GraciasGracias Privacy Policy

Effective Date: October 11, 2026 Last Updated: October 11, 2026 Version: 1.3

1. Introduction

1.1 Purpose

This Privacy Policy ("Policy") describes how GraciasGracias ("we," "us," "our," or "Platform") collects, uses, discloses, and protects personal information of users ("you" or "your") of the platform at graciasgracias.live and related services.

1.2 Scope

This Policy applies to all users of the Platform, including visitors, registered users, event organizers, and ticket purchasers. It governs our practices regarding personal information collected through the Platform, regardless of where you access it from.

1.3 Data Controller

The data controller responsible for your personal information is:

GraciasGracias Gral. Salvador Alvarado 72, Escandón I Secc Miguel Hidalgo, 11800 Ciudad de México, CDMX Mexico

Email: support@graciasgracias.live

1.4 Applicable Laws

We comply with applicable data protection laws including:

• LFPDPPP — Mexican Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares)
• GDPR — European Union General Data Protection Regulation (for EU users)
• CCPA/CPRA — California Consumer Privacy Act (for California users)
• Other applicable jurisdictional privacy laws

1.5 Acceptance

By using the Platform, you consent to the collection, use, and disclosure of your personal information as described in this Policy. If you do not agree, you must not use the Platform.

2. Information We Collect

2.1 Information You Provide Directly

Account Information:

• Name (display name)
• Email address
• Username (immutable once selected)
• Profile information you choose to provide (bio, photo, location)
• Preferred city for content personalization

Sign-up and Survey Information: When you create your profile we ask for information such as your phone number (optional), age range, gender, nationality, city, preferred language and how you heard about GraciasGracias. If you choose to answer our optional survey, we also collect your situation in Mexico (for example, whether you are visiting or living here), the languages you speak and your level of Spanish, how you find events, your interests, and what you are looking for on the Platform. We use this information to personalize the Platform and to understand our community.

Authentication Information:

• Social authentication tokens (Google) and basic profile data when you use SSO
• We do not use passwords. You sign in with a one-time link sent to your email address, or with your Google account.

Communication Content:

• Messages you send through Platform messaging
• Community board posts, comments, and reactions
• Custom approval question responses
• Support communications with us
• Messages, photos and other content you send us by WhatsApp, together with the phone number and WhatsApp profile name you use

Event and Ticketing Information:

• Events you create as an organizer
• Tickets you purchase
• Refund requests
• Friends Only meetup participation

Buying without an account: You can buy tickets without creating an account. We collect your name, your email address and any answers to the organizer's questions, and we email you a private link to your order. Anyone who has this link can view your tickets, request a refund and add the order to a GraciasGracias account, so please keep it private. The link stops working 14 days after the event ends. If you later sign in with a verified email address that matches a guest order, we automatically add that order to your account.

Marketplace and Rental Information:

• Listings you create (items for sale, rentals available)
• Contact attempts between buyers/sellers, renters/landlords
• Mexican-specific rental information (Fiador, Póliza Jurídica preferences)

Social Connections:

• Friend connections you establish
• Users you block
• Hangouts and social calls

2.2 Information Collected Automatically

Device and Connection Information:

• IP address
• Device type and identifiers
• Browser type and version
• Operating system
• Mobile device identifiers
• Network information

Usage Information:

• Pages visited and content viewed
• Search queries on the Platform
• Click and interaction patterns
• Session duration and frequency
• Feature usage patterns
• Performance and error data

Session recordings: Our analytics provider records how pages are used — for example clicks, scrolling and page navigation — so we can find and fix problems. Text you type into form fields is masked and not recorded.

Location Information:

• Approximate location derived from IP address
• Explicit location data if you enable location-based features
• Selected region or city preference
• Event venue locations you interact with

Cookies and Similar Technologies:

• Authentication cookies (essential)
• Preference cookies (functional)
• Analytics cookies (PostHog)
• Performance cookies

See Section 9 for details on cookies.

