Privacy Notice (Mexico)

1. Controller responsible for processing your personal data

Apolaris AI (hereinafter, "Apolaris", "we" or "the platform"), provided by Apolaris AI S.L., a company established in Spain, whose registration details are APOLARIS AI S.L., Tax ID (NIF) B05659628, C/Ana Maria 33, 33209 Gijon, Asturias, Spain, acts as the controller (responsable) for your personal data and is responsible for processing it in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations and the Privacy Notice Guidelines currently in force in Mexico. The Services are offered from Spain to customers in the European Union, Mexico and other markets; this Notice sets out the protections that apply to data subjects in Mexico, which are retained in full.

For any matter relating to your personal data or to this Notice, you may contact us at the email address [email protected]. Our website is apolaris.net and we operate the subdomains app.apolaris.net (the application), portal.apolaris.net (staff portal), docs.apolaris.net (documentation) and support.apolaris.net (support).

2. Dual role: controller and processor

It is important that you distinguish the role we play depending on the type of data:

• Apolaris as controller. When you browse our marketing site apolaris.net, request commercial information, register as a customer or manage your account with us, Apolaris decides the purposes and means of the processing and therefore acts as the controller.
• Apolaris as processor. When a business customer uses the platform to manage the data of its own end customers, employees, appointments, sales or other records, that business is the controller of such data, and Apolaris processes it solely on behalf of and in accordance with the instructions of that business, in the capacity of processor. In those cases, the privacy notice applicable to the data subjects is that of the business using Apolaris, and data subjects must direct their requests to that business.

This Notice primarily describes the processing in which Apolaris acts as controller, and provides general information on how we protect the data we process as a processor.

3. Personal data we collect

Depending on your relationship with us, we may collect the following categories of personal data:

• Identification and contact data: name, job title, business name, email address, phone number and preferred language.
• Account and usage data: access credentials, account settings, activity records (audit log), IP address, device identifiers and browsing data.
• Passkey (biometric sign-in) credentials: if you enable passwordless sign-in, we store only a public-key credential and technical metadata. Your fingerprint, face or PIN is verified on your own device and is never sent to or stored by Apolaris; through this feature we do not collect biometric data (see Section 4).
• Commercial prospecting data (leads): the information you provide when requesting a demonstration, quote or commercial contact.
• Billing and payment data: metadata of payment transactions. Card processing is delegated to payment providers; Apolaris does not store full card numbers.
• Content you process on the platform (as processor): end-customer data (names, contact details, appointment and purchase history) — which may include client records created automatically from an inbound WhatsApp conversation and AI-generated notes summarizing a client's stated preferences — employee and payroll data, the content of WhatsApp and SMS messages, recordings and transcripts of telephone calls (including those handled by the AI voice agent), queries and prompts directed to the artificial intelligence features, the content of the business's public website and the enquiries of its visitors and, optionally, video-surveillance recordings and events, as well as the signed consent documents, clinical history and clinical photographs of the Consents & Clinic History module (see Section 4).

4. Sensitive personal data

As a general rule, we do not collect sensitive personal data for our purposes as a controller. However, certain content that a business customer decides to process on the platform could be sensitive in nature; in particular:

• Payroll and labor data that may include protected information.
• Images and events from security cameras with computer vision, which may include biometric data or the recognition of presence and counting of people.

Biometric sign-in is not sensitive-data collection. Signing in with a fingerprint, face or PIN (passkeys) does not involve Apolaris collecting biometric data: the biometric is verified only on your device, and we store solely a cryptographic public key. The only feature that may involve biometric data is the security-camera / computer-vision module described above, which is activated and controlled by the business customer.

The processing of this data depends on the activation of the corresponding modules by the business customer, who acts as the controller and must obtain the consents required by law. When a purpose requires sensitive data, the express consent of the data subject will be requested. In the case of video surveillance, it is the responsibility of the establishment to display on its premises the video-surveillance notice (aviso de videovigilancia) and the signage required by the applicable rules; the platform processes the footage as a processor and applies short retention periods.

4.1 Health data in the Consents & Clinic History module

When a business customer activates the optional Consents & Clinic History module, the platform processes sensitive personal health data of that business's clients: signed consent documents, clinical and treatment history, allergies, medications, treatment notes, patch tests and clinical photographs. Under the LFPDPPP, sensitive data requires the express written consent of the data subject. The signed clinical consent captured in the module — by means of an electronic signature drawn on screen, a QR code or a remote signing link, with signature evidence (IP address, device and timestamps) and a PDF sealed with a SHA-256 fingerprint — constitutes that express written consent, in accordance with Article 8 of the LFPDPPP.

