1. Data controller
The controller of your personal data is Magos Esenciales (operator of aromAI), with registered address at Calle de la Hera 34, Barrio San Martín, Tepotzotlán, Estado de México, C.P. 54605, México. Contact for any privacy matter and to exercise your rights: osvaldho@magosesenciales.com.
2. What data we collect
- Account data: name, email address, phone/WhatsApp (optional), country, and password or sign-in method.
- Wellness data you choose to share:what you write in the platform's conversations (for example, during an aromatic Experience), your aromatic preferences, and the resulting personalized content (such as your Note and its formula). This data may reflect your emotional state; we treat it with special care and only to provide you the service.
- Payment data: processed by Stripe; we only receive payment references (never your full card number).
- Technical data: IP address (used, among other things, to determine your country and apply the corresponding legal conditions), device type, and platform usage data.
3. How we use your data
- To provide the service: generate your personalized content, manage your account and subscriptions.
- To process your texts with artificial intelligence providers to generate personalized interpretations and messages. Your data is not used to trainthose providers' models.
- To send you service-related communications (confirmations, your Note, follow-ups after an Experience) by email or WhatsApp, according to the contact details you provided.
- To comply with legal obligations, prevent fraud, and protect the security of the platform.
You can object to follow-up communications at any time by replying to them or writing to the contact email; opting out does not affect your access to the platform.
4. Who we share data with
We do not sell your personal data. We share it only with:
- Providers that operate the platform: hosting and infrastructure (Vercel), database and authentication (Supabase), payments (Stripe), AI model providers to generate content, and a communications platform (GoHighLevel) to send emails and WhatsApp messages. All act under contract as data processors.
- The distributor who facilitates your Experience: if you take part in an aromatic Experience, the host distributor sees your name, contact details, and the content generated at their event, so they can follow up with you. The distributor is required to use that data only for that purpose.
- Authorities: when a legal obligation requires it.
Some providers process data outside your country (mainly in the United States). When that happens, we rely on the transfer mechanisms recognized by the applicable law.
5. How long we keep your data
We keep your data while your account is active and for the periods required by law afterwards (for example, tax obligations on billing data). If you close your account, we delete or anonymize your personal data within a reasonable time, except for data we must retain by law.
6. Your rights
You have the right to access, rectify, cancel, and object to the processing of your data (ARCO rights under the LFPDPPP in Mexico), as well as to request its portability or deletion where the law provides for it. To exercise them, write to osvaldho@magosesenciales.com from the email associated with your account, stating which right you wish to exercise. We will respond within the timeframes set by applicable law. If you believe we did not address your request, you may contact the data protection authority of your country.
7. Security
We apply technical and organizational measures to protect your data: encryption in transit, per-user access control at the database level, and isolation of each distributor's and participant's data. No system is infallible; if a breach affecting your data occurs, we will notify you in accordance with applicable law.
8. Country annexes
These additional conditions apply to users in the following countries and prevail over the general body of this policy where they are more protective for you.
United States (US) Annex
We do not sell or "share" (within the meaning of state privacy laws such as California's CCPA/CPRA) your personal data for targeted advertising purposes. You can exercise your rights of access, correction, and deletion by writing to the contact email; we will not discriminate against you for exercising them. If you are a resident of a state with its own privacy law, you may appeal a denial by replying to the same email.
Brazil (BR) Annex
We process your data in accordance with the Lei Geral de Proteção de Dados (LGPD). The legal bases we use are performance of the contract (providing you the service), your consent (follow-up communications and wellness data you choose to share), and legitimate interest (platform security). In addition to the rights in section 6, you have the right to confirm the existence of processing, to the anonymization or blocking of unnecessary data, and to information about who we share your data with. You may file complaints with the ANPD.
Canada (CA) Annex
We process your data in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws (including Quebec's Law 25). Your acceptance of this policy constitutes your express consent to the processing described, including the processing of your data outside Canada (mainly in the United States and Mexico), where it may be subject to the laws of those jurisdictions. You may withdraw your consent at any time (which may prevent us from continuing to provide you the service), request access to and correction of your data, and file complaints with the Office of the Privacy Commissioner of Canada (OPC) or the corresponding provincial authority. Our privacy officer is Osvaldo Osornio Landeros, reachable at the email indicated in section 1.
9. Changes to this policy
If we change this policy materially, we will notify you within the platform and, where the law requires it, ask you to accept again. The current version and its date appear at the top of the document.