2.3 Information from Third Parties

Payment Information: We do not store full payment card information. Stripe processes payments and we receive:

• Transaction confirmation
• Last 4 digits of payment methods
• Payment method type
• Stripe customer ID and payment intent ID

Stripe Connect (Organizers): For organizers, Stripe provides additional information including:

• Identity verification status
• Payout account configuration
• Connect account ID
• Lane configuration (MX or US)

Social Authentication: When you authenticate via Google, we receive basic profile information (email, name, profile photo) per the OAuth scope you authorize.

Event Import Partners: External event data from Ticketmaster, other partners, and publicly available event calendars includes event details, venue information, and pricing, which become Platform content.

Artificial-Intelligence Services: We use services provided by OpenAI and Anthropic to (a) check text and images submitted to the Platform — including posts, comments, listings, event details, photos and private messages — for content that breaks our rules; (b) read listings and events you send us by WhatsApp, including text in images such as event flyers, to prepare a draft for your review; (c) extract listing details from images of listings that were posted publicly elsewhere (see "Listings Republished from Other Sources" below); and (d) translate event information. Content sent to these services is processed under their policies and our agreements with them.

Listings Republished from Other Sources: Our team may add marketplace and rental listings that were posted publicly elsewhere, such as in WhatsApp or Facebook groups. These listings may include the poster's name and the contact details that appeared in the original post. We do not keep the image used to create the listing. If a listing was created from your post and you want it corrected or removed, contact support@graciasgracias.live and we will act promptly.

2.4 Sensitive Personal Information

We generally do not collect sensitive personal information. However, certain features may incidentally involve sensitive data:

• Health information: If shared voluntarily in community posts or event approval questions
• Sexual orientation/gender identity: If shared voluntarily in profile or content
• Religious beliefs: If shared voluntarily in community posts
• Political opinions: If shared voluntarily in community posts

We do not encourage submission of sensitive information. Where collected, we apply heightened protections. You may request removal of sensitive information at any time.

We do not collect:

• Financial account credentials
• Government-issued ID numbers (except as required by Stripe for organizer KYC)
• Biometric information
• Genetic information

3. How We Use Information

3.1 To Provide the Platform

• Authenticate your access and maintain your account
• Process ticket purchases and refunds
• Facilitate organizer payouts via Stripe
• Display events, listings, and community content
• Enable messaging and social features
• Deliver tickets (email, in-app)
• Send transactional notifications (purchase confirmations, event reminders, etc.)
• Process refunds and resolve disputes
• Provide customer support

3.2 Lawful Bases for Processing (GDPR)

For users protected by GDPR, we process personal information based on:

• Contract performance — To provide services you request (Article 6(1)(b))
• Legitimate interests — Platform operations, security, fraud prevention (Article 6(1)(f))
• Legal obligations — Tax records, regulatory compliance (Article 6(1)(c))
• Consent — Where explicitly required (marketing, special categories) (Article 6(1)(a))

3.3 LFPDPPP Purposes (Mexican Users)

For Mexican users, primary purposes (finalidades primarias) include:

• Provision of Platform services
• Account management and authentication
• Transaction processing
• Communications related to your use of the Platform
• Compliance with legal obligations

Secondary purposes (finalidades secundarias) — which you may opt out of:

• Marketing communications
• Product improvement analytics
• User research

3.4 To Improve the Platform

• Analyze usage patterns to improve features
• Detect and fix technical issues
• Develop new features
• Conduct A/B testing
• Aggregate analytics

3.5 For Safety and Security

• Content moderation (automated and human)
• Fraud detection and prevention
• Investigation of suspected violations
• Account security monitoring
• Protection of user safety

3.6 For Communications

• Transactional emails (essential, cannot be opted out)
• Marketing emails (with opt-in consent where required)
• Bell notifications within the Platform
• Push notifications on your device, if you allow them (for example order confirmations, payout updates and replies to your posts). You can turn them off in your browser or device settings.
• WhatsApp messages, only in conversations you start with us on WhatsApp (see Section 11.5)
• Event reminders by WhatsApp, only if you ask for them by sending us the join message from your ticket — only for that event (24 hours and 2 hours before), and you can reply STOP at any time
• Service announcements

3.7 For Legal Compliance

• Compliance with applicable laws
• Response to legal process (subpoenas, court orders)
• Protection of rights and safety
• Tax recordkeeping

3.8 With Your Consent

For purposes beyond those described, we will request your specific consent.

