Privacy policy

"BASIC AI" is the controller of the personal data described in this Comprehensive Privacy Notice (the "Notice"), under the Mexican Federal Law on Protection of Personal Data Held by Private Parties published in the Official Gazette of the Federation on March 20, 2025 (the "Law") and other applicable provisions.

BASIC AI has a Personal Data Department, in charge of handling data subjects’ requests and promoting the protection of personal data within the organization, which you can contact at leonardot@usebasicai.com.

For the purposes of this Notice, and without prejudice to the definitions set forth in the Law, the following terms have the meaning indicated:

• •Client: the individual or legal entity that contracts with BASIC AI for the use of the Platform or any other service.
• •Client Data: the personal data that the Client, its Users or the systems the Client integrates enter, upload, capture or generate on the Platform in connection with the service, including data about its employees, operators, customers, recipients, suppliers and end consumers.
• •Platform: BASIC AI’s software-as-a-service solutions, including Palletto, with their web and mobile applications, programming interfaces and integrations, as well as the instances delivered under the Client’s brand and domain ("white label").
• •Sites: usebasicai.com, usebasic.ai, usepalletto.com and the other domains operated by BASIC AI.
• •User: the individual to whom the Client or BASIC AI grants access credentials to the Platform.

3.1 BASIC AI as controller. This Notice governs exclusively the personal data that BASIC AI processes for its own purposes, namely that of:

• a)Clients who are individuals, as well as legal representatives, attorneys-in-fact and contacts of Clients that are legal entities;
• b)Users, solely for the administration of their accounts, Platform security, technical support and billing;
• c)Prospects and people who request information, demos or quotes; and
• d)Visitors to the Sites.

3.2 BASIC AI as processor. With respect to Client Data, the controller is the Client, who determines the purposes, means and scope of its processing. BASIC AI acts solely as processor: it processes such data on behalf of the Client, according to its instructions and to the terms of the respective contract, and does not use it for its own purposes. This includes, depending on the modules the Client contracts and configures, information on trips, routes, vehicles, operators, geolocation, personnel files, digital tax receipts (CFDI) and their supplements, including the Carta Porte, digital documents, indicators and reports.

3.3 Obligations of the Client as controller. The Client is responsible for making its own privacy notice available to data subjects; obtaining any required consent, including express consent for the processing of sensitive personal data; determining the lawfulness, relevance, accuracy and retention period of the information it enters into the Platform; and handling data subjects’ requests. The processing of Client Data is governed by the Client’s privacy notice, even when the Platform operates under its brand and domain.

3.4 Requests regarding Client Data. Data subjects who wish to exercise their rights regarding Client Data must contact the Client. If BASIC AI receives such a request, it will forward it to the corresponding Client and provide the cooperation agreed in the contract, without resolving it on its own.

BASIC AI obtains data directly from the data subject, through the Sites, the Platform, email or other means of contact, or indirectly through the Client that registers a User or appoints a representative or contact. The data categories are as follows:

Payment card data. Credit or debit card data is collected and stored directly by the payment processor (Stripe); BASIC AI does not receive or store it.

Sensitive personal data. BASIC AI does not collect or process sensitive personal data for its own purposes. Any sensitive data the Client may enter into the Platform is Client Data and is governed by section 3.

Third-party data. Anyone who provides BASIC AI with personal data of other people, such as representatives, contacts or additional Users, represents that they are authorized to do so, that the data is accurate and that they have informed the data subjects of the content of this Notice.

5.1 Primary purposes. These are necessary for the legal relationship between BASIC AI and the data subject or the Client they represent or work for, so their processing does not require consent:

• 1.Identify the Client and its representatives; prepare, execute, administer and perform software-as-a-service, software development, artificial intelligence agent, process automation and technology consulting contracts.
• 2.Create, administer and protect User accounts, including the master user and the additional Users the Client registers, as well as their roles and permissions.
• 3.Provide, implement, maintain, update and support the Platform and other contracted services.
• 4.Send operational notifications, alerts and service-related communications.
• 5.Issue tax receipts, collect and follow up on payments, renewals, suspensions and cancellations.
• 6.Ensure the security and integrity of the Platform and the Sites; prevent and detect fraud, unauthorized access and uses contrary to the Terms and Conditions; and keep audit logs.
• 7.Comply with legal, tax and contractual obligations, respond to requests from competent authorities and exercise or defend BASIC AI’s rights.
• 8.Handle requests for information, demos and quotes.