The purposes of this processing are the provision and documentation of the business's services. The business using the module is the controller (responsable) of this data and APOLARIS AI S.L., Tax ID (NIF) B05659628, C/Ana Maria 33, 33209 Gijon, Asturias, Spain acts as processor (encargado), applying encryption at rest with a dedicated key, per-employee access privileges and an audit log. The procedure for exercising the ARCO rights is unchanged (see Section 9); requests concerning this data must be directed to the business acting as controller. Clinical records are retained for the periods required by NOM-004-SSA3-2012 (five years) and other applicable law, even if the data subject requests the cancellation of their account or record; in that case, the link to the client's profile is pseudonymized and the documents are deleted when the legal period expires.

5. Purposes of the processing

Your personal data is used for the following purposes.

5.1 Primary purposes (necessary for the relationship)

These purposes give rise to and are necessary for the legal relationship with you; they do not require additional consent:

• Create, configure and manage your account and provide you with access to the platform and its modules.
• Provide the contracted services, including appointment scheduling and online booking pages, point of sale and payments, inventory, human resources and payroll, CRM and loyalty program, omnichannel WhatsApp contact center, voice telephony with an AI agent (with call recording and transcription), customer-journey marketing automation (email, SMS and WhatsApp, with opt-out handling through cancellation keywords), a public website builder (on platform subdomains or custom domains, including domain purchase), push notifications, AI cameras, AI copilot, competitor analysis (map-based discovery of nearby businesses from public map data, with an AI advisor), analytics, multi-site and franchise operations and, optionally, the Consents & Clinic History module.
• Operate the AI automation builder, which lets managers create automations across any module triggered on a schedule (for example, hourly, daily, weekly or monthly) or by real-time business events (for example, a sale created, a booking cancelled or leave requested), and which delivers results through in-app notifications, email and proactive insights; any outward action (for example, emailing a customer, sending a contact-center message or invoking a webhook) is queued for manager approval before execution and is recorded in the audit log.
• Send notifications and messages by SMS through our SMS carrier, OVHcloud, including two-factor authentication codes, and provide token-authenticated access to our REST API by means of per-user tokens.
• Process payments, billing and collections.
• Provide technical support and customer service.
• Ensure the security of the platform, prevent fraud and maintain activity records.
• Comply with applicable legal, tax and contractual obligations.

5.2 Secondary purposes (require your consent)

The following purposes are not necessary for the relationship and require your consent. You may refuse it now or withdraw it at any time, without this affecting the provision of the contracted services:

• Send you commercial communications, newsletters, product updates and promotions from Apolaris.
• Conduct surveys, market studies and statistical analyses to improve our products.
• Personalize content and offers based on your usage and interests.

To refuse or withdraw your consent to these purposes, write to [email protected] stating your request.

6. Use of cookies and tracking technologies

Our site and platform use cookies and similar technologies for operation, session security, remembering preferences and, where applicable, measuring usage. The details of the cookies, their purposes and how to manage them are described in our Cookie Policy, which you may refer to for more information and to configure your preferences. Our login uses its own security mechanisms (offline arithmetic challenge, honeypot field and attempt limiting) that do not rely on CAPTCHA, CDN or third-party trackers.

7. Data transfers and remittances

To operate the platform we share data with providers that act as processors (remittances) and, where applicable, with third parties (transfers). These providers process the data solely for the indicated purposes and under confidentiality and security obligations:

Provider	Purpose
Stripe, PayPal and Mercado Pago	Payment processing
Telnyx	Voice telephony (including the AI voice agent, call recording and transcription)
WhatsApp / Meta (WhatsApp Cloud API or WAHA gateway)	WhatsApp messaging
AI infrastructure operated by or for Apolaris, currently located in Spain (self-hosted language, vision, speech-to-text and text-to-speech models)	Artificial intelligence features; personal data is not sent to third-party AI cloud services
OpenStreetMap (Nominatim and Overpass); Google Places API (optional)	Geocoding and discovery of nearby businesses for the competitor-analysis feature
Cloudflare	DNS, network, CDN, WAF/DDoS protection and secure tunnel
OVHcloud (OVH SAS, France)	Sending SMS messages (including two-factor authentication codes), transactional email, domain registration for business websites, and an EU edge server for network failover
Tailscale	Private encrypted network between our own servers (end-to-end-encrypted traffic only)
Browser push services (Google, Apple or Mozilla, depending on the user's browser)	Delivery of the encrypted push notifications users opt into

The platform is hosted on servers owned and operated by Apolaris in Spain (European Union); no public-cloud hosting provider is used. Some of these providers may process data outside Mexico. In those cases we adopt measures so that the processing maintains an adequate level of protection. The platform may operate in the cloud or be self-hosted by the business customer; when it is self-hosted, the infrastructure remains under the control of that business. We may also transfer data when required by a competent authority or a legal provision. Except in those cases, we do not transfer your data to third parties without your consent when required by law.