4. How We Share Information

4.1 With Other Users

Information you share publicly is visible to other users:

• Profile information you make public
• Community posts and comments
• Event participation
• Marketplace and rental listings (the listing itself — for example the title, description, photos and price)
• Friends Only meetup participation (visible to creator's friends only)

Contact details on listings and events. Different rules apply depending on the type of listing:

• Marketplace and rental listings. The contact details a poster provides (for example a WhatsApp number, phone number, email address, or Facebook or Instagram profile) are not public. They are shown only to people who are signed in to a GraciasGracias account and choose to view them. We keep a record of who viewed the contact details of which listing and when, and we limit how many contact details one person can view, to protect posters from spam and misuse. If a listing was posted from a GraciasGracias account, other members contact the poster through Platform messaging instead.
• Event listings not sold through GraciasGracias (for example, events sent to us by WhatsApp, events that take reservations by phone, and events added from a web link). The contact details provided for the event are public and can be seen by anyone, including people who are not signed in, because the purpose of these listings is to let people contact the organizer. We stop showing these contact details after the event has ended or has been removed.
• Listings and events sent by WhatsApp. The phone number you use to message us on WhatsApp is never published. Only the contact details you type into the contact section of your listing or event are shown, under the rules above.

4.2 With Event Organizers

When you purchase a ticket or request approval:

• The organizer receives your name, email, and ticket information
• Custom approval question responses are visible to the organizer
• The organizer may need to communicate with you about the event

Organizers are bound by data protection obligations regarding attendee information.

4.3 With Service Providers

We share personal information with trusted third-party service providers who help us operate the Platform. These providers process information on our behalf for purposes that include payment processing, hosting and infrastructure, authentication, communications and email delivery, messaging (WhatsApp), analytics, error monitoring, content moderation, mapping, and event data. The categories of information shared depend on the provider's function and may include account identifiers, contact details, transaction data, content submitted to the Platform, device and usage information, and location queries. The specific providers we use may change over time without notice. Each provider operates under its own privacy practices, and our relationships are governed by data processing agreements that define how that information is handled.

4.4 Cross-Border Transfers

Personal information may be transferred to and processed in countries other than your country of residence, including:

• United States and other countries — Our service providers, including Stripe, Vercel, Supabase, Cloudflare, OpenAI, Anthropic, PostHog, Sentry, Resend, Google, Meta (WhatsApp), CARTO, Fly.io and Klipy, process data mainly in the United States or in other countries where they operate
• European Union — Some service infrastructure
• Mexico — Primary operations

For EU users, we ensure appropriate safeguards including Standard Contractual Clauses (SCCs) where required by GDPR.

For Mexican users (LFPDPPP), international transfers are conducted per applicable legal frameworks.

4.5 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred. We will notify you of any such transfer and any changes in privacy practices.

4.6 Legal Compliance

We may disclose information when required by law, including:

• Response to legal process (subpoenas, court orders, search warrants)
• Tax authority requirements
• Law enforcement requests with valid legal basis
• Protection of rights, property, and safety of GraciasGracias, users, or others
• Investigation of fraud or violations

4.7 With Your Consent

We may share information for other purposes with your consent.

4.8 Aggregated and Anonymized Data

We may share aggregated or anonymized data that cannot reasonably be used to identify you for any purpose.

