Privacy notice

The short version

• Who we are: Plexormedia, S. de R.L. de C.V., a company in Mérida, Mexico, that runs plexormedia.com under the PlexorMedia brand. For anything about your data, write to hello@plexormedia.com.
• What we collect: what you type into our contact form or newsletter sign-up, what you send us by email, and the technical details every website receives when you visit.
• No cookies of our own. Our pages store nothing in your browser, except your choice of light or dark mode if you use that switch. Cloudflare, which protects the site, may set strictly necessary security cookies. Our visitor statistics come from Cloudflare’s own counts of requests and use no cookies or scripts. There are no advertising trackers.
• A few providers help us. Hostinger hosts the site on servers in the United States, Cloudflare protects it and checks our forms for spam, Zoho handles our email, and EmailOctopus sends the newsletter. They work for us under contract. Cloudflare also uses some data for its own purposes: spam-check data, to improve its bot detection, and traffic data from visits, to protect its network and improve its services.
• Marketing only if you ask for it. You get the newsletter only after you sign up and confirm by email, and one click in any issue unsubscribes you. Writing to us never puts you on a mailing list.
• We never sell your personal data.
• Your rights: you can ask to see, correct or delete your data, or object to how we use it. Write to hello@plexormedia.com. We answer within 20 business days, and within one month where the GDPR applies.

The rest of this page gives the details. It is our full privacy notice (aviso de privacidad integral) under Mexican law, and it gives the information that Article 13 of the EU General Data Protection Regulation (GDPR) requires. We publish it in Spanish and English. For people in Mexico, the Spanish version prevails.

Who is responsible

Your personal data is handled by:

Plexormedia, S. de R.L. de C.V.
Calle 25 No. 220, San Miguel
Mérida, Yucatán, 97140
Mexico

• Brand: PlexorMedia
• Email for anything about your personal data: hello@plexormedia.com

We are the responsable under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published on March 20, 2025. Where the GDPR applies to our processing, we are the “controller”. Our legal notice gives the rest of our company details.

Sensitive data. We don’t ask for sensitive personal data, such as health information or religious or political beliefs. Please don’t include it in your messages, and don’t send us confidential information about your clients.

What we collect and why

For each activity, this section says what we collect, why, on what legal basis and for how long.

Mexican law distinguishes two kinds of purpose:

• primary purposes are needed for what you ask of us, such as answering your message;
• secondary purposes are not needed for that. They need your consent, and you can refuse them or withdraw your consent at any time. Our only secondary purpose is the newsletter, with the marketing it may contain.

For the newsletter, we ask for your express consent: you sign up and then confirm by email.

For people covered by the GDPR, each activity also gives its legal basis. Where we rely on our legitimate interests, we say what they are, and you can object.

1. When you visit the site

What: Every visit passes through Cloudflare, which filters attacks and keeps copies of our pages so they load faster. Requests that Cloudflare can’t answer from those copies go on to the servers of our host, Hostinger. Both record technical details of each request: the time, your IP address, the page or file requested, the page you came from, your browser and device type, and whether the request worked.

Why: to deliver the pages, keep the site secure, and find and fix errors.

Purpose under Mexican law: primary.

Legal basis (GDPR): our legitimate interest in running a secure website that works (Article 6(1)(f)).

Kept for: the periods set in Hostinger’s and Cloudflare’s own policies. Our own website code doesn’t write your IP address or anything you type into its logs.

2. Visitor statistics

What: Our visitor numbers come only from Cloudflare’s counts of the requests that reach its servers (point 1). No script runs on our pages for this, and nothing is stored on or read from your device. Cloudflare’s dashboard shows us totals, such as requests, data transferred and the number of different IP addresses, with breakdowns by country, browser and operating system. Its security pages also list, for a sample of the requests Cloudflare blocked or put through a security check, each request’s IP address, country, network, browser identification (User-Agent), the page requested and the time. We use that information only to keep the site secure (point 1).

Cloudflare’s own use: Cloudflare also uses traffic data from the sites it serves, including the requests described in point 1, for its own purposes: to protect its network and improve its services. Cloudflare’s privacy policy describes this use.

