You do not need to know every record in advance in order to make a general access request.

Identification will be verified proportionately. You must not send unnecessary additional files. If supplementary information is required, it will be requested in accordance with the legal procedure, not as a barrier to exercising rights.

The determination will be communicated within 20 business days from receipt of the request, in accordance with law. If granted, it will be made effective within the 15 business days following the response. Each period may be extended once for an equal period when circumstances justify it and notice is given in accordance with law.

Exercise of these rights is free of charge, except for reproduction or delivery costs permitted by law. Total or partial denials will be based on a legal ground. Cancellation may require prior blocking; it does not require deletion of data whose retention is legally justified, but mere business convenience is not sufficient to deny it.

14. Revocation, restrictions, and departure from the Platform

You may revoke consent or limit the use or disclosure of data by writing to the privacy contact with your account information and the processing you wish to limit. When applicable, identity will be verified and the request will be handled in accordance with legal mechanisms and time periods, without imposing an indefinite delay for technical reasons.

Revocation does not have retroactive effect and does not eliminate a legal retention obligation. If processing is indispensable to evaluate your application or provide a feature, refusal may prevent that specific activity. Refusing promotions does not, by itself, prevent participation.

You may request account closure through the App feature or by email. Data-cancellation requests, including those relating to a specific document or text, do not require closing the entire account when they can be handled separately.

15. Security, confidentiality, and breaches

Protection requires administrative, physical, and technical measures appropriate to the sensitivity and risks, such as access controls, authentication, permission management, and incident response. Authorized personnel and providers may process information for the functions assigned to them under confidentiality obligations.

A breach that significantly affects property or moral rights will be communicated to the affected persons immediately in accordance with law, with information so that they can take measures. This does not limit the Controller’s prevention, investigation, and response obligations.

As a Counselor, you must protect User information to which you have access. Reporting an incident to the privacy contact does not authorize public disclosure of it or publication of evidence that reveals unnecessary data.

16. Permissions, technologies, and automated measures

The App uses third-party components, local storage, and session technologies for authentication, preferences, calls, notifications, financial transactions, and diagnostics. Web channels may use equivalent technologies depending on their function. You may manage permissions through the operating system or browser, taking into account that restricting a necessary element may prevent the corresponding feature.

The camera, microphone, images, files, and calendar are used for the operations you request through enabled features. Technical permissions do not amount to unlimited authorization of purposes. Future non-essential advertising or tracking technologies must be disclosed and made subject to the required controls and consents before activation.

Automated rules are used for attendance statuses, cancellations, flags, availability, and operational measures. Criteria may consider connection, punctuality, cancellations, recurrence, approval, and activity. A classification may be erroneous and review may be requested through support.

You may exercise objection when an automated decision produces significant effects in circumstances protected by law. An AI-generated text is not, by itself, a diagnosis or final determination concerning your participation.

17. Minors, changes, and authority

Participation is reserved for persons 18 years of age or older. If we become aware of a minor’s data in an application or account, its processing will be reviewed and the appropriate restrictions, deletion, or strictly necessary retention will be adopted.

Updates will be published with a version and date through Platicas privacy channels. Material changes will be communicated through appropriate means. A new or incompatible purpose that requires consent must be disclosed and authorized before application; updating the text does not legitimize prior unauthorized processing.

You may contact the Secretariat of Anti-Corruption and Good Governance, or the authority that is legally competent, in accordance with current personal-data protection procedures. Internal handling of a request is not a waiver and not an additional prerequisite for exercising rights before an authority.