Privacy Notice

1. Personal data collected

We may collect, directly or through providers, the following data:

2. Purposes of processing

Primary purposes (necessary for the service):

• Create and manage accounts and project invitations.
• Operate the Portal (quotes, documents, deliverables, tickets, legal acceptances).
• Communicate progress, proposals, and support related to the project.
• Comply with contractual, tax, and security obligations.

Secondary purposes (optional): send commercial communications about Codiva services. You may object at any time by writing to hello@codiva.dev.

3. Automated processing and AI

We may use automated or AI tools in an assistive way for internal operations (for example, drafting or classification). We do not make binding legal or contractual decisions based solely on automated means without human review when the law or context requires it.

4. Security measures

We apply reasonable security measures: authentication, per-project access control, private file storage, encryption in transit (TLS), and industry-standard providers. Client Portal access is limited to invited members and authorized Codiva staff.

5. Processors and subprocessors

Relevant providers that may process data on Codiva’s behalf to operate the service:

• Vercel - hosting and edge.
• Supabase - database, authentication, and storage.
• Resend - transactional email.
• Stripe - payments, when the project uses it.

Each provider applies its own measures. Codiva remains the controller vis-à-vis the data subject for the purposes it determines.

6. Cookies and similar technologies

We use cookies and similar technologies necessary for session, security, and preferences. You may configure your browser to block them; some Portal features may stop working.

7. Transfers

Data may be processed inside or outside Mexico by cloud and email providers that support our operations, bound by confidentiality and contractual security. We do not sell personal data.

8. ARCO rights

You may access, rectify, cancel, or object to the processing of your personal data (“ARCO rights”), and revoke consent when applicable, under the LFPDPPP.

9. ARCO procedure

• Send your request to hello@codiva.dev proving identity and clearly describing the right you wish to exercise.
• We will respond within 20 business days; if granted, it will be effected within 15 additional business days, or we will inform you of the reason for denial.

10. Revocation of consent

You may revoke consent for processing that requires it. Revocation will not affect processing necessary to perform the contractual relationship or comply with legal obligations.

11. Limitation of use or disclosure

You may register in Profeco’s Public Registry to Avoid Advertising (REPEP). To limit Codiva’s use of your data, exercise your ARCO rights or write to hello@codiva.dev.

12. Changes to this notice

We may modify this notice. Changes will be published with a new version. If the change is material, a new acceptance will be requested in the Portal or you will be notified by email.

13. Contact

• General and data-protection email: hello@codiva.dev
• Address: Goldsmith número 40, colonia Polanco III Sección, Alcaldía Miguel Hidalgo, Mexico City, postal code 11550
• Brand: Codiva.dev - custom software and digital products.