Privacy Policy

Last updated: November 9, 2026 · Version 1.0

1. Who we are

Gabriel Villegas Quirós, an individual doing business as Trust Code MX ("Trust Code," "we," "us"), located at Privada Lago 26, Colonia Américas Unidas, Alcaldía Benito Juárez, 03610 Mexico City, Mexico, is responsible for the personal information described in this policy. We follow Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, in force since March 21, 2025) and the U.S. rules that apply to our emails and text messages.

Privacy contact: privacidad@trustcodemx.com
Person responsible for privacy requests: Gabriel Villegas

This policy covers trustcodemx.com (in English and Spanish), our forms, email (sent from trustcodemx.com or trustcode-mx.com), calls, video calls, text messages and WhatsApp, and any business relationship with us. It does not cover third-party websites we link to.

2. Information we collect

Identity and contact: name, company, job title, email, phone number (including mobile), country, city and preferred language.
Project information: the tools your team uses, team size, processes, needs, estimated budget, and anything you share in forms, calls or emails.
Billing (clients): name or legal entity, tax ID, billing address and billing email. We never collect card numbers or bank passwords; payments are processed by your bank or the payment platform you choose.
Browsing: IP address, approximate location based on IP, device and browser type, pages visited, clicks, scrolling, referring site and cookie identifiers (see section 9).
Communications: the content of emails, text messages and WhatsApp messages, and recordings or transcripts of video calls. We always tell you before recording, and you can ask us not to record.
Business contact information published online: for business-to-business outreach, the name, company, title, work email and phone, website and professional profiles that a person or their company published (company websites, industry directories and rankings, professional profiles and communities).

Sensitive information: we do not ask for it (for example health, ethnic origin, beliefs, political opinions, sexual orientation or biometric data). Please do not send it; if we receive it without asking, we delete it.

Financial information: we only process clients' billing information, to invoice and collect payment for what you hired us to do. Because it is needed for that relationship, it does not require your express consent (Articles 7 and 9, section IV, of the LFPDPPP).

Information about other people: if you share someone else's information with us (for example, your team's), you confirm that you informed them and are allowed to share it.

3. How we use your information

Primary purposes, needed for the relationship you ask for:

Respond to your requests for information, quotes, audits or assessments.
Schedule, hold and follow up on calls and meetings, and send confirmations and reminders.
Prepare proposals, and enter into and perform implementation, training and support contracts.
Invoice, collect payment and meet tax and legal obligations.
Support you and tell you about relevant changes to our services.
Protect our website and systems against spam, fraud and abuse.
Send you text messages (SMS) about your request, only if you gave your express consent (see section 6).

Secondary purposes, not needed for the service:

Send you content, workshop invitations and Trust Code news by email.
Contact you for the first time for business purposes when we obtained your business contact information from what you or your company published.
Measure and improve our website, campaigns and services with analytics and advertising cookies.
Ask you for a review or testimonial. We only publish your name, logo or testimonial with your express permission.

You can opt out of secondary purposes at any time: email privacidad@trustcodemx.com, use the unsubscribe link in any email, or change your cookie preferences. Opting out does not affect the primary purposes or our service.

Which purposes require consent.

Primary 1 to 6: they are needed for the relationship you ask for or to comply with the law (Article 9, sections I and IV, of the LFPDPPP). Otherwise, they rely on your implied consent when you give us your information with this policy available to you.
Primary 7 (text messages): requires your express consent.
Secondary 1, 3 and 4: rely on your consent, which you can refuse or withdraw at any time. Analytics and advertising cookies are only activated if you accept them.
Secondary 2: when we obtain your business contact information indirectly, we share this policy in our first message, which includes a way to stop receiving messages. If you do not object, we will consider that you agree to this use (implied consent, Article 7 of the LFPDPPP).

4. Artificial intelligence and automated processing

We use AI-powered tools, such as monday.com agents and Anthropic's Claude assistant, to organize requests, summarize meetings, research companies using public information and draft replies. We also use automated processes to schedule and follow up on business emails.

These processes do not make decisions that produce legal effects or significantly affect you; a person makes the decisions on proposals, pricing and contracts. You can object to automated processing as explained in section 8.

We do not sell or rent your personal information, and we do not share it with third parties for their own marketing.

Service providers that process information on our behalf. They receive only what they need to provide their service, under their confidentiality and security terms:

Provider	What we use it for
Google	Email, calendar and documents (Workspace); Analytics, Tag Manager, Ads and Search Console
monday.com	CRM, forms, AI agents and meeting notes
Make	Automation between tools
Quo	Phone calls and text messages
Microsoft	Clarity (usage analytics) and Bing Webmaster Tools
Cloudflare	Turnstile (bot protection on forms)
Hostinger	Website hosting
Anthropic	AI assistant
Meta	WhatsApp (messaging)

Several of these providers store information outside Mexico, mainly in the United States, and we require them, through their terms of service, to apply appropriate security and confidentiality measures.

Transfers to third parties. We only share your information with third parties that process it on their own behalf in these cases, which do not require your consent (Article 36 of the LFPDPPP):

Banks and payment or hiring platforms (such as PayPal, Fiverr or Upwork), when you pay or hire us through them, because it is needed for our relationship with you (sections IV and VII). Their own privacy policies also apply.
Authorities, when a law or court order requires it (sections I and V).