5. Your Rights

5.1 Rights Under LFPDPPP (ARCO Rights) — Mexican Users

If you are in Mexico, you have the following rights regarding your personal information:

• Acceso (Access): Right to know what data we hold about you
• Rectificación (Rectification): Right to correct inaccurate data
• Cancelación (Cancellation): Right to request deletion
• Oposición (Opposition): Right to object to processing

To exercise ARCO rights, contact us at support@graciasgracias.live with:

• Your name and contact information
• Specific right(s) you wish to exercise
• Clear description of the data involved
• Proof of identity

We will respond within 20 business days as required by LFPDPPP.

Cancellation and your messages. Deleting your account removes your identity as described in Section 6.2. If your cancellation request also covers the messages you sent, we replace the text of every message you sent — and its earlier edited versions — with "[deleted]" and remove the images you sent. The messages keep their place in the other participants' conversations so those conversations stay readable; every such erasure is recorded, with your request as its reason.

5.2 Rights Under GDPR — EU Users

If you are in the EU/EEA, you have additional rights:

• Right to access — Receive a copy of your data
• Right to rectification — Correct inaccurate data
• Right to erasure ("right to be forgotten") — Request deletion
• Right to restrict processing — Limit how we use your data
• Right to data portability — Receive your data in machine-readable format
• Right to object — Object to certain processing
• Right not to be subject to automated decision-making — With significant effect
• Right to withdraw consent — Where processing is based on consent
• Right to lodge a complaint — With your data protection authority

To exercise GDPR rights, contact us at support@graciasgracias.live.

5.3 Rights Under CCPA/CPRA — California Users

California residents have the following rights:

• Right to know — What personal information we collect, use, and share
• Right to delete — Request deletion of personal information
• Right to correct — Correct inaccurate personal information
• Right to opt out — Of sale or sharing for cross-context behavioral advertising
• Right to limit — Use of sensitive personal information
• Right to non-discrimination — For exercising your rights

We do not sell personal information for monetary consideration. We may share information for limited purposes that could be considered "sharing" under CPRA; you may opt out by contacting support@graciasgracias.live.

5.4 Account Settings

Many rights can be exercised through account settings:

• Update profile information
• Change email address (subject to verification)
• Manage notification preferences
• Block other users
• Delete posts and content you created
• Close your account

Note: Username cannot be changed by users (Section 2.2 of ToS); contact support for exceptional circumstances.

5.5 Marketing Communications

You may opt out of marketing communications:

• Unsubscribe link in marketing emails
• Notification preferences in account settings
• Contact support@graciasgracias.live

Transactional communications (ticket confirmations, event reminders, security alerts) cannot be opted out while maintaining an active account.

5.6 Cookie Management

You can manage cookies through:

• Browser settings (block/delete cookies)
• Third-party opt-out tools

We do not currently offer a cookie settings tool on the Platform. You can block or delete cookies, including analytics and attribution cookies, in your browser settings.

Disabling essential cookies may prevent the Platform from functioning.

6. Data Retention

6.1 Retention Periods

We retain personal information for as long as necessary to:

• Provide Platform services
• Comply with legal obligations
• Resolve disputes
• Enforce agreements
• Maintain business records

Specific retention periods:

• Account information — for the duration of your account, plus a reasonable period after closure.
• Transaction records — as required by Mexican tax law, typically 5 years.
• Stripe Connect records — per Stripe's retention requirements.
• Content (posts, comments) — until you delete it. If you delete your account, posts and comments stay so other people's discussions remain whole, but they no longer show who you are ("Deleted user"); see Section 6.2.
• Communications (messages) — as long as the conversation exists. When a message is edited, the earlier text is kept and can be read only by administrators and the platform owner. If you delete your account, your messages stay in the other participants' conversations shown as from "Deleted user"; their text can be erased on request (Section 5.1).
• Ban records — if an account is banned for breaking our rules, we keep its email address on our ban list even after the account is deleted, so a banned person cannot register again by deleting first. We rely on our legitimate interest in preventing abuse.
• Payout records — an organizer who has received payouts is anonymized, never fully deleted, so the payout trail stays intact for legal, tax and dispute purposes.
• Analytics data — aggregated or anonymized after defined periods.
• Backup data — per backup rotation schedules.
• Logs (security, errors) — typically 30 to 90 days.
• WhatsApp messages, the number you message us from, and related records — as long as needed to operate the WhatsApp service and prevent abuse; you may ask us to delete them at any time.
• Records of who viewed a listing's contact details — as long as needed to protect posters from misuse; deleted if the viewer's account is deleted.

