CORAZONADA — PRIVATE PILOT · v0.1 DRAFT UNDER LEGAL REVIEW This document is a working draft pending attorney review; it is not legal advice nor a final version. ------------------------------------------------------------------------ # Corazonada — Privacy Notice **Version:** v0.1 (structural draft) · **Date:** 2026-08-31 **Data controller (responsable):** CTM (Creando Tu Matrix) · Marcus Patman *Working draft, NOT legal advice and not a final publishable version. Pending review by a Mexican data-protection and consumer-law attorney — see [docs/es/regulatorio-mexico.md](../es/regulatorio-mexico.md), checklist §8, items 2 and 4 ("draft the privacy notice ... and beta terms"). AUTHORIZED for the private pilot by Marcus (2026-10-18): served at `/legal` with a visible draft banner; legal review remains pending before the pilot widens beyond owner-invited testers. This is an English mirror of [docs/es/aviso-privacidad.md](../es/aviso-privacidad.md) for reference — the Spanish version is the legally operative one, since this notice is governed by Mexican law (LFPDPPP). Any discrepancy is a translation bug, not an intentional difference. Every `[ ]` marks a placeholder the attorney or Marcus must fill in before this document is final.* --- ## 1. Data controller Corazonada is a subscription concierge service operated by **CTM (Creando Tu Matrix)**, currently run by Marcus Patman. Formal incorporation of the Mexican legal entity (S. de R.L. de C.V., SAPI de C.V., or SAS — decision pending, see [regulatorio-mexico.md §6](../es/regulatorio-mexico.md)) is in progress. `[ ]` This section will be updated with the full legal name, tax ID (RFC), and registered address once incorporation is complete. This notice is governed by Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the DOF on March 20, 2025, in force since March 21, 2025. ## 2. Personal data we collect We collect only what's necessary to operate the service you asked for, either directly from you or generated by your use of the service: - **Identification and contact:** the chat identifier of the channel you entered through (WhatsApp number or Telegram chat) and the profile name that platform shares with us. - **Conversation:** the history of text messages and voice notes you exchange with Corazonada, including transcripts of your voice notes. - **Memory and preferences:** facts and preferences you mention in conversation that the agent stores to personalize the service (for example, your frequent contacts or flight preferences). You can ask to correct or delete any stored fact at any time, directly in the chat thread where you talk to me (WhatsApp or Telegram). - **Portal credentials, when you provide them for a specific errand** (for example, your CFE login): these are encrypted in a separate vault before storage and only decrypted, in memory, at the moment of executing the action you authorized. - **Google data (Gmail and Calendar), only if you connect your account:** calendar events and emails the agent needs to read for the task you asked for. This access is never requested without your explicit authorization via Google OAuth, and you can revoke it at any time from your Google account. - **Operational technical data:** an audit log of the actions the agent takes on your behalf (what was done, when, and with what result) — this exists so you can ask "what did you do with my account?" at any time, and for our own accountability. **What we do NOT do:** we do not use your conversations, email, or calendar to train AI models, ours or anyone else's. We do not sell your personal data. We do not send unsolicited outbound messages to numbers that haven't contacted us. ## 3. Purposes of processing We use your personal data to: 1. Operate the personal-agent service you requested: execute the errands you confirm (e.g., checking your CFE bill, searching flights), follow up on pending tasks, and notify you of things we're watching on your behalf. 2. Personalize the service based on what you've told us (preference memory). 3. Honor the confirmation gates and audit log our own security design requires — we never execute an action with real consequences (spending, sending an email, etc.) without your explicit confirmation. 4. Comply with legal obligations (e.g., retaining records an authority may require). We do not use your data for secondary purposes (third-party marketing, ad profiling). `[ ]` If this changes before public launch, this section must be updated and your consent re-obtained for the new purpose, per the LFPDPPP. ## 4. Consent By messaging Corazonada for the first time with a valid invite code, you confirm you've read this notice and consent to the processing of your data for the purposes described above. For sensitive or financial data (e.g., a portal credential), we ask for your express confirmation at the moment you provide it, not just at the start of the conversation. You can withdraw your consent and opt out at any time by texting "STOP" or "BAJA" — we stop messaging you immediately and confirm the opt-out. Messaging us again afterward re-opts you in. ## 5. Transfers and subprocessors To operate the service, we share the strictly necessary data with the following providers, all under contractual confidentiality obligations and the same level of protection this notice requires (LFPDPPP, third-party transfers): | Provider | What for | Data processed | |---|---|---| | Google (Gemini) | The AI model driving the conversation | Your conversation text, at the moment each reply is generated | | OpenRouter | Routing the call to the AI model | Your conversation text in transit to the model | | Telegram | The pilot's messaging channel (@CorazonadaBot) | Your Telegram chat: chat identifier, profile name, and message content | | E2B | The cloud computer where the agent browses portals on your behalf (simulated during the pilot; no real data) | Whatever's on screen during an active errand | | Google | Reading Gmail/Calendar, only if you connect your account | Events and emails, only what the errand requires | | Railway | Hosting the application and database | All of the above, at rest | | Resend | Sending and receiving your personal agent's email (pending activation in the pilot) | The emails the agent sends or receives on your behalf | | `[ ]` Key-management (KMS) provider | Encrypting portal credentials in the vault | The encrypted credentials — the final provider hasn't been chosen yet (see `common/config.py`, `KMS_KEY_ID`) | These providers operate, in whole or in part, outside Mexico — this constitutes an **international transfer of personal data**, permitted under the LFPDPPP when the recipient assumes obligations equivalent to this notice, which we require contractually from each one. `[ ]` Formal data-processing/transfer agreements (DPAs) with each subprocessor are a pending action item (see [regulatorio-mexico.md §1](../es/regulatorio-mexico.md), flagged 🔴). ## 6. ARCO rights You have the right to **A**ccess, **R**ectify, and **C**ancel your personal data, and to **O**ppose its processing (the ARCO rights under Mexican law). To exercise them: - For memory facts and preferences: just ask directly in the chat thread where you talk to me — the agent handles it on the spot. - For any other personal data (e.g., a formal access request or full account cancellation): `[ ]` CTM privacy contact email, pending assignment — in the meantime, request it over the same chat and we'll handle it manually. We respond to every ARCO request within the 20 business days the LFPDPPP requires. `[ ]` The attorney needs to confirm the exact statutory article and any extension procedure. ## 7. Security measures Portal credentials you share with us are encrypted in a vault separate from the main database; encryption at rest uses a key derived from a KMS provider (see §5). Access to your cloud computer (E2B) is isolated per subscriber — never shared across users. Every action with real consequences goes through an explicit confirmation gate before executing, and is recorded in an audit log. ## 8. Retention and deletion We retain your data while your account is active, plus whatever additional period the law requires for audit or compliance purposes. `[ ]` The exact post-opt-out retention period is still pending definition with the attorney. Disconnecting an integration (e.g., your Google account) purges from our active storage whatever data that integration let us read. ## 9. Security breach notification If a security breach affecting your property or personal rights occurs, we'll notify you immediately over the same channel you talk to us on or whatever contact method you've registered, as the LFPDPPP requires. `[ ]` The attorney needs to confirm the exact statutory wording for the applicable timeframe. ## 10. Changes to this notice If we update this notice in a way that affects the purposes of processing, we'll notify you over your chat channel and, where the law requires it, ask for your consent again before continuing. The current version is always available at `[ ]` (URL pending — see `LEGAL_DOCS_URL`). ## 11. Contact For any question about this notice, message us directly on your Corazonada chat channel. `[ ]` Formal privacy contact email, pending assignment once the entity is incorporated.