5.2 Secondary purposes. These are not necessary for the legal relationship, but allow BASIC AI to provide better service:

• 1.Send advertising, newsletters and information about products, services and events of BASIC AI and its brands.
• 2.Analyze browsing on the Sites to personalize content, offers and advertising campaigns.
• 3.Conduct satisfaction surveys and market research.

5.3 Opting out of secondary purposes. You may refuse the processing of your data for any or all of the secondary purposes:

• •Before providing your data or when creating your account
• •If your data was not obtained directly from you, within five business days after you become aware of this Notice, by emailing leonardot@usebasicai.com; and
• •At any time, by emailing leonardot@usebasicai.com with the subject "Negativa finalidades secundarias" (opt-out of secondary purposes), stating your name and the purpose concerned, or through the unsubscribe link included in every communication.

Your refusal will not be grounds to deny, suspend or condition the contracted services.

5.4 Client Data. BASIC AI does not use Client Data for its own purposes, advertising or campaigns, nor does it contact the data subjects, except when it does so on the Client’s instructions and in performance of the service.

6.1 As controller, BASIC AI only processes the approximate location derived from the IP address of Users and visitors, for security, fraud prevention and usage analysis purposes. BASIC AI does not collect the precise location of these people for its own purposes.

6.2 As processor, the Platform’s geolocation and tracking features, such as tracking of vehicles, routes, trips and operators, process location information on behalf of and on the instructions of the Client. The Client determines the activation of these features, their scope, schedules and retention period, and is responsible for informing its employees and operators about such tracking, for having the legal basis that justifies it and for limiting it to the purposes disclosed.

6.3 In the mobile applications, obtaining the device’s location depends on the permissions its user grants in the operating system, which can be withdrawn at any time from the device settings. Withdrawing these permissions may prevent location-dependent features from working.

7.1 The Platform may include features that use third-party artificial intelligence models to analyze information, generate reports and indicators, classify documents, log incidents, support staff training and, when the Client configures it, send communications. The Client decides whether to enable these features and to what extent.

7.2 The results of these features are support tools; they may contain inaccuracies and are subject to the Client’s human review. BASIC AI does not, through these features, make decisions that produce legal effects on data subjects. Decisions the Client makes based on those results are its sole responsibility.

7.3 Artificial intelligence model providers act as processors of BASIC AI, or as sub-processors in the case of Client Data, and process the information solely to generate the requested result, in accordance with their contractual terms with BASIC AI.

7.4 BASIC AI does not use personal data of its Clients, Users or third parties to train artificial intelligence models, its own or third parties’. It may use previously de-identified and aggregated information, which does not allow anyone to be identified, to improve its products and services.

8.1 Disclosures to processors. To provide its services, BASIC AI shares personal data with providers that process it on its behalf, as processors, subject to contractual confidentiality and security obligations. These disclosures are remissions (remisiones) and do not require the data subject’s consent. The processors fall into the following categories:

The updated list of processors can be requested from the Personal Data Department.

8.2 Processing outside Mexico. Some processors store or process information outside Mexican territory. These disclosures are remissions, not transfers, and BASIC AI requires these processors to comply with confidentiality and security obligations regarding the information.

8.3 Transfers without consent. BASIC AI may transfer personal data without the data subject’s consent in the cases provided for in the Law, including:

• a)To competent authorities, in compliance with a legal provision or a duly grounded and reasoned request;
• b)To holding companies, subsidiaries or affiliates under the common control of BASIC AI that operate under equivalent privacy policies;
• c)When necessary under a contract entered into or to be entered into in the interest of the data subject; and
• d)When necessary for the recognition, exercise or defense of a right in legal proceedings.

8.4 Corporate transactions. In the event of a merger, spin-off, restructuring, sale or transfer of all or part of BASIC AI’s business or assets, personal data may be transferred to the acquiring or successor entity, which will be bound to process it in accordance with this Notice. If you do not want your data to be transferred in these cases, you can say so through the procedure in section 12.

