Privacy Policy

Last updated: October 7, 2026

Governing language. The Spanish version of this Privacy Policy (Aviso de Privacidad) is the governing version. This English version is a courtesy translation; in the event of any discrepancy between the two, the Spanish version prevails. See also the Terms of Service and how to request data deletion.

Jonatan Efrain Castillo Gomez, an individual carrying on a business activity (persona física con actividad empresarial) who operates the Micrxn platform (hereinafter, "Micrxn" or "we"), with address at Paraguay 2129, Colonia del Sur, C.P. 44920, Guadalajara, Jalisco, Mexico, and contact email soporte@micrxn.com, is the data controller (responsable) responsible for the processing of your personal data on the terms described below, and makes this Privacy Policy (privacy notice, Aviso de Privacidad) available to you in accordance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (Federal Law on the Protection of Personal Data Held by Private Parties, "LFPDPPP"), its Regulations and other applicable law in Mexico.

Micrxn is a modular business platform (ERP) offered to companies and professionals. It brings together, among others, modules for users and roles, third parties (customers, suppliers and contacts), catalog, CRM, sales, purchasing, supplier portal, inventory, fulfillment, finance, accounting, approvals, reports, documents, conversations over messaging and email channels, sequences and bulk sends, calendar and appointments, personnel management, notifications, integrations with third-party services, and an artificial intelligence assistant and agents.

1. Our dual role: read the section that applies to you

Section A — A company that uses Micrxn processes your data

In this case, the client company is the data controller of your data: it decides what data it uploads, for what purposes and for how long, and it must make its own privacy notice available to you. Micrxn acts as data processor (encargado), that is, it processes the data solely in accordance with that company's instructions and in order to provide the service to it, without using the data for purposes of its own.

If you wish to exercise your rights over that data, please address the company that processes it, preferably. If you write to us, we will route your request to that company and let you know.

Section B — You are a user, customer, prospect or administrator of Micrxn

Here Micrxn is the data controller. This covers the data of user accounts and of organizations, sign-in, contracting and subscription status, support, commercial prospecting and visitors to our sites.

2. Data we process

2.1 Section A (data that each client company uploads or receives)

This depends on the modules each client company uses and on what it decides to record. It may include:

• Conversations: telephone number, email address or equivalent channel identifier; the profile name that the channel itself exposes; the content of messages and attachments, and their timestamps and delivery statuses.
• Third parties, CRM and commercial operations: name, email, telephone, addresses, tax data, notes, opportunities, appointments, and the commercial documents in which the person appears (quotes, orders, purchase orders, invoices, payments and collections).
• Suppliers: the contact data and documentation that the supplier or the client company records, including through the supplier portal.
• Personnel of the client company: identification and contact data, position, type and term of the employment or services relationship, training and certifications and, if the company records them, compensation and bank details.
• Documents and files that the client company uploads, with whatever content it decides.
• Content processed by artificial intelligence: the instructions, queries and responses generated within the organization (see section 6).

2.2 Section B (Micrxn users and customers)

• User account: username, email address, first and last name, profile picture and, if you provide them, telephone number and recovery email. If you use a password, we keep only its cryptographic digest (bcrypt hash), never the password in clear text.
• Sign-in with Google or Microsoft: the identifier of your account with that provider and the basic profile data detailed in section 4.
• Organization and access: name of the organization, membership in it, roles, permissions, and activity and audit logs within the platform.
• Subscription: status of the subscription and of the trial period, plan, and the customer and subscription identifiers assigned to us by the payment processor. Micrxn does not receive or store your card data; it is captured directly by the payment processor (see section 5).
• Billing data that you provide to us in order to issue tax receipts: business name or name, RFC (Mexican taxpayer identification number) and tax address.
• Support communications and their content.
• Technical data: IP address, date and time, and browser data recorded in our server logs.

2.3 Mandatory and optional data

The following are mandatory, because they are indispensable to provide the service: the channel identifier and the content of the message, in order to deliver a conversation (Section A); and the email address and the identification data of the account and of the organization (Section B). If they are not provided, it is not possible to deliver the conversation over that channel or to register the account. Billing data is needed only to issue the corresponding tax receipts.

