Privacy Notice

1. Data Controller

The party responsible for processing your personal data is veriko.mx ("Veriko", "we", "us"), with registered tax address at [registered tax address], [city, state], Mexico, and tax ID (RFC) [tax ID (RFC)]. For any matter relating to the protection of your personal data you may contact us at privacidad@veriko.mx.

2. Personal Data We Process

We process the following data depending on how you use the service: account data (name and email); payment receipts you upload and the data extracted from them (which may include amounts, dates, tracking keys or numeric references, and masked or partial beneficiary accounts such as CLABE, card or phone number); validation records; API keys; and technical and usage data (IP address, timestamps and activity logs, including a log of the requests the platform receives, with credentials hidden and, when a request is very large, its content summarized). Billing data is processed through Stripe, as described below.

If you request a legal document in the Trust center of this site, with or without an account, we also process your name, email, company and job title; the reason for your request and, when the document requires it, your RFC, corporate name and legal representative; the language you chose; the reference number, status and dates of the request; your full IP address and your browser data, which are recorded with each action you take in the Trust center; and usage counters tied to a fingerprint (hash) of your IP address and your email, which we use to limit abuse. If you sign a document with a button, we also process the date and time of the signature and the fingerprint (hash) of the signed file. If a document is sent to you or you are given access to it, we process the record of that delivery and of that access, including use of your download link.

If you write to us through the contact form, we process your name, your email, your company (if you provide it), the reason you choose, your message, the language of the page, your browser data, a fingerprint (hash) of your IP address, which we use to limit abuse, and the result of the form's anti-abuse check. Your message reaches our team by email; we also alert the team through messaging with your name, the reason and an excerpt of the message.

When you request a document without signing in or write to us through the contact form, an anti-abuse check verifies that the form is not being submitted by an automated program. For that purpose, the site-protection provider receives your IP address, technical data about your connection and your browser, and the token the check generates.

We do not intentionally request sensitive personal data. Please do not include information that is not necessary to verify a SPEI transfer.

When you accept this Privacy Notice and the Terms of Service, whether when you create your account or when we ask you to accept a new version, we record as evidence of your acceptance your name and email, the date and time, the version accepted, the language in which you read it, the fingerprint (hash) of the document, your full IP address and your browser data. Acceptances recorded before this version of the Notice was published keep only your name, your email, the date and the version. If you give us a document signed by hand, our team records the file you send us and, with it, the name of the signer, the corporate name and the representative, the date of the signature, any internal notes the team adds, the fingerprint (hash) of the file, and who recorded it and when. From each acceptance or signature we can generate a PDF receipt with this data, which you can download from your session and which our team can download to handle a clarification; the receipt is generated when it is requested and is not stored, but a record is kept of who downloaded it and when, with the IP address and browser from which it was requested.

3. Purposes of Processing

Primary purposes (necessary to provide the service): verifying that a SPEI transfer is real by querying Banxico's CEP; creating and managing your account; processing and authenticating API use; handling billing and invoicing; providing support; maintaining the security of the service; and complying with applicable legal obligations.

Additional primary purposes (necessary to serve anyone who requests, signs or accepts a legal document, with or without an account): handling your request for legal documents, which includes confirming your email, informing you of the status and outcome of the request and notifying our team of it; collecting the button signature of documents such as the mutual confidentiality agreement and keeping, as evidence of the signature, your name, email, company and job title, the full IP address, the browser, the date and time and the fingerprint of the signed file; recording your acceptance of this Notice and of the Terms with that same evidence and keeping it as proof of your consent; recording the documents you give us signed by hand and generating the receipt of an acceptance or a signature; notifying you by email and in the application, with a summary of what changed, of the update of a document you accepted, signed or have access to, and asking you to accept a new version when the change requires it; sending you documents with a personalized watermark (your name, email, reference number and date), or giving you temporary access to them through a link, and keeping a record of that access; and protecting the request form against abuse.

Secondary purposes (not necessary, requiring your consent and which you may decline without affecting the service): sending communications about new features, satisfaction surveys and product improvements. If you do not want us to process your data for these purposes, you may state so at any time at privacidad@veriko.mx.

4. Handling of Receipts and Images

When you upload a receipt (accepted formats JPEG, PNG, WebP or PDF), the file is checked before processing. Metadata (including EXIF information) is stripped from an image. A PDF is kept as uploaded, with its metadata, and is rejected if it contains active or hidden content, such as code, attached files or hidden layers. An automated text recognition (OCR) step then extracts the data needed to perform the validation; if the PDF is a Banxico CEP, the data is read directly from its text.

Alternatively, you may enter the data directly (date, amount, tracking key or numeric reference, and beneficiary account) without uploading any receipt. The extracted or entered data is used to query Banxico's CEP, issue the validation verdict and improve the accuracy of the service.