8.5 BASIC AI does not sell, rent or trade personal data.

9.1 Data processed as controller. It is kept for the duration of the legal relationship and, afterwards, for the periods required by tax, commercial and other applicable provisions, as well as the statute of limitations for actions arising from that relationship. Once those periods end, the data will be blocked and then deleted or de-identified.

9.2 Client Data. It is kept for the term of the contract. Upon termination, the Client will have thirty calendar days to export its information, unless the contract sets a different period. After that period, BASIC AI will delete or de-identify the Client Data, except for data it must keep by law.

9.3 Backup copies. Residual copies contained in backups will be deleted according to their ordinary rotation cycles; in the meantime, they will remain protected and will not be actively processed.

10.1 BASIC AI maintains reasonable administrative, technical and physical security measures, proportionate to the risk, to protect personal data against damage, loss, alteration, destruction and unauthorized use, access or processing. These include role-based access controls, encryption of information and confidentiality obligations for its staff and contractors.

10.2 No information transmission or storage system is completely invulnerable, so BASIC AI cannot guarantee absolute security. Users are responsible for the confidentiality of their credentials and of the access they grant or administer.

10.3 Security breaches. Regarding the data it processes as controller, BASIC AI will inform the data subject of breaches that significantly affect their property or moral rights, as soon as it confirms they occurred, so they can take steps to defend their rights. Regarding Client Data, BASIC AI will notify the Client, who is responsible for deciding on communication to the data subjects.

The Sites and the Platform use cookies, web beacons and similar technologies that automatically collect the technical and browsing data described in section 4, for the following purposes:

You can disable cookies in your browser settings. Disabling essential cookies may prevent the Platform from working properly.

You have the right to access your personal data; to rectify it when it is inaccurate or incomplete; to cancel it when you consider it is not required for the stated purposes; and to object to its processing for specific purposes ("ARCO rights").

To exercise them, send your request to leonardot@usebasicai.com with the following:

• 1.Name of the data subject and email address to receive the response;
• 2.Copy of the data subject’s official ID and, where applicable, of their representative’s ID and the document evidencing the representation;
• 3.Clear description of the right you wish to exercise and the data it refers to;
• 4.Any document or information that helps locate the data; and
• 5.For rectification requests, the requested changes and the supporting documentation.

BASIC AI may ask you, only once, for additional information or documentation when what was provided is insufficient or incorrect. It will respond within a maximum of twenty business days from receipt of the request and, if appropriate, will carry it out within the fifteen business days following the response. These periods may be extended once for an equal period when circumstances justify it. The response will be sent to the email address given in the request.

Exercising ARCO rights is free of charge; only justified shipping or reproduction costs may be charged. Cancellation will give rise to a blocking period prior to deletion, and BASIC AI may deny a request in whole or in part in the cases provided for in the Law, stating the reason. Requests regarding Client Data are handled according to section 3.4.

You can revoke the consent you have given or request that the use or disclosure of your data be limited through the procedure in section 12. To limit promotional communications, BASIC AI will add you to its internal exclusion list.

Revocation has no retroactive effect and does not apply to data BASIC AI must keep by law or to fulfill obligations arising from the legal relationship. If the data is necessary to provide the service, revocation may mean the termination of that relationship.

If you consider that your right to the protection of personal data has been violated, you may go to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), the competent authority under the Law.

The Sites and the Platform are intended exclusively for people over eighteen years of age. BASIC AI does not knowingly collect data from minors for its own purposes; if it detects that it has done so, it will delete it.

This Notice governs the processing BASIC AI carries out as controller. The terms of processing of Client Data are governed by the services agreement, the Terms and Conditions and, where applicable, the data processing agreement entered into with the Client, which will prevail in case of discrepancy regarding that data. This Notice does not modify the obligations agreed in those instruments.

BASIC AI may modify this Notice to address legal changes or changes in its services or privacy practices. The current version will be published at https://usebasicai.com/aviso-de-privacidad with its update date and, when changes are significant, Clients and Users will be notified by email.

If a change adds purposes that require consent, BASIC AI will obtain it before processing data for them. Merely publishing a change or continuing to use the Sites or the Platform does not imply consent to new purposes.

By providing your personal data, signing a contract with BASIC AI, creating an account or using its sites and platform, you acknowledge that you have read this Notice and consent to the processing of your data under the terms described here, including your asset and financial data.