6.2 Account Deletion

When you delete your account, we anonymize it. Specifically:

• Erased: your name, contact email, phone number, gender, profile photo and cover (including the stored files), bio, nationality, cities, languages, situation in Mexico, relationship and family details, age range, interests, how you found us, your sign-up and survey answers, and your social links.
• Replaced: your username is replaced with an anonymous one (deleted_…) and your original username becomes available again; the email address you signed in with is replaced with a non-deliverable placeholder, so the address is freed.
• Ended: you are signed out on every device, linked sign-in methods are removed, and the account can no longer be signed in to.
• Stopped: your active listings expire and lose their contact details, and hangouts you host are cancelled; people who were going receive a neutral notice that the meetup was removed.
• Kept, without your identity: orders, tickets, payouts and refund records (tax and consumer-law retention); posts and comments; messages in other people's conversations (shown as "Deleted user" / "Usuario eliminado"); reports; moderation and audit records. Records of actions taken by our staff keep the staff member's username, even if that staff account is later deleted, so actions remain accountable.
• Not removed: if the account was banned, its email address stays on our ban list (Section 6.1).
• Organizers with payouts are anonymized, not deleted (Section 6.1).
• Backups: copies in backups are deleted as the backups rotate.

Deletion cannot be undone. To have the text of your messages erased as well, ask us (Section 5.1). There is no self-service way to remove the remaining records entirely; where the law requires it, contact us.

6.3 Legal Holds

We may retain information longer when required for legal proceedings, investigations, or compliance.

7. Data Security

7.1 Security Measures

We implement appropriate technical and organizational measures to protect personal information:

• Encryption in transit (TLS/SSL)
• Encryption at rest for sensitive data
• Row-level security (RLS) policies on database access
• Authentication and access controls
• Regular security audits
• Secure development practices
• Employee training and confidentiality agreements
• Incident response procedures

7.2 Limitations

No security measure is perfect. We cannot guarantee absolute security of information transmitted to or stored on the Platform. You are responsible for:

• Maintaining your account credentials
• Reporting suspected security breaches immediately

7.3 Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you and applicable authorities as required by law, including:

• LFPDPPP notification requirements (Mexico)
• GDPR Article 33-34 notification (EU users)
• State data breach laws (US users)
• Other applicable notification laws

8. Children's Privacy

The Platform is not intended for users under 18 years of age. We do not knowingly collect personal information from minors.

If we discover we have collected information from a minor:

• We will delete the information promptly
• We will close the account
• We will notify parents/guardians where appropriate

If you believe we have collected information from a minor, contact us at support@graciasgracias.live.

Parents/guardians who believe their child has provided information should contact us for removal.

9. Cookies and Tracking Technologies

9.1 What Are Cookies

Cookies are small text files stored on your device when you visit websites. They help websites function and collect information.

9.2 How We Use Cookies

Essential Cookies (cannot be disabled):

• Authentication and session management
• Security features
• Basic functionality

Functional Cookies (can be managed):

• Language and region preferences
• User interface customization
• Feature preferences

Analytics Cookies:

• PostHog product analytics
• Usage measurement
• Performance monitoring

Attribution Cookies: When you arrive through one of our links — for example the link in our Instagram profile, an organizer's promotional link, or a GraciasGracias short link — we set a cookie that records how you arrived (kept up to 30 days) and, for short links, a random visitor identifier (kept up to 1 year). If you then create an account or buy a ticket, we save how you arrived with your account or order.

Third-Party Cookies:

• Stripe (payment processing)
• Google (authentication)
• Google (maps shown on event pages)
• Other integrated services

9.3 Managing Cookies

You can manage cookies through:

• Browser settings (most browsers allow blocking/deleting cookies)
• Third-party opt-out tools

We do not currently offer a cookie settings tool on the Platform. You can block or delete cookies, including analytics and attribution cookies, in your browser settings.

