Full Privacy Notice

1. Identity and address of the data controller

Daniel Cardona Sánchez, an individual engaged in business activity (hereinafter, "Tesora"), with address at Blvd. López Mateos 3261, Int. 118, Col. El Rosario, C.P. 37125, León de los Aldama, Guanajuato, Mexico, is responsible for processing your personal data under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and the Privacy Notice Guidelines.

Contact email: contacto@tesora.mx
Website: https://tesora.mx

2. Personal data we collect

For the purposes described in this notice, Tesora may collect the following categories of personal data:

Identification and contact data

Full name, date of birth, nationality, email address, phone number, home address, marital status.

Asset and financial data

Inventory of personal property and real estate, bank and investment accounts, contracted protections, company holdings, debts and obligations, the physical location of documents and valuables, references to the existence and location of access to digital services — never collecting passwords, PINs, or keys of any kind — and the people you designate.

Family and personal relationship data

Identity of spouse, descendants, ascendants, heirs, and designated persons; family relationships and the designation of people you trust.

Images of official documents you choose to upload

The platform offers, on a strictly optional basis, to read an official document for you —voter ID card, birth certificate, or marriage certificate— in order to fill in the guided inventory fields and avoid typing errors. You do not have to use it: you can enter every field by hand and the result is identical.

If you authorize it, the image is transmitted to Anthropic PBC (United States), which processes it and returns only the extracted fields. Tesora does not store the image: it is not saved on any server, database, or log of ours, and it ceases to exist when the request ends. Anthropic retains it under its own retention policies, currently up to 30 days.

From the image we extract only the data the notarial instrument requires: name, date of birth, address, CURP, expiration date, place of birth, parents’ names, marital property regime, and spouse’s name, depending on the document. We do not extract or retain the voter key, electoral section, CIC/OCR number, signature, fingerprint, or photograph of the holder.

Data you voluntarily share during the conversation

The platform includes a conversational assistant. Everything you write in it is treated as personal data. That may include information about your health, religious or philosophical beliefs, or other information the LFPDPPP considers sensitive.

3. Purposes of processing

Primary purposes (necessary to provide the service)

1. Create and manage your account and authenticate your identity.
2. Build, organize, and safeguard your asset inventory and your succession plan.
3. Make that information available to the people you expressly designate, in the circumstances you yourself define.
4. Facilitate, when you request it, communication with the notary who will formalize the corresponding legal instruments.
5. Handle your requests, questions, and complaints.
6. Comply with applicable legal obligations.

Secondary purposes (not necessary — you may refuse)

7. Send you communications about Tesora updates, content, and services.
8. Produce internal statistics and analysis in dissociated form, meaning you cannot be identified.

To refuse the secondary purposes, write to contacto@tesora.mx stating your name and the purpose you refuse. Your refusal will not be grounds for denying you the service, nor will it affect the primary purposes.

4. Transfers of personal data

4.1 Transfer to notaries

When you request it or expressly authorize it, Tesora will transfer your personal data to the notary you designate, so that they may review, prepare, and where applicable formalize the corresponding legal instruments.

The receiving notary becomes an independent data controller with respect to the data they receive, and is subject to their own obligations under the LFPDPPP and applicable notarial law.

This transfer requires your consent and does not happen automatically.

4.2 Transfer to the people you designate

In the circumstances you expressly define within the platform (for example, your death or a certified incapacity), Tesora will make the information you designated available to the people you named.

4.3 Authorities

Tesora may transfer personal data to competent authorities when there is a duly founded and justified request, without needing your consent, under article 37 of the LFPDPPP.

5. Service providers (data processors)

Tesora uses technology infrastructure providers that process personal data on behalf of and under the instructions of Tesora. These providers act as processors, not as third-party recipients, and their servers may be located outside Mexico:

These providers are contractually bound to keep the information confidential and not to use it for their own purposes.

Retention: the information processed by the conversational assistant, as well as any document images you authorize sending, is retained by the provider for a maximum of 30 calendar days, solely for security and abuse monitoring, after which it is deleted. Your data is not used to train artificial intelligence models.

Tesora keeps no copy of those images. They are not saved on the platform, not recorded in logs, and not stored in your browser: they are transmitted, read, and discarded. The only thing that remains are the extracted text fields, which stay on your device under the rules in section 9.

6. How to exercise your ARCO rights

You have the right to Access your personal data, Rectify it when it is inaccurate, Cancel it when you consider it unnecessary, and Object to its processing for specific purposes. You may also revoke your consent at any time.

How to exercise them: send your request to contacto@tesora.mx with the following:

1. Full name and a means of sending you the response.
2. A document proving your identity (valid official ID) or, where applicable, legal representation.
3. A clear description of the data over which you are exercising the right.
4. Anything that helps locate the data.
5. In the case of rectification, documentation supporting the requested change.

Deadlines: Tesora will respond within a maximum of 20 business days from receipt of the request. If it is granted, it will take effect within the 15 business days following notice of the response. Exercising these rights is free; only justified shipping or reproduction costs, if any, must be covered.

7. Options to limit the use or disclosure of your data

In addition to your ARCO rights, you may ask contacto@tesora.mx to add you to Tesora’s internal exclusion list, to stop receiving promotional communications.

You may also register with PROFECO’s Public Consumer Registry (repep.profeco.gob.mx).

8. Security measures

Tesora has implemented administrative, technical, and physical security measures to protect your personal data against damage, loss, alteration, destruction, and unauthorized use, access, or processing, including encryption of communications and access controls on the platform.

Tesora conducts security audits of its system and documents the corresponding remediation actions.

9. Use of tracking technologies

The site tesora.mx does not use tracking, analytics, or advertising cookies, and does not employ third-party tracking technologies.

The platform uses your browser’s local storage in two cases, both inside your own device:

• a) Strictly necessary technical storage. It keeps minimal operating data —for example, the record that you accepted the Terms and this Notice, or the thread of a conversation in progress—. It does not identify you, is not shared with third parties, and is deleted when you close the tab.
• b) Optional storage of your inventory progress, subject to your express consent. When you start the guided inventory, the platform asks whether you want to keep your progress on that device so you can continue later. This storage is not necessary for the service to work: if you decline it, the tool works the same and your progress is erased when you close the tab.

If you accept option (b), the information you enter —including the data of the people you designate— stays saved in your browser, on your device. It is not transmitted to Tesora servers or to third parties, and Tesora cannot read it, recover it, or back it up. You can delete it at any time with the tool’s “Borrar todo” (Delete everything) button, or by clearing your browser’s site data. We recommend not enabling this option on shared or public computers.

The above does not apply to what you write in the conversation with the El Arquitecto de Vida assistant, which is transmitted for processing under sections 4 and 5 of this notice.

If these technologies change, this notice will be updated to describe which ones are used and how to disable them.

10. Changes to this privacy notice

Tesora reserves the right to modify this privacy notice. Any change will be published at https://tesora.mx/aviso-de-privacidad, stating the date of the last update. We recommend reviewing it periodically.

When a change is substantial, Tesora will notify you at the email address on file.

11. Competent authority

If you believe your right to personal data protection has been violated, you may turn to the guarantor authority for personal data protection in Mexico (as of the date of this notice, the Secretaría Anticorrupción y Buen Gobierno, which assumed that function after the 2025 reform).