Any additional data that you or the client company decide to record (telephone, picture, notes, custom fields) is optional. Not providing it does not prevent use of the service.

Micrxn does not request sensitive personal data (health, ethnic origin, beliefs, sexual preferences, biometric data), nor is such data necessary for the service; we ask you not to include it in messages or documents. The platform does allow each client company to record financial or asset-related data (datos patrimoniales o financieros) of third parties (for example, credit limits, compensation or bank accounts of its personnel or of its suppliers). When it does so, it is that company, as data controller, that must have the appropriate consent and legal basis.

3. Purposes

Primary purposes, necessary for the relationship:

• To create and authenticate user accounts and to manage organizations, roles and permissions.
• To provide the client company with the modules it uses: to store, display and process the information it uploads, and to deliver, classify and reply to messages over the channels it connects.
• To run the artificial intelligence functions and the automations that the client company configures.
• To manage contracting, the trial period, subscription billing and support.
• To send operational notices about the service (for example, verification codes and notifications).
• Security, prevention of abuse and fraud, and fault diagnosis.
• To comply with legal and tax obligations and with requests from authorities.

Secondary purposes, not necessary, to which you may object:

• Sending commercial communications about Micrxn to customers and prospects (Section B).

You may object to the secondary purposes at any time by writing to soporte@micrxn.com. Refusing is not grounds for denying you the services you have contracted.

We do not sell personal data, nor do we use it for third-party advertising.

4. Sign-in with Google and Microsoft

You may create your account and sign in with a username and password, or with your Google or Microsoft account. Use of these providers is optional.

4.1 Google user data

• What we request access to: only the basic profile and email address permissions (the profile and email scopes).
• What Google user data we receive (collect) and store: your Google account ID, your email address, your first name, last name and display name, and the URL of your profile picture.
• How we use it: exclusively to identify you, to create your Micrxn account or link it to an existing one with the same email address, to sign you in, and to display your name and your picture within the application.
• What we do not do: sign-in does not give us access to your Gmail mail, your contacts, your calendar or your Drive files. We do not retain the access or refresh tokens that Google issues during sign-in. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop or train artificial intelligence models.
• Who it is shared with (sharing and transfer): we do not transfer Google user data to third parties, except to the processors that host and operate the platform on our behalf (section 5), where necessary to provide the service to you, to comply with a legal obligation or a request from an authority, or with your consent.
• Limited Use: Micrxn's use of information received from Google APIs, and any transfer of that information — including to any other app — adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• How it is stored, protected, retained and deleted: Google user data is stored together with the rest of your account data, with the security measures described in section 9; it is retained for the periods set out in section 8; and you may request its deletion through the data deletion procedure.
• How to revoke access: at any time, from myaccount.google.com/permissions, by removing Micrxn's access. Revoking access prevents you from signing in with Google again, but does not by itself delete the data already stored in your Micrxn account: to delete it, follow the data deletion procedure. If your account does not have a password of its own, write to us before revoking so as not to lose access.

4.2 Microsoft user data

If you sign in with Microsoft, we request the openid, profile, email and User.Read permissions, and we receive and store the same basic data: account identifier, email address, first name, last name, display name and profile picture when available. We use it for the same purposes and subject to the same limits described for Google, and likewise we do not retain the sign-in tokens. You may revoke access from your Microsoft account settings (personal accounts: account.live.com/consent/Manage; work or school accounts: myapplications.microsoft.com).

4.3 Email integrations: a different case

Sign-in is independent of email integrations. If a client company decides to connect a Gmail or Microsoft 365 mailbox in order to send and receive messages from Micrxn, it does so with credentials that it provides itself for that mailbox; the messages in that mailbox are then processed on behalf of that company, in accordance with Section A.

5. Processors and transfers

We distinguish between processors (providers that process data on behalf of and under the instructions of Micrxn, which does not constitute a transfer) and transfers to third parties that process the data in their own right. Several of the following recipients are involved only if the client company activates the corresponding integration.