Why: to know how much the site is used, and from where.

Purpose under Mexican law: primary, as part of running the site (point 1).

Legal basis (GDPR): our legitimate interest in knowing how much the site is used, and from where (Article 6(1)(f)). To object, write to hello@plexormedia.com. Cloudflare counts every request that reaches it, so we can’t take one visitor out of its totals.

Kept for: Cloudflare’s dashboard shows at least the last 30 days. Cloudflare keeps the underlying request records for the periods set in its own policies, and publishes no fixed period for them. We keep no copies of our own.

3. When you write to us through a form

Our contact page and our services page each have a form for questions and inquiries.

What you give us: your name, your email address, the service you’re interested in, your message and, if you wish, your organization.

What we add: the language of the page, and which of the two pages you wrote from.

How it works: Our website’s server checks the form (see the spam check in point 5) and sends it as an email, through Zoho CPaaS (formerly ZeptoMail) in Zoho’s EU data center, to our mailbox hello@plexormedia.com on Zoho Mail. The website doesn’t store your message. We answer you from that mailbox.

Why: to answer you and, if you asked about our services, to prepare a proposal.

Purpose under Mexican law: primary. We don’t use these details for marketing, and writing to us doesn’t sign you up for the newsletter.

Legal basis (GDPR): when you ask about our services, steps you ask us to take before a possible contract (Article 6(1)(b)). For other messages, our legitimate interest in answering the people who write to us (Article 6(1)(f)).

Kept for: as for emails (point 6).

4. When you sign up for the newsletter

What you give us: your email address. It’s the only field.

What we add: nothing. The language of the page decides which list you join (English or Spanish), so that the confirmation email and the newsletter reach you in that language.

How it works:

1. You enter your email address on our site.
2. Our website’s server passes it to EmailOctopus, the service that sends our newsletter, and adds it to the list for the page’s language. EmailOctopus doesn’t receive your IP address at this step.
3. EmailOctopus emails you a link to confirm that you want to subscribe (double opt-in). Without confirmation, you get no newsletter. When you click it, EmailOctopus shows a short confirmation page on its own site; it can’t send you back to ours. That page loads its fonts from Google Fonts, so Google (United States) receives your IP address and your browser’s technical details when it opens. It sets no cookies.
4. Once you confirm, you get the newsletter.

What the newsletter contains: new AI tools and changes that matter for professional work. It may also tell you about PlexorMedia’s own books, services and training. Under Mexican law, that makes it a marketing and advertising purpose.

What it measures: nothing about you. We switch off EmailOctopus’s open and click tracking for every email we send, so our emails contain no tracking image, and we don’t see who opened an email or clicked a link. EmailOctopus has confirmed in writing that, with tracking off, links are not rewritten and no tracking image is added, and that its confirmation email carries no tracking either. The links to unsubscribe, change your preferences or read an email in your browser lead to pages hosted by EmailOctopus, which also load their fonts from Google Fonts. If your email app loads images, the small EmailOctopus logo at the foot of each email comes from EmailOctopus’s servers, which then receive your IP address and the technical details of your app, as with any image. EmailOctopus still records what any email service needs to deliver mail: whether each email was delivered or bounced, and unsubscriptions.

Purpose under Mexican law: secondary. We send the newsletter only with your express consent, which you give by signing up and confirming.

Legal basis (GDPR): your consent (Article 6(1)(a)). You can withdraw it at any time by unsubscribing.

Kept for: until you unsubscribe. The section How long we keep data explains what happens after that.

EmailOctopus looks up a profile picture for each subscriber’s address at Gravatar (Automattic, United States), sending the address only in scrambled (hashed) form. EmailOctopus offers no way to switch this off for a single account.

5. The spam check on our forms

What: To keep bots out of our forms, we use Cloudflare Turnstile. When you start filling in one of our forms, Turnstile checks your browser in the background, usually without asking you to do anything. For this, Cloudflare processes your IP address, technical details of your browser and its connection (its User-Agent and TLS fingerprint), and which site the check is for. Turnstile sets no cookies. When you send a form, our server asks Cloudflare to confirm the result and passes on your IP address.

