Legal

Privacy Notice

Last updated: October 17, 2026

This Privacy Notice is issued in compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (the "Law"), its Regulations and the applicable Privacy Notice Guidelines in force in the United Mexican States. This is an English translation provided for convenience; the document is governed by Mexican law.

1. Identity and address of the Data Controller

Rodrigo Ricardo Méndez Gallegos (an individual with business activity), responsible for the piclink platform (https://piclink.mx), with Tax ID (RFC) MEGR920423JZ6 and address at Camino del Teca 580, Tlajomulco, Jalisco, México, is responsible for the processing of your personal data (the "Data Controller").

2. Personal data we collect

We collect personal data directly when you provide it, automatically when you use the Service, and through third parties that provide services to us. Depending on your interaction, we may process:

• Identification and contact data: full name, username, email address.
• Authentication data: access credentials (passwords are managed in encrypted form by our identity provider; piclink has no access to them in clear text) and third-party account identifiers when you sign in with Google.
• Billing data: when you purchase a paid plan, your payment method data is collected and processed directly by our payment processor (Stripe). piclink retains only transaction data (plan, amount, period, status), not your full card number.
• In-app purchases: if you purchase a plan in the mobile app, the charge is made by the App Store (Apple) or Google Play (Google) using the payment method you have on file with that store; piclink does not receive or keep your card details. From the store we receive a purchase identifier, the plan purchased, its status and its renewal or expiration dates, in order to activate and maintain your plan.
• Content you upload: photographs and images and their associated metadata (for example, titles, album names), which may contain the likeness of individuals.
• Usage and technical data: IP address, device and browser type, identifiers, access dates and times, pages and galleries visited, and viewing metrics.
• Notification data: if you authorize it, the subscription identifier used to send you push notifications.
• Payments feature data (Stripe Connect): if you activate charging deposits and payments to your clients, Stripe directly collects the identity, tax and banking data needed to verify your account (for example, name, tax ID (RFC), official ID, address and bank account number (CLABE)). piclink does not receive those documents; it keeps only the identifier and status of your connected account and, for each payment, the description, amount, currency, method, status, transaction identifiers and the link to the receipt issued by Stripe.
• Data of clients who pay a quote: name and email address (taken from the quote issued by the User), amount, method and status of the payment and the link to the receipt. Their card data is collected and processed directly by Stripe; piclink never sees it.
• AI Studio data: the product photo you upload to generate, the generated images, the styles and options you choose, the type of product detected by the automatic analysis and your usage (photos included in your plan, photos purchased and used, and your photo pack purchase history).
• Safety review data: when an automatic review analyzes a sample of your Content (see the "Artificial intelligence" section), we keep its result: which images were reviewed, whether any was flagged and why.
• Day of the Dead Altar data (visitors without an account): the photo you send, the name of the person you remember, the relationship and the words you choose to write, the page language and an irreversible fingerprint of your IP address (not the address itself), which we use to limit submissions and prevent abuse.
• Altar offerings (visitors without an account): what you left (a flower, a candle and similar), the phrase you chose from a list, which photo or spot of the altar it went to and the day, plus two irreversible fingerprints: one of your IP address and one of a random key your browser keeps so we can count how many people have left an offering. We do not ask for your name or any free text. Your browser also keeps, only on your device, the photos you sent to the altar and your offerings, to show them to you when you come back.
• Country and other gestures on the altar (visitors without an account): the country you connect from, which the service that protects the page derives from your IP address and which we only use to count where the offerings come from; what you choose from a list, such as what you miss about a person on the altar; and each marigold path you trace, with the same fingerprints as the offerings. None of this carries your name or free text.

3. Sensitive data and images of individuals

We do not deliberately collect sensitive personal data to operate the Service. If your Content includes data that could be considered sensitive, its processing will depend on the consent that you, as the photographer, have obtained from the relevant individuals.

The same applies to the data of your clients that you enter in quotes and to that of those who pay you through the Payments feature: you are the controller of that data with respect to your clients and piclink processes it as a processor on your behalf, except for the data Stripe processes as an independent controller (see the "Stripe Connect and the Payments feature" section).

The AI Studio is designed for photos of products, not of people. Any people who appear in the images it generates are synthetic models created by artificial intelligence and do not correspond to real people.

The photos sent to the seasonal altar may show a person who has passed away. Whoever sends them declares that they have the right to share them; a living person may appear only with their permission, and a minor only with the permission of whoever exercises parental authority or guardianship. piclink removes a photo at the request of any person depicted or their family.