There are international transfers and disclosures to processors (remisiones), mainly to the United States, arising from the use of WhatsApp and of the technology providers indicated. By using those channels and functions you are informed of that circumstance. Where a transfer requires your consent and you do not wish to grant it, you may say so at soporte@micrxn.com; please bear in mind that this may prevent use of the corresponding channel or function.

6. Artificial intelligence

Micrxn offers functions assisted by artificial intelligence, such as an assistant that answers queries and performs actions requested in natural language, suggestion and drafting of replies, classification of conversations, summaries, document reading and semantic search.

• What is sent: the text of the instructions and queries, the content of the messages or documents being worked on, and the organization context needed to generate the response.
• Providers: text requests are sent to third-party models through OpenRouter, Inc.; document reading and semantic indexing are performed with the Gemini API of Google LLC. The specific models and providers may change; the current list is the one in section 5.
• Logging: Micrxn keeps, within the client company's organization and for audit, security and diagnostic purposes, a record of each artificial intelligence request that includes the instruction sent, the response generated, the actions performed and who originated it.
• Training: Micrxn does not use the content of conversations or documents to train models of its own. Processing by each artificial intelligence provider is governed by that provider's terms.
• Automatic reply: automatic reply to incoming messages is disabled by default. Each client company decides whether it keeps it disabled, whether the artificial intelligence only prepares drafts for a person to review, or whether it replies by itself, and on which channels, with what minimum confidence level and with what limit per conversation. No automatic reply is sent when the conversation is already assigned to a person, or when the message touches on topics such as payments, billing, legal matters or emergencies: those cases are escalated to a human.
• Human approval: actions of the assistant that the platform classifies as risky require the approval of an authorized person before they are performed.
• How to turn it off: the client company may keep automatic reply disabled, or place a conversation under human control or on pause. If you are an end user and prefer exclusively human attention, you may request it from the company you are communicating with or write to us.
• Micrxn does not, on its own account, make automated decisions that produce legal effects concerning you or significantly affect you. Responses generated by artificial intelligence may contain errors; the client company is responsible for the automations it configures and for reviewing their results.

7. Cookies and local storage

This legal notices site is static content and does not use cookies, analytics, pixels or trackers. Like any web server, it records the IP address and the date of each visit in its technical logs.

The Micrxn application uses only strictly necessary cookies and storage to keep you signed in. Without them it is not possible to authenticate:

• __Host-micrxn.sid: session cookie for sign-in and for the account console, httpOnly and Secure; it expires after 2 hours without activity.
• erp_session: ERP session cookie, signed and httpOnly; it lasts up to 24 hours.
• Browser local storage (localStorage): the session credential (token) and basic data from your profile —identifier, username, email address, organization, roles, permissions and the URL of your picture—, to keep the session and display your profile. They are deleted when you sign out or when you clear the site's data in your browser.

We do not use advertising or profiling cookies, or third-party analytics tools. The application loads typefaces from Google Fonts (see section 5). If in the future we add analytics or other technologies, we will state so here and enable the corresponding controls.

8. Retention

• Data of your user account (Section B): for as long as the account exists. The platform does not for now offer a self-service function to delete the account or the organization or to export your data: both are requested from soporte@micrxn.com and are handled manually within the time limits in section 10 (see how to request deletion).
• Data uploaded by the client company (Section A): for as long as the client company keeps its account active. Once the relationship has ended, the data is returned or deleted, at the client company's request, within the following 30 calendar days, unless the client company instructs otherwise or there is a legal duty to retain it.
• Documents and notifications: the documents module assigns each file a retention class according to its nature; for example, an accounting or tax voucher cannot be deleted from the application before its minimum period, and ephemeral attachments are subject to purging when their maximum period expires. Internal notifications expire according to their severity.
• Artificial intelligence and audit logs: for as long as the organization exists, or until their deletion is appropriate.
• Technical and security logs: up to 90 days.
• Backups: they are overwritten in cycles of up to 35 days; deleted data may persist in a backup until that cycle closes.
• Micrxn's accounting and tax documentation: 5 years, in accordance with Mexican tax law.
• Data necessary for the defense of claims: during the applicable limitation periods, in blocked status (bloqueo).