If our business is ever merged, sold or transferred, your information may be transferred to the new owner, who will be bound by this policy. If you do not want your information transferred in that case, tell us at privacidad@trustcodemx.com; if you do not object, we will consider that you agree.

Mobile information and text messaging consent. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. We do not share, sell or provide your mobile phone number or your text messaging consent to third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service (for example, our phone provider), is permitted. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. We also do not upload your phone number to advertising platforms.

6. Text messages (SMS)

If you check the consent box on one of our forms or ask us directly, the Trust Code MX program will send you informational text messages about your request: meeting confirmations and reminders, answers to your questions, and follow-ups on proposals or projects. We do not send promotional text messages.

Message frequency varies based on your request.
Message and data rates may apply.
Reply STOP to opt out and HELP for help. We also accept QUIT, END, REVOKE, OPT OUT, CANCEL, UNSUBSCRIBE and any other reasonable opt-out request, in any language, and apply it within 10 business days at most.
Consent is not a condition of purchase.
Program details are in our SMS Terms.

7. How long we keep your information

Type of information	Retention period
Requests that do not become a project	Up to 24 months after our last contact
Clients	During the relationship, then as long as tax and commercial laws require, generally 5 years
Business contacts obtained indirectly	Up to 24 months after we obtained them, or until you ask us to stop contacting you
Do-not-contact list	As long as needed so we never contact you again
SMS and email consent records	Up to 5 years after you opt out, so we can prove consent
Meeting recordings and transcripts	Up to 12 months after the conversation or project ends
Browsing data	Per each tool; 14 months in Google Analytics

When a period ends, we block the information for as long as the law requires and then securely delete it.

8. Your rights and choices

You can ask us to access, correct or delete your information, and you can object to its use, including automated processing (known in Mexico as ARCO rights). You can also withdraw your consent at any time, without retroactive effect; in some cases this may prevent us from continuing to serve you.

How to make a request. Email privacidad@trustcodemx.com with the subject "Privacy request" and include:

Your name and how you want to receive our answer.
A document that proves your identity or, if you act for someone else, your authority to do so.
A clear description of the information and the right you want to exercise.
For corrections, the changes you request and documents that support them.
Anything else that helps us find your information.

Timing. We answer within 20 business days of receiving your request. If it applies, we carry it out within the next 15 business days. Either period may be extended once, for the same length, when justified; we will tell you beforehand. Requests are free; we may only charge justified costs of copying or delivery.

Limiting how we use your information. You can ask to be added to our do-not-contact list, unsubscribe from any email, reply STOP to our text messages and change your cookie preferences. If you are in Mexico, you can also register with PROFECO's Public Registry to Avoid Advertising (REPEP).

If you disagree. If you disagree with our answer, you can file a data protection request with Mexico's Secretaría Anticorrupción y Buen Gobierno within 15 business days after we send it. If we do not answer in time, you can file it once our deadline has passed (Article 40 of the LFPDPPP).

If you live outside Mexico. In the United States, we honor requests to access, correct and delete your information and to opt out of marketing, through the same channel. Elsewhere in Latin America, we honor the rights your country's data protection law gives you, and you may contact its authority (for example, Colombia's Superintendencia de Industria y Comercio or Argentina's Agencia de Acceso a la Información Pública). We will not treat you differently for exercising your rights.

9. Cookies and tracking technologies

We use three kinds of cookies and similar technologies:

Essential: make the website work, remember your language and cookie choices, and protect us against bots (Cloudflare Turnstile). They cannot be turned off on the site.
Analytics: Google Analytics and Microsoft Clarity show us how the site is used, through behavioral metrics, heatmaps and session replay. Clarity masks the content of form fields.
Advertising and conversions: Google Ads measures which ads lead to requests and may show you Trust Code ads based on your previous visits.

Analytics and advertising cookies are only activated if you accept them in the site's cookie notice. You can change your choice at any time in that notice or in your browser.

These providers may collect information about your online activities over time and across different websites. More information and choices:

Our website does not respond to browser "Do Not Track" signals. Where applicable law requires it, we treat the Global Privacy Control signal as a request to opt out of advertising cookies.

10. Security

We use administrative, technical and physical safeguards: access limited to those who need it, two-step verification on our accounts, encrypted connections (HTTPS) and providers with recognized security practices. No system is perfectly secure. If a breach significantly affects your financial or personal rights, we will tell you immediately what happened and what we did about it.

11. Children

Our services are for businesses and professionals 18 or older. We do not knowingly collect information from minors; if we learn we have, we delete it.

12. Information we process for our clients

When we implement or support a system for your company, such as your monday.com account, we may access personal information about your customers, employees or vendors. In that case we act as a processor: we use that information only to perform the contract and follow your instructions, keep it confidential, never use it for our own purposes, and return or delete it when the work ends. Your company remains responsible for that information.

13. Changes to this policy

We will post any change on this page with a new "last updated" date. If a change is material, such as a new purpose or a new transfer, we will email you before it takes effect and, where the law requires, ask for your consent again.

By giving us your information after this policy was made available to you, you consent to its use for the primary purposes. You can opt out of secondary purposes as described in section 3. Text messages always require your express consent.

15. Contact, language and authority

For any question about this policy, email privacidad@trustcodemx.com or write to our address above. This policy is published in English and Spanish with the same content; if there is any difference, the Spanish version prevails. Mexico's data protection authority is the Secretaría Anticorrupción y Buen Gobierno.