Our server also limits how often a form can be used from the same IP address, and in total each day, so that nobody can flood us with messages. The counts it keeps for this stay only in the server’s memory and are never written to disk. They are discarded the first time the form is used on a new day (UTC), or when the server restarts. A hidden field, which people don’t see, also catches simple bots.

Cloudflare’s own use: Cloudflare also uses the Turnstile signals as an independent controller, relying on its own legitimate interest, to improve how Turnstile detects bots. See Cloudflare’s Turnstile Privacy Addendum.

Why: to protect our forms and our inbox from spam and abuse.

Purpose under Mexican law: primary.

Legal basis (GDPR): our legitimate interest in keeping our forms safe (Article 6(1)(f)).

Kept for: our server’s counts, until they are discarded as described above. Cloudflare’s Turnstile data: for the periods set in Cloudflare’s own policies.

Automatic refusal: If the spam check fails, or a form is used more often than these limits allow, the form refuses the submission. This has no legal effect on you, and you can always write to hello@plexormedia.com instead.

6. When you email us

What: your email address, your name if you include it, what you write and any attachments. This includes the messages that reach us through our forms.

Why: to answer you, follow up and, if you ask about our services, prepare a proposal.

Purpose under Mexican law: primary.

Legal basis (GDPR): when you ask about our services, steps before a possible contract (Article 6(1)(b)). Otherwise, our legitimate interest in answering messages (Article 6(1)(f)).

Kept for: as long as we need to deal with your message and follow up, and no longer than 24 months after our last exchange. If the conversation leads to a contract, we keep what that contract’s records need for as long as the law requires.

7. Our social media profiles

PlexorMedia has profiles on X, Instagram, TikTok, YouTube and Facebook. On this site they are plain links: nothing from those platforms loads until you click. When you follow us, comment or send us a message there, the platform handles your data under its own privacy policy, as an independent controller. Like any account holder, we see your public profile and what you post or send us. The platform also gives us summary statistics.

For our Facebook Page, Meta provides statistics called Page Insights. For these, we and Meta Platforms Ireland Limited are joint controllers, and Meta has taken on responsibility for meeting the GDPR’s obligations for that processing, including informing you and handling requests to exercise your rights. If you send us such a request, we pass it on to Meta. See Meta’s Page Insights Controller Addendum.

Why: to share our work and talk with the people who follow it.

Purpose under Mexican law: primary, when we answer you on a platform.

Legal basis (GDPR): our legitimate interest in presenting our work and answering people on those platforms, and, for Page Insights, in understanding in aggregate how people use our Facebook Page (Article 6(1)(f)).

Kept for: what you post or send us stays on the platform until you or we delete it, under the platform’s rules.

Do you have to give us your data?

No law or contract requires you to. Without an email address, though, we can’t answer you or send you the newsletter. The technical details in point 1 and point 5 are needed for the site and its forms to work.

Marketing is optional

• We send marketing only through the newsletter, and only to people who have signed up and confirmed by email.
• We never use the details you give us in a form or an email to send you marketing, and we never sign anyone up for the newsletter on their behalf.
• Nothing on this site depends on subscribing. You can read every page and write to us without it.
• You can refuse or stop at any time. Don’t sign up, use the unsubscribe link in any issue, or write to hello@plexormedia.com.
• We don’t sell or rent our subscriber list, and no one else gets it to send their own marketing.

Cookies and similar technologies

• Our own pages and code set no cookies. The only thing they keep in your browser is your choice of light or dark mode, and only if you use that switch. That choice lasts only for your visit and is never sent to our server.
• Cloudflare, which protects the site, may set strictly necessary security cookies. Examples are __cf_bm, which helps tell people from bots, and cf_clearance, set after you pass a security check. They are used only for security.
• Turnstile uses no cookies.
• There is no advertising, no Google Analytics, no social media pixel and no embedded content from other sites. Our fonts and images come from plexormedia.com itself.
• No measuring technology runs on our pages. Our visitor statistics come only from Cloudflare’s counts of the requests that reach its servers (point 2 above), and nothing is stored on or read from your device for them.