Disabling essential cookies will prevent Platform login and core functionality.

9.4 Do Not Track Signals

We currently do not respond to Do Not Track (DNT) browser signals. Industry standards for DNT signals remain evolving.

10. Automated Decision-Making and Profiling

10.1 Content Moderation

We use automated content moderation systems (services provided by OpenAI and Anthropic), which review both text and images, to detect policy violations. Automated moderation may:

• Flag content for human review
• Apply temporary restrictions
• Auto-remove content meeting specific criteria

You may request human review of automated moderation decisions affecting your content.

10.2 Fraud Detection

We use automated systems to detect potential fraud, including:

• Unusual login patterns
• Suspicious transaction patterns
• Account behavior anomalies

10.3 Recommendation Systems

The Platform may use recommendation algorithms to surface relevant content, events, and connections. These do not result in significant automated decisions affecting your legal rights.

10.4 Your Rights

You have the right to:

• Request explanation of automated decisions
• Request human review
• Object to processing based on legitimate interests

11. Specific Features and Privacy

11.1 Friends Only Meetups

Friends Only Meetup features rely on friend connections:

• Friends are explicitly established (mutual consent)
• Friend lists are not publicly displayed
• Friends Only content visibility is creator-anchored, not transitively granted through friendship chains

11.2 Location Features

Location information is used for:

• City-based content personalization
• Event discovery in your area
• Map display of event venues
• Optional location sharing in profile

You can manage location-related preferences in account settings.

11.3 Messaging

Direct and group messages are:

• Visible to the participants in the conversation
• Stored on Platform infrastructure
• Checked automatically before delivery by automated moderation tools (including services provided by OpenAI and Anthropic); a message that appears to break our rules may be blocked or held for review
• Not end-to-end encrypted

Our staff do not routinely read messages. They review messages that our automated systems flag or that users report. Administrators and the platform owner can read any conversation, including direct messages, when needed for safety, to handle abuse reports, or to respond to legal requests; moderators cannot. When you edit a message, the earlier text is kept and only administrators and the platform owner can read it. If someone in a conversation deletes their account, their messages remain, shown as from "Deleted user". The first message you receive from someone who is not your friend arrives as a request, which you can accept, decline, or block and report.

11.4 Event Approval Custom Questions

Custom approval questions and your responses are:

• Visible to the event organizer
• Visible to GraciasGracias administrators for support purposes
• Not publicly displayed

11.5 Submitting Listings and Events by WhatsApp

If you send us a listing or an event by WhatsApp:

• We receive your phone number, your WhatsApp profile name, and the messages, photos and other files you send. WhatsApp is provided by Meta, which processes these messages under its own terms and privacy policy.
• We use automated tools, including artificial-intelligence services provided by Anthropic and OpenAI, to read your message, check your photos for content that breaks our rules, and prepare a draft of your listing or event. For events, this may include reading the text on a flyer or image you send. You review the draft before it is submitted.
• Your phone number is used to reply to you, to connect your messages into one submission, to apply limits that prevent spam, and to identify people who have broken our rules. It is never published. Only the contact details you type into your listing or event are shown to others (see Section 4.1).
• If our systems detect abusive content, we may stop responding to your number, either temporarily or permanently.
• You can reply STOP (or ALTO or BAJA) at any time and we will stop sending you messages. If you send us a new message later, we will treat it as a request to resume the conversation.
• We keep WhatsApp messages and related records as described in Section 6.

12. International Considerations

12.1 Users Outside Mexico

We welcome users from anywhere in the world. By using the Platform, you consent to:

• Processing of your information in Mexico and other jurisdictions where our service providers operate
• Application of Mexican law to your use of the Platform (subject to mandatory protections in your jurisdiction)

12.2 Specific Jurisdictional Rights

If you have specific rights under your local laws that exceed those described here, those rights remain in effect.