When a validation comes back valid, we keep internally the accounts involved in the operation and the institution they belong to, in order to improve the accuracy of later validations. We are currently working to reduce this information to what is strictly necessary and to stop keeping third-party data.

5. Transfers and Data Processors

To provide the service we share some of your data with third parties. We distinguish between transfers, where the recipient decides on its own how to treat the data, and disclosures to data processors, who treat it solely on our behalf and under our instructions.

Some of these recipients process the data outside Mexico. Disclosures are made under contracts or clauses requiring the processor to treat the data solely as we instruct, to maintain confidentiality and security measures, and to delete it once the service concludes. When the recipient is located outside Mexico, the transfer or disclosure is international; by engaging the service you are aware of it and, where the law requires consent, you grant it.

Veriko does not use the data provided for purposes other than those set out in this notice. We do not share your data with third parties without your consent, save for the cases set out in Article 36 of the LFPDPPP (including, among others, requests by competent authorities or compliance with legal obligations).

6. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described, while your account is active and for the periods required by applicable legal, tax or contractual provisions. Once those purposes have been fulfilled and those periods have expired, we delete your data. Data that a law requires us to keep is used only to comply with that obligation.

Uploaded receipts (image or PDF) are kept, for as long as your account exists, for five years (1,825 days) from the date they are uploaded, under the obligation to retain supporting documentation set out in Article 30 of Mexico's Federal Fiscal Code. After that period, we delete them, whether or not they are associated with an active validation; validation records (the verdict, without the receipt) may be kept separately as evidence of the result. If you delete your account, your receipts are deleted with it even if the five years have not elapsed, as explained in the "Account Deletion" section.

When you validate a receipt through the API, you may ask us not to keep it: we delete it when the validation ends and nothing else needs it, and we keep the extracted data and the result. You may also request the permanent deletion of a validation: its content is deleted and only a minimal record is kept, with the verdict, the dates and the amount, so that your usage and your financial reports remain consistent with what was charged.

The following periods apply to requests for legal documents, to signatures and to the acceptance of this Notice and of the Terms; when they end, the data is deleted automatically:

• Unconfirmed request: if you do not confirm your email, the request and any signatures that accompany it are deleted after 48 hours.
• Request from someone without an account: two years from the last interaction, that is, from when you confirm your email, receive a decision or an email from Veriko, use a download link or withdraw the request.
• Request from someone with an account: for as long as the account exists; it is deleted with it.
• Granted access: for someone without an account, two years from when it expires or is revoked (an access without an expiry date is kept for as long as it remains in force); for someone with an account, for as long as the account exists.
• Delivery and download-link records: the period of the request or access they belong to. Links are deleted with their access or two years after they expire, and manual deliveries to an email without an account, two years after delivery.
• Watermarked documents: they are deleted when their download link expires or, if they were sent as an attachment, 30 days after delivery.
• Activity record of requests, signatures and links: when the period of the request or signature ends, it is kept without email, IP address, browser or details.
• File of a handwritten signature: it is deleted together with the signature it belongs to.
• Acceptance of this Notice and of the Terms: for as long as the account exists and, once it is deleted, for the period that applies to confirmed signatures, as stated below.
• Change notices sent to your email: the record of their delivery is kept for as long as the account exists and is deleted with it.
• Counters used to limit abuse: they are deleted when their window ends, which lasts one hour or one day.

Confirmed signatures, by button or by hand, and the acceptance of this Notice and of the Terms are kept for the term of the signed or accepted document, including the obligations that survive its termination, and ten more years, which is the ordinary limitation period for commercial matters; they are then deleted automatically. If the document does not state a term, it ends when the relationship with the person who signed or accepted ends: with an account, when the account is deleted; without an account, when there is no longer an account with their email, no access in force and no open request. This Notice and the Terms do not state a term, so their acceptance is kept for ten years from the moment the account is deleted. These signatures and acceptances are not deleted at the end of the two-year period that applies to requests or when the account is deleted: in that case they lose their link to the account and keep the name and email of the person who signed or accepted. The file of a handwritten signature is deleted together with it.

When you delete your account, the following data is not deleted, each for the reason indicated:

• Billing records (payment receipts, refunds and credits), which keep the Stripe customer identifier but not the link to your account, for tax and accounting obligations.
• Security and request records of the platform, for the security of the service and its audit; they are no longer linked to an account, but may keep technical data such as the IP address.
• A record that the deletion took place, with its date, a random internal identifier and figures, without your name, email or phone number.
• The internal bank account catalog described in the "Handling of Receipts and Images" section, except what your account's validations contributed, which is deleted with it. What is kept does not store your name and is not linked to your account.
• Messages you sent through the contact form or by email, to answer them and keep the support history.
• Confirmed signatures, by button or by hand, for the period indicated in this section.
• The record of your acceptance of this Notice and of the Terms (the date, the version and, for new acceptances, the language, the IP address, the browser and the fingerprint of the document), which loses its link to the account and keeps your name and email, for the period indicated in this section.

