What I collect, and what I do with it.

01 · Who is responsible

Francisco Enrique Bernal Quirós, trading as Datafiel.

I am an independent technology consultant with my address at Rapone 6, Rivello Residencia, Hermosillo, Sonora, 83243, Mexico, and the party responsible for the personal data described here under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). For anything in this notice, write to paco@datafiel.com.mx.

02 · What I collect

Only what you give me, plus basic site measurement.

The contact form. Your name, email address, company (optional), the topic you select, and whatever you write in the message. That is everything the form asks for.

Email and calls. Anything you send me directly, and the notes I take when we talk.

Site analytics. Pages visited, approximate location at city level, device and browser type, and how you arrived, collected by Google Analytics. I do not see names or email addresses in analytics.

Hosting logs. The site is served by Cloudflare, which records IP addresses and request data in standard server logs for security and performance.

03 · Why I use it

To reply to you, to do the work, and to keep the lights on.

• To answer your enquiry and decide together whether an engagement makes sense.
• To scope, deliver and invoice an engagement, and to keep the records that contracts and Mexican tax law require.
• To understand which pages are useful so I can improve the site.
• To keep the site and my systems secure.

I do not use your data for advertising, I do not add you to a mailing list, and I do not sell or rent it to anyone.

04 · Client data during an engagement

Yours stays yours.

During an assessment or implementation I may be given access to your systems, documents and data, including personal data about your staff or customers. I use it only for the agreed work, treat it as confidential, and follow the terms of our agreement and any non-disclosure agreement, which take precedence over this notice. When the engagement ends I return or delete it, except for the working papers I need to keep to stand behind my findings.

05 · Apps and messaging services I build

When I run an app for a client, the client decides.

Some engagements include building and operating an app for a client, for example a WhatsApp assistant on Meta's WhatsApp Business Platform that answers questions and passes conversations to the client's staff. The people who write to that app are the client's contacts. The client is the party responsible for their data, and I process it only on the client's behalf and following the client's instructions.

What the app handles. Your phone number and WhatsApp profile name, the messages and button choices you send, the replies the app sends you, and the time of each message.

What it is used for. Only to run the service the client asked for: answer you, keep track of where you are in the conversation, and hand you over to a person when needed. I do not use it for advertising, I do not sell it, and I do not combine it with other data. Data received through Meta's platforms is used only to provide that service, in line with Meta's platform terms.

Where it lives. Whenever possible, in cloud accounts owned by the client. Meta carries the messages themselves under its own terms.

06 · Services I rely on

A short list, and I chose each one deliberately.

• Formspree delivers contact form submissions to my inbox.
• Google Analytics measures site traffic. Google Fonts serves the typefaces, which means your browser requests them from Google.
• Cloudflare hosts and protects the site.
• Meta (WhatsApp Business Platform) and Microsoft (Azure and Microsoft 365), when an app I run for a client is built on them. In that case the data usually lives in the client's own accounts.
• My email, calendar and document tools, which hold our correspondence and engagement files.

These providers process data on my behalf under their own privacy terms, and most of them are in the United States, so data may be transferred outside Mexico. I only share what each service needs to do its job. Beyond this, I disclose personal data only when the law requires it.

07 · Cookies

Analytics cookies only.

The only cookies this site sets are the ones Google Analytics uses to tell returning visitors from new ones. There are no advertising or tracking cookies from third parties. You can block cookies in your browser settings or install Google's analytics opt-out add-on; the site works the same either way.

08 · How long I keep it

As long as it has a purpose, then it goes.

• Enquiries that do not become an engagement: up to 12 months, so I can pick the conversation back up if you return.
• Engagement records, contracts and invoices: five years after the engagement ends, as Mexican tax and commercial law require.
• Analytics data: per the retention setting in Google Analytics, currently 14 months.
• Conversations handled by an app I run for a client: for the period that client's agreement sets, which each project states, and no longer.

09 · Your rights

Ask, and I will answer.

Under the LFPDPPP you have the ARCO rights: to access the personal data I hold about you, to rectify it if it is wrong, to cancel it, and to oppose a particular use of it. You can also withdraw consent or limit how I use your data. If you are in the European Economic Area, the United Kingdom or California, you have the equivalent rights under the laws that apply there, and I will honor them.

To exercise any of these, email paco@datafiel.com.mx with your name and what you are asking for. I will reply within 20 business days, as the law sets out, and usually much sooner. If you believe I have not handled your data properly, you can complain to Mexico's data protection authority, which since 2025 is the Secretaría Anticorrupción y Buen Gobierno (it took over this role from the INAI).

10 · Deleting your data

One email, and it is gone.

To have your personal data deleted, including anything an app I run for a client holds about you, email paco@datafiel.com.mx with the subject "Data deletion request" and the phone number or email address the data is linked to. If the data belongs to a client's app, I will tell the client and act on their instructions, which in practice means deleting it.

I will confirm the deletion within 20 business days. Records that the law requires me to keep, such as invoices, are kept only for the required period and then deleted. Messages already delivered to a WhatsApp chat also live on the devices of the people in that chat, which I cannot reach.

11 · Security

The same standards I hold clients to.

I use reasonable technical and organizational measures to protect the data I hold: encrypted connections, access controls, multi-factor authentication on every account, and vendors I have assessed. No system is perfectly secure, and I will tell you promptly if a breach affects your data.

12 · Changes

If this notice changes, the date at the top changes with it.

I will post any update here. Material changes to how I use your data will not apply to you without your consent. Questions about any of this: paco@datafiel.com.mx.