Legal

Privacy Notice

Last updated: September 5, 2026

This Privacy Notice is issued in compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (the "Law"), its Regulations and the applicable Privacy Notice Guidelines in force in the United Mexican States. This is an English translation provided for convenience; the document is governed by Mexican law.

1. Identity and address of the Data Controller

Rodrigo Ricardo Méndez Gallegos (an individual with business activity), responsible for the piclink platform (https://piclink.mx), with Tax ID (RFC) MEGR920423JZ6 and address at Camino del Teca 580, Tlajomulco, Jalisco, México, is responsible for the processing of your personal data (the "Data Controller").

2. Personal data we collect

We collect personal data directly when you provide it, automatically when you use the Service, and through third parties that provide services to us. Depending on your interaction, we may process:

• Identification and contact data: full name, username, email address.
• Authentication data: access credentials (passwords are managed in encrypted form by our identity provider; piclink has no access to them in clear text) and third-party account identifiers when you sign in with Google.
• Billing data: when you purchase a paid plan, your payment method data is collected and processed directly by our payment processor (Stripe). piclink retains only transaction data (plan, amount, period, status), not your full card number.
• Content you upload: photographs and images and their associated metadata (for example, titles, album names), which may contain the likeness of individuals.
• Usage and technical data: IP address, device and browser type, identifiers, access dates and times, pages and galleries visited, and viewing metrics.
• Notification data: if you authorize it, the subscription identifier used to send you push notifications.
• Payments feature data (Stripe Connect): if you activate charging deposits and payments to your clients, Stripe directly collects the identity, tax and banking data needed to verify your account (for example, name, tax ID (RFC), official ID, address and bank account number (CLABE)). piclink does not receive those documents; it keeps only the identifier and status of your connected account and, for each payment, the description, amount, currency, method, status, transaction identifiers and the link to the receipt issued by Stripe.
• Data of clients who pay a quote: name and email address (taken from the quote issued by the User), amount, method and status of the payment and the link to the receipt. Their card data is collected and processed directly by Stripe; piclink never sees it.

3. Sensitive data and images of individuals

We do not deliberately collect sensitive personal data to operate the Service. If your Content includes data that could be considered sensitive, its processing will depend on the consent that you, as the photographer, have obtained from the relevant individuals.

The same applies to the data of your clients that you enter in quotes and to that of those who pay you through the Payments feature: you are the controller of that data with respect to your clients and piclink processes it as a processor on your behalf, except for the data Stripe processes as an independent controller (see the "Stripe Connect and the Payments feature" section).

4. Purposes of processing

Primary purposes (necessary for the Service)

• Create and manage your account and authenticate your access.
• Host, process (resize/optimize), organize and deliver your photographs and galleries to the people you share them with.
• Publish your public profile/portfolio when you choose to.
• Process payments, manage subscriptions and issue receipts where applicable.
• If you activate the Payments feature, enable your clients to pay you deposits and quote payments into your own Stripe account, reflect the status of each payment and send you and your client the corresponding notices (OXXO voucher, reminder, confirmation, expiry or refund).
• Provide you with support, respond to your requests and send you operational Service notices (for example, account verification or relevant changes).
• Ensure security, prevent fraud and abuse, and comply with legal obligations.

Secondary purposes (not necessary)

• Send you marketing communications, news and promotions.
• Measure the performance of advertising campaigns and improve our advertising on social media.
• Produce statistics and analytics to improve the Service.

You may object to or refuse the processing for secondary purposes at any time by writing to hola@piclink.mx, without affecting the provision of the Service.

5. Legal basis

We process your data based on the consent you give by accepting this Notice and using the Service, on the performance of the contractual relationship arising from the Terms & Conditions, and on compliance with applicable legal obligations.

