Privacy Notice — Tlali.app

1. Who we are and how to reach us

Tlali.app is operated by Ellery Gómez Soto, an individual with business activity (active RFC, tax regime 612), doing business as IT Smart Business, with an address in Mexico City, Mexico. We are the data controller responsible for processing your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).

2. Personal data we collect

We collect the personal data you choose to enter when using Tlali.app. Depending on which modules you use, this may include:

• Identification and contact data: name, email address, phone number.
• Billing data: RFC (Mexican tax ID), legal name, tax regime, postal code, and CFDI use — only if you request a tax invoice.
• Financial data: accounts, transactions, amounts, and the card or bank account details you enter to track your household finances. Subscription payments are processed through Stripe; Tlali.app does not store your full payment card details.
• Sensitive health data: medical, wellness, or veterinary information you choose to record for members of your household or your pets.
• Data about minors or dependents: if you enter information about children, dependents, or pets in your care, you represent that you have the consent or legal authority to do so.
• Platform usage data: technical session information (IP address, device type) needed to operate and secure the service.

You decide what goes into the system. Tlali.app does not require you to enter data you would rather not record; every module is optional and used at your discretion.

3. Why we process your data

Primary purposes (required to deliver the service):

• Create and manage your account and those of your household members.
• Process your subscription payment and, where applicable, issue your tax invoice (CFDI).
• Operate the modules you choose to use.
• Provide technical support and respond to your requests.
• Send you operational notifications about your account.

Secondary purposes (optional):

• Send you updates about new product features, unless you opt out.

You may opt out of secondary purposes at any time without affecting your use of the service, following the procedure in Section 6.

4. Sensitive personal data — express consent

Because Tlali.app processes financial data, health data, and potentially data about minors — categories treated as sensitive under Article 3, section VI of the LFPDPPP — your registration and continued use of these modules constitutes your express consent to process that data, solely for the purposes described in this notice.

5. Sharing and transfer of personal data

Tlali.app and IT Smart Business do not share, sell, rent, or transfer your personal data to third parties under any circumstances — including for third-party advertising or marketing.

Your data is processed only by service providers strictly necessary to run the platform: payment processing through Stripe, hosting and database infrastructure, and tax invoice issuance through our authorized certification provider (PAC). These providers act as data processors under contractual confidentiality obligations. They are not third parties entitled to use your data for their own purposes.

6. Your ARCO rights and how to exercise them

Under Mexican law you have the right to Access, Rectify, Cancel, or Object to the processing of your personal data — known collectively as ARCO rights — and to withdraw your consent at any time.

To exercise these rights, send your request to ARCO@tlali.app and include:

• Your full name and the email address associated with your account.
• A clear description of the right you wish to exercise.
• A document verifying your identity.

We will respond within the timeframes set by the LFPDPPP.

7. Cookies and tracking technologies

Tlali.app uses only cookies that are strictly necessary for the site and platform to function: session cookies that keep you securely signed in. We do not use analytics, advertising, or third-party tracking cookies. If this ever changes, we will update this notice before implementing any additional technology.

8. Changes to this notice

Any change to this privacy notice will be published on this page, along with the date it was last updated.