4. Purposes of processing

Primary purposes (necessary for the Service)

• Create and manage your account and authenticate your access.
• Host, process (resize/optimize), organize and deliver your photographs and galleries to the people you share them with.
• Publish your public profile/portfolio when you choose to.
• Process payments, manage subscriptions and issue receipts where applicable.
• If you activate the Payments feature, enable your clients to pay you deposits and quote payments into your own Stripe account, reflect the status of each payment and send you and your client the corresponding notices (OXXO voucher, reminder, confirmation, expiry or refund).
• If you use the AI Studio, analyze the product photo you upload and generate the images you order, keep track of your included and purchased photos, and process the purchase of photo packs.
• Provide you with support, respond to your requests and send you operational Service notices (for example, account verification or relevant changes).
• Ensure security, prevent fraud and abuse, and comply with legal obligations. This includes automatically reviewing a sample of the hosted Content to detect unlawful or dangerous material.
• Display on the collective altar at piclink.mx, during the season, the photos that people send and that a person on our team approved.

Secondary purposes (not necessary)

• Send you marketing communications, news and promotions.
• Measure the performance of advertising campaigns and improve our advertising on social media.
• Produce statistics and analytics to improve the Service.

You may object to or refuse the processing for secondary purposes at any time by writing to hola@piclink.mx, without affecting the provision of the Service.

5. Legal basis

We process your data based on the consent you give by accepting this Notice and using the Service, on the performance of the contractual relationship arising from the Terms & Conditions, and on compliance with applicable legal obligations.

6. Transfers and providers (processors)

To operate piclink we use technology providers that process data on behalf of and under the instructions of the Data Controller (processors), some located outside Mexico. These providers are contractually bound to keep confidentiality and to process the data only to provide their service to us:

• Cloudflare: photograph storage (R2), content delivery (CDN) and infrastructure.
• Amazon Web Services (AWS Cognito): authentication and credential management.
• Google: sign-in with a Google account (when you choose it) and, if you connect your Google Calendar in the Scheduling module, synchronization of your bookings with your calendar (see the “Google Calendar data use” section).
• Stripe: processing of piclink payments and subscriptions, including the purchase of AI Studio photo packs, and, if you activate the Payments feature, the connected account where you receive your clients' payments (see the "Stripe Connect and the Payments feature" section).
• Apple (App Store) and Google (Google Play): billing and management of subscriptions purchased inside the mobile app. Each store processes your payment data as an independent controller, under its own privacy policy. To link the purchase to your account we send the store an internal identifier that does not reveal who you are, and we receive the status of the purchase from it.
• Meta Platforms (Facebook/Instagram): advertising measurement and optimization via the pixel and the conversions API.
• Google (Google Analytics 4): usage statistics for the public site and the dashboard: which channel people arrive from and how they move through it. It is never loaded in the galleries you deliver to your clients nor on sites served under a custom domain, and we never send it your email or your name (see the Cookie Policy).
• HubSpot: customer relationship management (CRM): your contact and account usage data, to follow up with you on sales and support.
• Google (Gemini API): generation of the AI Studio images from the product photo you upload (see the "Artificial intelligence" section).
• Anthropic (Claude API): automatic analysis of images and text: the photo you upload to the AI Studio, the sample-based safety review of the hosted Content and assistance in our support channels (see the "Artificial intelligence" section).
• OpenAI (API): assistance in your account's support chat (see the "Artificial intelligence" section).
• Database, email and infrastructure providers necessary to operate the Service.

We do not sell your personal data. Except for the transfers to processors described above, we do not transfer your data to third parties without your consent, except in the cases provided for in Article 37 of the Law (for example, requirements from a competent authority).

Google Calendar data use (Scheduling module)

If you choose to connect your Google Calendar within the Scheduling module, piclink requests only the Google permissions strictly necessary for scheduling:

• View and edit events (calendar.events): we create a calendar event for each confirmed booking (client name, session type, date, time and location) and update or delete that event when the booking is rescheduled or cancelled. We only write and modify the events that piclink creates for your bookings; we never read or alter your other events.
• View your availability (calendar.freebusy): we read only your busy/free time ranges so we don't offer your clients slots that overlap with events already on your calendar. We do not read event titles, attendees or any event content.

Google access tokens are stored encrypted and used only for the purposes above. You can disconnect your Google Calendar at any time from your dashboard; when you do, we revoke access with Google and delete the associated tokens. This connection is optional: Scheduling works without it (bookings are confirmed by email and an .ics file).

Stripe Connect and the Payments feature

If you activate the Payments feature, we share your email address and the data of each transaction with Stripe, and we receive from Stripe the status of your connected account and of each payment. To open and verify your connected account, prevent fraud and comply with its own legal obligations, Stripe collects and processes your data as an independent controller, not as piclink's processor: when you provide personal data in connection with piclink, Stripe receives that personal data and processes it in accordance with the Stripe Privacy Policy. You may exercise your rights before Stripe through the means that policy indicates.

The data of your clients who pay a quote (name, email, amount, method and payment status) is received by Stripe and by you; piclink processes it on your behalf to show the payment status and send the payment notices. If your client pays at OXXO, the voucher and the receipt are issued by Stripe.

Artificial intelligence

Some piclink features use third-party artificial intelligence models. Those providers process the data as processors, on our behalf, and their servers may be located outside Mexico, mainly in the United States.