6. Transfers and providers (processors)

To operate piclink we use technology providers that process data on behalf of and under the instructions of the Data Controller (processors), some located outside Mexico. These providers are contractually bound to keep confidentiality and to process the data only to provide their service to us:

• Cloudflare — photograph storage (R2), content delivery (CDN) and infrastructure.
• Amazon Web Services (AWS Cognito) — authentication and credential management.
• Google — sign-in with a Google account (when you choose it) and, if you connect your Google Calendar in the Scheduling module, synchronization of your bookings with your calendar (see the “Google Calendar data use” section).
• Stripe — processing of piclink payments and subscriptions and, if you activate the Payments feature, the connected account where you receive your clients' payments (see the "Stripe Connect and the Payments feature" section).
• Meta Platforms (Facebook/Instagram) — advertising measurement and optimization via the pixel and the conversions API.
• HubSpot — customer relationship management (CRM): your contact and account usage data, to follow up with you on sales and support.
• Database, email and infrastructure providers necessary to operate the Service.

We do not sell your personal data. Except for the transfers to processors described above, we do not transfer your data to third parties without your consent, except in the cases provided for in Article 37 of the Law (for example, requirements from a competent authority).

Google Calendar data use (Scheduling module)

If you choose to connect your Google Calendar within the Scheduling module, piclink requests only the Google permissions strictly necessary for scheduling:

• View and edit events (calendar.events): we create a calendar event for each confirmed booking (client name, session type, date, time and location) and update or delete that event when the booking is rescheduled or cancelled. We only write and modify the events that piclink creates for your bookings; we never read or alter your other events.
• View your availability (calendar.freebusy): we read only your busy/free time ranges so we don't offer your clients slots that overlap with events already on your calendar. We do not read event titles, attendees or any event content.

Google access tokens are stored encrypted and used only for the purposes above. You can disconnect your Google Calendar at any time from your dashboard; when you do, we revoke access with Google and delete the associated tokens. This connection is optional: Scheduling works without it (bookings are confirmed by email and an .ics file).

Stripe Connect and the Payments feature

If you activate the Payments feature, we share your email address and the data of each transaction with Stripe, and we receive from Stripe the status of your connected account and of each payment. To open and verify your connected account, prevent fraud and comply with its own legal obligations, Stripe collects and processes your data as an independent controller, not as piclink's processor: when you provide personal data in connection with piclink, Stripe receives that personal data and processes it in accordance with the Stripe Privacy Policy. You may exercise your rights before Stripe through the means that policy indicates.

The data of your clients who pay a quote (name, email, amount, method and payment status) is received by Stripe and by you; piclink processes it on your behalf to show the payment status and send the payment notices. If your client pays at OXXO, the voucher and the receipt are issued by Stripe.

7. Cookies and tracking technologies

We use cookies and similar technologies to authenticate you, remember your preferences, unlock protected galleries, measure usage and support our advertising. You can learn the details and how to manage them in our Cookie Policy.

8. ARCO rights

You have the right to Access your personal data, Rectify it when inaccurate, Cancel it when you consider it is not required for the purposes, and to Object to its processing for specific purposes ("ARCO" rights).

To exercise them, send a request to hola@piclink.mx including: (i) your name and a means to receive a reply; (ii) documents proving your identity or legal representation; (iii) a clear description of the data and the right you wish to exercise. We will respond within the time frames set by the Law (generally, 20 business days).

9. Revocation of consent and limitation of use

You may revoke your consent to the processing of your data or limit its use and disclosure by sending your request to the email indicated. In some cases revocation may mean we can no longer provide you with the Service. You may also request to opt out of marketing communications at any time.

10. Retention and security

We retain your data while your account is active and for as long as necessary to fulfill the purposes and applicable legal and tax obligations. When you delete your account or your Content, we begin its deletion, although temporary backup copies may remain for a limited period. Records of payments from your clients are kept for the periods required by tax law. We implement reasonable administrative, technical and physical security measures to protect your data against loss, misuse or unauthorized access; however, no system is completely infallible.

11. Minors

The Service is intended for adults. We do not intentionally collect data from minors as account holders. If you are a photographer and upload images of minors, you are responsible for having the consent of those who exercise parental authority or guardianship.

12. Changes to the Privacy Notice

We may update this Notice due to legal, internal or Service changes. We will publish the current version at https://piclink.mx/en/privacy with its update date; when changes are substantial, we will make reasonable efforts to notify you.

13. Contact

For any questions about this Notice or about the processing of your data, contact us at hola@piclink.mx, or in writing at the Data Controller's address indicated in section 1.

If you believe your right to data protection has been violated, you may turn to the National Institute for Transparency, Access to Information and Protection of Personal Data (INAI) or the relevant competent authority.