Each of these data is used only for the stated purpose and is deleted automatically when its period expires: billing records, at the end of the retention period set by Article 30 of Mexico's Federal Fiscal Code; security and request logs, after 12 months; contact messages, two years after the last message. Signatures and the acceptance of this Notice and of the Terms follow the period already stated. The record of the deletion contains no data that identifies you and is kept with no time limit.

Backups of the database and of uploaded files are kept for up to 31 days. Whatever is deleted also disappears from them when that period ends.

7. Account Deletion

You may delete your account at any time from your profile in the application. If you cannot sign in, you may request the cancellation of your data as set out in the "ARCO Rights" section. Once you confirm the deletion, the account is deactivated immediately: your sessions are closed, your API key stops working and you can no longer sign in, but your data is not yet deleted.

During the following 30 days, which are the grace period, your data is kept, your email remains linked to the account and you may restore it from the link in the two notices we send you by email, one seven days and the other one day before the permanent deletion, or by writing to privacidad@veriko.mx.

Once the grace period has ended, an automated process that runs once a day deletes the account and the data associated with it: your profile and credentials; your validations, with the receipts you uploaded and the official receipts stored; your saved beneficiaries and the imports you made; your webhooks and their delivery history; your notifications and the links to messaging channels; your sessions, recognized devices and sign-in identities; your usage history and the origin of your sign-up; and your requests for legal documents, accesses and deliveries. The deletion is permanent: once it has been completed, we do not restore accounts. If you need to keep your receipts, download them before deleting the account.

When you request the deletion, the cancellation of your paid subscription in Stripe is scheduled for the end of the period already paid, so that it is not renewed or charged again. If you restore the account within the grace period, the cancellation is reversed. Before the permanent deletion, any subscription that is still active is canceled immediately; if Stripe has not confirmed the cancellation, the permanent deletion is delayed until it does. Stripe keeps billing data on its own, under its own privacy notice.

The data that is not deleted with the account, and for how long, is described in the "Data Retention" section.

8. ARCO Rights

You have the right to Access your personal data, Rectify it when inaccurate, Cancel it when you consider it is no longer needed for the stated purposes, and Object to its processing (ARCO rights), as well as to withdraw your consent and to limit the use or disclosure of your data.

To exercise these rights, send your request to privacidad@veriko.mx, stating your name, the means to communicate our response, documents proving your identity or legal representation, and a clear description of the data and the right you wish to exercise. We will respond within the time frames set by the LFPDPPP. If you do not receive a satisfactory response, you may file a data protection request with Mexico's Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), under Article 40 of the LFPDPPP.

9. Use of Cookies and Similar Technologies

We use necessary cookies to maintain your session, protect it against fraud and unauthorized access, and remember your language preference. These cookies do not require your consent because they are indispensable for the site to function. In forms that include an anti-abuse check, the site-protection provider that runs it may also store cookies or data in your browser's local storage; they serve to tell people apart from automated programs and are indispensable for that check.

We use analytics cookies to measure the service's performance and improve the browsing experience, including a first-party cookie that keeps for 30 days where you arrived from, so we know which channel led to your sign-up. In the browser of the people on our team, we also use a second first-party cookie, lasting 400 days, to set that internal use apart in reports without excluding it from them. You can object through your browser settings or the opt-out tools offered by the analytics provider.

We use Microsoft Clarity cookies (_clck, one year, and _clsk, one day) and Microsoft's MUID cookie to generate heatmaps and session recordings. Microsoft may use this information for its own purposes, including advertising. If you disagree, you can object by writing to privacidad@veriko.mx or by blocking these cookies in your browser. From the European Economic Area, the United Kingdom or Switzerland, Clarity does not set these cookies or record the session without your explicit consent.

You can manage or disable cookies through your browser settings; please note that disabling certain cookies may affect how the service works.

10. Changes to this Privacy Notice

We may amend this Privacy Notice to reflect legal, regulatory or operational changes in our practices. We will publish the current version on this site and indicate the last updated date.

We recommend reviewing this Notice periodically. Where changes are material, we will endeavor to notify you by email and in the application, with a summary of what changed, and we will ask you to accept the new version when the change requires it.

11. Contact

If you have questions about this Privacy Notice or about the processing of your personal data, write to us at privacidad@veriko.mx.

Controller: veriko.mx, [registered tax address], [city, state], Mexico.