12.3 Language

This Policy is available in English and Spanish. In case of conflict between language versions, the English version controls. The Spanish translation is provided for convenience.

13. Changes to This Policy

13.1 Updates

We may update this Policy from time to time. Material changes will be communicated via:

• Email notification
• Prominent Platform notice
• Updated "Last Updated" date

13.2 Continued Use

Continued use of the Platform after material changes constitutes acceptance. For changes affecting your rights, we may seek additional consent where required by law.

13.3 Prior Versions

Prior versions of this Policy are available upon request at support@graciasgracias.live.

Version 1.2 (October 9, 2026): explains who can read messages and the kept edit history (Section 11.3), what account deletion erases and keeps (Section 6.2), message erasure on request (Section 5.1), and the ban-list and payout-record retention (Section 6.1).

14. Privacy Officer and Contact

14.1 Privacy Contact

For privacy questions, requests, or complaints:

Email: support@graciasgracias.live

Mailing Address: GraciasGracias Gral. Salvador Alvarado 72, Escandón I Secc Miguel Hidalgo, 11800 Ciudad de México, CDMX Mexico

14.2 Data Protection Authorities

If you believe we have violated your privacy rights:

Mexico: INAI (Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales) at https://home.inai.org.mx

EU: Your national data protection authority — find yours at https://edpb.europa.eu/about-edpb/about-edpb/members_en

California: California Privacy Protection Agency at https://cppa.ca.gov

We encourage you to contact us first to address concerns.

15. Summary

Who collects my data?
GraciasGracias, as the data controller.

What data is collected?
Account information, content, transactions, usage data and technical data.

Why is data collected?
To provide the Platform, for security, for legal compliance and to improve the Platform.

Who is data shared with?
Service providers; event organizers, for your transactions with them; and others as legally required.

Where is data stored?
Primarily in the United States (Supabase, Vercel) and Mexico.

How long is data kept?
As long as needed; transaction records as required by tax law, typically 5 years.

What are my rights?
Access, rectification, deletion, opposition and portability, subject to your jurisdiction.

How do I exercise my rights?
Email support@graciasgracias.live or use your account settings.

How is data secured?
Encryption, access controls and security audits.

16. Specific Privacy Notices

16.1 LFPDPPP Aviso de Privacidad (Mexican Users)

This Privacy Notice complements the main Privacy Policy and provides specific information pursuant to LFPDPPP:

• Identity and address of the data controller: GraciasGracias, Gral. Salvador Alvarado 72, Escandón I Secc, Miguel Hidalgo, 11800, Ciudad de México, CDMX, Mexico
• Primary processing purposes: Provision of platform services, account management, transaction processing, communications, legal compliance
• Secondary purposes: Marketing, product analytics, user research (you may opt out)
• Sensitive personal data: We do not regularly collect sensitive data
• Transfers: We share data with service providers primarily in the United States
• ARCO rights: You may exercise your rights by contacting support@graciasgracias.live
• Notice changes: We will notify material changes by email and platform notice

16.2 GDPR-Specific Disclosures (EU Users)

• Data controller identity: GraciasGracias
• Data protection officer: Not currently appointed (not required for our scale; reviewed periodically)
• Lawful basis details: See Section 3.2
• Recipient categories: See Section 4
• Third country transfers: Standard Contractual Clauses where applicable
• Retention details: See Section 6
• Source of data: Directly from you and from third parties as described
• Automated decision-making: See Section 10
• Right to lodge complaint: Contact your national supervisory authority

16.3 CCPA-Specific Disclosures (California Users)

Categories of personal information collected (per CCPA categories):

• Identifiers (name, email, IP address, account identifiers)
• Customer records (transactions, communications)
• Commercial information (purchases, listings)
• Internet activity (usage, interactions)
• Geolocation data (approximate location)
• User content (posts, messages)
• Inferences (preferences, characteristics)

We do not sell personal information for monetary consideration. Disclosure for business purposes is covered in Section 4.

End of Privacy Policy.