• AI Studio. When you upload a product photo to the AI Studio, we send it to Anthropic, which automatically checks whether it works for generating and identifies the type of product. When you order photos, we send it to Google, which generates the images from that photo and from the instructions of the style you chose. We do not send them your name or your email. The AI Studio only uses the photo you upload there: it does not take photos from your Galleries or from your clients, or data from your Google Calendar.
• Automatic safety review. To prevent piclink from being used to host unlawful or dangerous material, when an account exceeds a certain storage volume, or when our team requests it because of signs of abuse, an Anthropic model analyzes a small random sample of its images, in a reduced version and without your name or your email. If the review flags something, a person on our team verifies it before any action is taken: the review alone does not suspend or close accounts.
• Chat support. When you write to us through our support channels (the support chat, WhatsApp, Telegram or our social media), an assistant based on an Anthropic or OpenAI model may help reply to you. In that case the text of the conversation is sent to it, not the images. In your account's support chat, general account data is also sent to it (your plan, your language and the features you have enabled), without your name or your email.
• Day of the Dead Altar. Every photo a visitor sends to the altar goes through an Anthropic model that warns if it looks like dangerous or illegal content. That review only flags the photo in our internal tool: a person on our team decides whether it is published. No photo is published on its own.

Under the conditions these providers apply to the paid services we use, they do not use those images or texts to train their models, and they may keep them for a limited time to detect abuse and comply with their legal obligations. You can read their terms: Google (Gemini API), Anthropic and OpenAI. piclink does not use your Content to train artificial intelligence models either.

None of these features on its own makes decisions with legal effects on you. If you do not want a photo to be processed with artificial intelligence to generate images, do not upload it to the AI Studio: the rest of the Service works without it.

7. Cookies and tracking technologies

We use cookies and similar technologies to authenticate you, remember your preferences, unlock protected galleries, measure usage and support our advertising. You can learn the details and how to manage them in our Cookie Policy.

8. ARCO rights

You have the right to Access your personal data, Rectify it when inaccurate, Cancel it when you consider it is not required for the purposes, and to Object to its processing for specific purposes ("ARCO" rights).

To exercise them, send a request to hola@piclink.mx including: (i) your name and a means to receive a reply; (ii) documents proving your identity or legal representation; (iii) a clear description of the data and the right you wish to exercise. We will respond within the time frames set by the Law (generally, 20 business days).

To ask for a photo on the altar to be removed, write to hola@piclink.mx with the link to the photo.

9. Revocation of consent and limitation of use

You may revoke your consent to the processing of your data or limit its use and disclosure by sending your request to the email indicated. In some cases revocation may mean we can no longer provide you with the Service. You may also request to opt out of marketing communications at any time.

10. Retention and security

We retain your data while your account is active and for as long as necessary to fulfill the purposes and applicable legal and tax obligations. When you delete your account or your Content, we begin its deletion, although temporary backup copies may remain for a limited period. Records of payments from your clients are kept for the periods required by tax law. We implement reasonable administrative, technical and physical security measures to protect your data against loss, misuse or unauthorized access; however, no system is completely infallible.

If the trash is enabled for your account, Content you delete from your account (galleries, projects and the other items that support it) is not erased at that moment: it is kept for up to 60 days in your account's trash, where you can recover it or delete it before that period ends. When the period ends it is deleted automatically. Deleting your account also deletes whatever is in the trash, without waiting for that period.

The photo you upload to the AI Studio and the generated images are kept in your account, and count against your plan's storage, until you delete them or delete your account. The results of safety reviews are kept for as long as necessary to prevent abuse and respond to legal requirements.

Photos sent to the altar that are not approved are deleted when that is decided; we keep a fingerprint of the file so we do not receive it again. Approved photos are shown while the altar is open and are deleted when we close it, or sooner if the person who sent it or a person depicted asks. The fingerprint of the IP address is deleted after 30 days.

For offerings we keep the kind, the phrase, the spot and the day while the altar exists, to show how many there are; the fingerprints of the IP address and of the browser key that go with each offering are deleted after 30 days. The fingerprint used only to count people is deleted when we delete that season's altar. The same applies to what people choose they miss and to the marigold paths; the country of each offering is kept while the altar exists and is only shown added up by country.

11. Minors

The Service is intended for adults. We do not intentionally collect data from minors as account holders. If you are a photographer and upload images of minors, you are responsible for having the consent of those who exercise parental authority or guardianship. The same applies to the seasonal altar: the photo of a minor is sent only with the permission of whoever exercises parental authority or guardianship, and is removed on request.

12. Changes to the Privacy Notice

We may update this Notice due to legal, internal or Service changes. We will publish the current version at https://piclink.mx/en/privacy with its update date; when changes are substantial, we will make reasonable efforts to notify you.

13. Contact

For any questions about this Notice or about the processing of your data, contact us at hola@piclink.mx, or in writing at the Data Controller's address indicated in section 1.

If you believe your right to data protection has been violated, you may turn to the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI) or the relevant competent authority.