8. Automated decisions and artificial intelligence

The platform incorporates artificial intelligence features, including an AI agent for scheduling appointments in the WhatsApp contact center, an AI copilot, analytical suggestions and cameras with computer vision for event detection, people counting and attendance control.

• Chatbot transparency. When you interact with the WhatsApp AI agent, with the telephone voice agent or with the chatbot, you will be informed that you are conversing with an automated system and not with a person; the WhatsApp AI agent prepends a transparency notice to its first automated reply in each conversation.
• Human intervention. These features serve as support. Decisions with significant effects (for example, confirming or rejecting an appointment, applying a charge or taking labor-related measures) may be reviewed and are supervised by a person from the business. Outward actions performed by automations (for example, emailing a customer, sending a contact-center message or invoking a webhook) are queued for manager approval before they are executed. You have the right to request human intervention, to express your point of view and to challenge a decision based solely on automated processing.
• Biometric or detection features. When a business activates camera capabilities that may involve the biometric or behavioral recognition of people, this will be disclosed in accordance with applicable transparency requirements, and its use is subject to the consents required by law.

9. Means to exercise your ARCO rights

You have the right to Access your personal data, to Rectify it when it is inaccurate or incomplete, to Cancel it when you consider it is not required for any of the purposes, and to Object to its processing for specific purposes (ARCO rights). You may also revoke the consent granted.

To exercise these rights, send your request to the email [email protected], including:

• Your name and a means by which we can communicate our response to you.
• The documents that prove your identity or, where applicable, legal representation.
• A clear description of the data in respect of which you are exercising the right and of the right you wish to exercise.
• Any element that facilitates the location of the data.

We will respond to your request within the time periods established by the LFPDPPP. If the data in respect of which you wish to exercise a right was captured by a business customer that uses the platform, we will guide you to direct your request to the corresponding controller, since in those cases Apolaris acts as a processor.

10. Security measures

We apply administrative, technical and physical measures to protect your data against damage, loss, alteration, destruction or unauthorized use, access or processing, including:

• Encryption of information in transit.
• Hardened login with offline arithmetic challenge, honeypot field and limiting of failed attempts, without relying on third-party services.
• Optional two-factor authentication and passkey (biometric) sign-in, the latter verifying the biometric on the user's device and storing only a public key.
• Role-based access control with an activity log (audit log).
• Strict data isolation for each customer (multi-tenant).

11. Legal framework and additional rights

This Notice is governed by the laws of the United Mexican States. Data subjects in Mexico may turn to the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI) if they consider that their right to data protection has not been duly addressed.

Users located in the European Union or the European Economic Area retain the rights granted to them by the General Data Protection Regulation (GDPR) and the ePrivacy rules, including the right to lodge a complaint with the supervisory authority of their country or, as Apolaris is established in Spain, with the Spanish Agencia Española de Protección de Datos (AEPD). With respect to the artificial intelligence features, we observe the transparency obligations set out in Article 50 of the European Union AI Act: the WhatsApp AI agent prepends a transparency notice to its first automated reply in each conversation, and any outward action performed by an automation is queued for manager approval before it is executed.

12. Changes to the Privacy Notice

This Notice may be modified to reflect changes in our services, in legislation or in our practices. The current version will be published at apolaris.net and, when the changes are significant, we will notify you through the usual channels. The date of the last update is indicated in the document header.

Simplified Privacy Notice

Apolaris AI (APOLARIS AI S.L., Tax ID (NIF) B05659628, C/Ana Maria 33, 33209 Gijon, Asturias, Spain) processes your personal data to create and manage your account, provide the platform's services (appointments and online booking, point of sale and payments, inventory, human resources and payroll, CRM and loyalty, WhatsApp contact center with AI agent, telephony with an AI voice agent, marketing automation, website builder, AI cameras, copilot, analytics, multi-site operations and, optionally, consents and clinical history), process payments, provide support and ensure security. Health data in the Consents & Clinic History module is processed as sensitive data, with your express written consent obtained through the signature of the clinical consent; the business using the module is the controller and Apolaris acts as processor. With your consent, we also send you commercial communications and carry out improvement analyses; you may refuse it or withdraw it at any time.

We share data with payment, email and SMS, telephony, messaging, AI, network and push-notification providers, solely to operate the service. Some features use automated intelligence (including a chatbot that identifies itself as such) with the possibility of human intervention.

To exercise your ARCO rights, revoke consents or learn the details of cookies and transfers, consult the Full Privacy Notice or write to [email protected]. Data subjects in Mexico may turn to the INAI; users in the EU/EEA retain their rights under the GDPR.