9. Security

We apply reasonable administrative, technical and physical measures: communications travel encrypted using TLS; each organization's data is isolated from that of the others by means of row-level security policies in the database; access within each organization is governed by roles and permissions; passwords are stored only as a cryptographic digest (bcrypt); integration credentials are stored encrypted with AES-256-GCM under keys that reside outside the database; the authenticity of incoming messages from the channels that allow it is verified cryptographically before they are processed; and uploaded documents are held, without being downloadable, until a malware scan declares them clean.

We want to be clear about the limits: messages and documents are not end-to-end encrypted —the platform needs to process them in order to provide the service—; for now we do not offer two-step verification or self-service password recovery (the latter is handled through support); and we do not hold security certifications issued by third parties.

No system is infallible. In the event of a security breach that significantly affects the economic or moral rights (derechos patrimoniales o morales) of data subjects, we will inform those affected without delay and, where applicable, the client company that is the data controller, so that they can take action, in accordance with the LFPDPPP.

10. ARCO rights

You may access your data, rectify it when it is inaccurate or incomplete, cancel it when you consider that it is not required for the stated purposes, and object to its processing for specific purposes (the rights of Access, Rectification, Cancellation and Objection, known in Mexico as derechos ARCO).

Procedure. Send your request to soporte@micrxn.com with the subject line "ARCO rights" ("Derechos ARCO"), including: (i) your name and a means of communicating the response to you; (ii) a copy of official identification or a document evidencing legal representation; (iii) a clear description of the data and of the right you wish to exercise; and (iv) any element that makes it easier to locate your data, such as the email address of your account or the telephone number you communicated with.

Time limits. We will communicate the decision adopted to you within a maximum of 20 business days counted from receipt of the request and, if it is granted, we will give effect to it within the 15 business days following that communication. These time limits may be extended once only, for an equal period, when the circumstances of the case justify it, informing you beforehand.

Cancellation does not always entail immediate and absolute erasure: where appropriate, your data will be cancelled, blocked or deleted as legally applicable, being kept blocked during the periods required by legal obligations or for the defense of claims, after which it is deleted.

11. Withdrawal of consent

You may at any time withdraw the consent you have given us. Send your request to soporte@micrxn.com with the subject line "Withdrawal of consent" ("Revocación de consentimiento"), stating your name, a means of contact for our reply, the document evidencing your identity and the processing operations in respect of which you are withdrawing consent. We will confirm receipt and handle the request within the same time limits indicated in section 10. The access you have granted to Micrxn from your Google or Microsoft account can also be revoked directly with those providers (see section 4).

Withdrawal does not have retroactive effect and, in certain cases, may prevent the service from continuing; we will let you know before carrying it out.

12. Limitation of use or disclosure

To limit the use or disclosure of your data, write to soporte@micrxn.com with the subject line "Limit use of data" ("Limitar uso de datos"), stating your name, a means of contact and the limitation you are requesting. If it is granted, we will enter you on our exclusion list and confirm it to you.

13. Substitution of the data controller

Micrxn is operated today by an individual carrying on a business activity and is in the process of incorporating a company. Once that company has been incorporated, it may replace the current data controller and take over the operation of the platform, together with the personal data necessary to continue providing the service and with the same obligations set out in this policy. We will notify you beforehand through the registered means of contact and will update here the identity and address of the new data controller. The purposes of the processing will not change by reason of that fact alone, and you will at all times retain the rights described in sections 10 to 12.

14. Changes to this policy

If we amend this policy, we will update the date in the heading and publish the current version at this same address. Where the change is substantial, we will endeavor to communicate it as well through the registered means of contact.

15. Authority

If you consider that your right to the protection of personal data has been infringed, you may turn to the competent authority in Mexico. Since the dissolution of the INAI, the powers relating to the protection of personal data held by private parties belong to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance).

16. Contact

Data controller: Jonatan Efrain Castillo Gomez, an individual carrying on a business activity, operator of the Micrxn platform
Address: Paraguay 2129, Colonia del Sur, C.P. 44920, Guadalajara, Jalisco, Mexico
Email: soporte@micrxn.com