Privacy notice

Who is the data controller

FormaNativa is a service operated by the individual identified below, who is the data controller for the processing of your personal data under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Mexico's federal personal data protection law).

Data we process

We process the data of the people who create an account or are part of a team in FormaNativa:

• Identification and contact: first name, last name and email address.
• Access and security: your password, which we store only as an irreversible value; the passkeys you register and your two-step verification settings.
• Invoicing: if you ask for an invoice, your legal name, RFC (Mexican tax ID), tax regime, postal code, CFDI use (the purpose stated on a Mexican electronic tax invoice) and the email address where you receive it. Card payments are processed by Stripe: we never receive or store your card details, only the customer and subscription identifiers.
• Your content: sites, pages and their history, media files, connected domains, forms, booking calendars and your teams' settings.
• Service use and security: your IP address and technical data about your connection, a log of the operations you carry out in your account and technical logs from our servers. We use them to protect your account, stop abusive requests and diagnose failures.
• Connected assistants: which artificial intelligence assistant you connected over MCP, to which team and when.

We do not ask you for sensitive personal data.

What we use it for

We use your data for these purposes, all of them necessary to provide you the service:

• Create and administer your account, your companies, your teams and their permissions.
• Verify your identity when you sign in and protect your account.
• Host, preview and publish your sites, and connect your domains.
• Charge your subscription and issue your tax invoices (CFDI).
• Send you the service emails: verification, password reset, invitations, form and booking notices, publications, payments and invoices.
• Give you support and handle your requests.
• Keep the platform secure, prevent abuse and diagnose failures.
• Automatically verify the pages that are published in order to detect and take down content that breaks the law (how it works).
• Meet our legal and tax obligations.

We do not use your data for advertising or marketing, we do not send newsletters and we do not sell your information. Nor do we use your content to train artificial intelligence models.

We process your data because it is necessary to fulfill the relationship you have with us, and with the consent you give by creating your account and using the service after reading this notice.

Data of the visitors to the sites

When someone visits a site published with FormaNativa, fills in one of its forms or books an appointment, the data controller for that data is the site owner. FormaNativa acts as a processor: it processes that data only on the owner's behalf and in order to provide them the service.

Forms and bookings

We store the answers the person submits —for example name, email, phone or message, depending on the fields the owner defines— and, for bookings, the date and time reserved. The answers are kept in our database in Mexico until the site owner deletes them. When they are sent they only pass through the delivery network, where temporary receipt records remain and delete themselves within a maximum of 30 days. These answers do not go through the verification of published content.

We also process the IP address of whoever submits a form or books an appointment, to stop abusive submissions and for security.

Visit statistics

We count visits in order to show statistics to the site owner: page visited, approximate country, region and city, device type and the referring site. To count unique visitors we use the visitor's IP address and browser, from which we compute a code that changes every day.

If you visited a site published with FormaNativa and want to exercise your rights over your data, contact its owner. If you cannot reach them, write to us and we will pass your request on to them.

Verification of published content

To detect and take down content that breaks the law or our Terms and conditions, we automatically verify only published content: the pages anyone can open on the internet, with the text, images and files they show. If those pages include personal data —for example names or photographs—, we process it in the verification only for this purpose.

Communications are not verified. The verification never reads form answers, bookings, emails or any other message between a site and its visitors, nor drafts, unpublished versions, previews or password-protected pages. No one at FormaNativa looks at those communications, unless the site owner asks us to in order to give them support or a competent authority orders it under the law.

No page is taken down on the automatic decision alone: a person reviews every flagged case. The full procedure, including how to ask for a clarification or report content, is in the Terms and conditions.

Cookies and statistics

Neither formanativa.mx nor the sites published with FormaNativa use tracking or advertising cookies. Visit statistics work without cookies.

In the studio (app.formanativa.mx), your session is stored in your browser's temporary storage and is deleted when you close the tab; we use a single cookie to remember whether the sidebar is open or closed. Password-protected pages remember the unlock only for that browser session.

Who we share it with

We do not sell or rent your data. To run the service we rely on these providers, which process data on our behalf and under our instructions:

Some of these providers process data outside Mexico, mainly in the United States. We only disclose data to authorities when the law requires it; for example, the information on your tax invoices reaches the SAT (Mexico's tax authority) when they are stamped.

Artificial intelligence assistants that you connect

When you connect an assistant such as Claude or ChatGPT, that assistant accesses the information of the team you chose —including form answers and bookings— with the permissions you hold in it. Its provider processes that information under its own terms and privacy notice. You can revoke the connection at any time from the connections section of your account.

How long we keep it

• Account and content: while your account is active and until you request its deletion.
• Form answers and bookings: until the site owner deletes them.
• Tax invoices and payment records: five years, as the tax laws require.
• Log of the operations in your account: 180 days.
• Technical and security logs, including IP addresses: up to 3 months.
• Database backups: up to 35 days; after that they are overwritten.
• Visit statistics: as daily totals, with no data that identifies the visitors.

When a piece of data is no longer necessary, we block it and then delete it. See how to request the deletion of your data.

Your derechos ARCO (access, rectification, cancellation and objection)

You have the right to access your data, rectify it, cancel it or object to its processing, as well as to withdraw your consent and limit the use of your information.

Many things you can do yourself from the studio: correct your name, delete files and form answers, archive sites and revoke connected assistants. For everything else, write to soporte@formanativa.mx and include:

• Your name, your account email and a way for us to reply to you.
• A copy of your official ID or, if you are acting on behalf of another person, the document that proves you represent them.
• A clear description of the right you want to exercise and of the data involved.
• Any document that helps locate your data.

We will reply to you within a maximum of 20 business days and, if your request is well founded, we will carry it out within the following 15 business days.

If you consider that your right to the protection of your data has been infringed, you may turn to the competent authority on the matter, the Secretaría Anticorrupción y Buen Gobierno (Mexico's anti-corruption and good governance ministry).

Security

• Encrypted HTTPS connections across the whole service.
• Database and files encrypted at rest.
• Passwords stored with Argon2, passkeys and two-step verification, which each team can require.
• Protected pages are encrypted and are only decrypted in the browser with the password you set.
• Access to each site limited to its team, with permissions by role.

No measure is infallible. If a security breach occurs that significantly affects your rights, we will inform you without delay.

Changes to this notice

If we change this notice, we will publish the new version on this page with its update date. If the change is significant, we will also let you know by email.

See also the Terms and conditions.