Our cookie notice gives the details.

Who helps us

These providers process personal data on our behalf, under contract, and only for the purposes in this notice.

Hostinger International Ltd. (Cyprus)

• What it does for us: hosts the website and runs its form code; keeps the server logs.
• Where: United States (Hostinger’s US data center).
• Safeguard for transfers: Hostinger’s data processing addendum, part of its terms of service, with the EU Standard Contractual Clauses (modules 2 and 3) for data transferred outside the European Economic Area.

Cloudflare, Inc. (United States)

• What it does for us: domain name system (DNS), security filter and caching for every visit; the Turnstile spam check; visitor statistics, counted on its own servers from those same visits.
• Where: United States, and Cloudflare’s data centers around the world.
• Safeguard for transfers: Cloudflare’s data processing addendum, part of its terms. Cloudflare is certified under the EU-US Data Privacy Framework. If that certification lapses or is invalidated, the EU Standard Contractual Clauses in the addendum apply automatically.

Zoho (Zoho Corporation group)

• What it does for us: Zoho CPaaS (formerly ZeptoMail) delivers form messages to our mailbox; Zoho Mail hosts hello@plexormedia.com and the emails you send us.
• Where: Zoho CPaaS in the EU (Zoho’s data centers in the Netherlands, with Ireland as backup); Zoho Mail in the United States (Zoho’s US data center).
• Safeguard for transfers: Zoho’s data processing addendum, based on the EU Standard Contractual Clauses, one for each account. Zoho signs it on request. We requested the addendum for Zoho CPaaS on October 6, 2026, and are waiting for Zoho to sign it. We have not yet requested the one for Zoho Mail.

EmailOctopus (Three Hearts Digital Ltd, United Kingdom)

• What it does for us: stores newsletter subscribers and sends the confirmation email and the newsletter.
• Where: stores the data in the EU (Amazon Web Services, mainly Ireland) and sends emails mainly through Bird B.V., in the EU. Some of its subcontractors are in the United States, for example Twilio SendGrid, which sends a small share of the emails, and Gravatar.
• Safeguard for transfers: the United Kingdom has an EU adequacy decision, so sending data to EmailOctopus needs no further safeguard. EmailOctopus’s data processing terms, Schedule 2 of its terms of use, cover its subcontractors outside the UK and the EU.

Each provider may use subcontractors (sub-processors) under the terms of its addendum. Under Mexican law, sending data to these providers is a remisión to processors (encargados), which doesn’t need your consent.

Apart from these providers, we share your data only when the law requires it, for example when a court or another competent authority orders us to.

Transfers

Under Mexican law. Apart from our providers, who act on our behalf, one recipient uses data for its own purposes: Cloudflare, which uses the spam-check signals to improve Turnstile (point 5), and traffic data from visits to protect its network and improve its services (point 2). No one else receives your data for their own purposes. The law allows some transfers without consent (LFPDPPP Article 36), for example when a law requires them, for the administration of justice, or to establish or defend a right in court.

Under the GDPR. PlexorMedia is in Mexico, and the European Commission has not recognized Mexico as providing an adequate level of protection. When you send us data from the EU, you give it directly to us. Our providers then process it in the United States, and Cloudflare also in its data centers around the world. EmailOctopus, which sends the newsletter, is in the United Kingdom, which has an EU adequacy decision, and stores subscribers in the EU. Zoho CPaaS, which delivers form messages to our mailbox, runs in Zoho’s EU data center; the messages then reach our mailbox at Zoho Mail, in the United States. The safeguards for these transfers are listed above, under Who helps us: the EU Standard Contractual Clauses in Hostinger’s addendum and, once Zoho has signed them, in Zoho’s, and, for Cloudflare, the EU-US Data Privacy Framework, with the Standard Contractual Clauses as the fallback its addendum provides.

Two of these addenda are public: Hostinger’s data processing addendum and Cloudflare’s data processing addendum. For Zoho’s or EmailOctopus’s, or for a copy of any of these safeguards, write to hello@plexormedia.com.

How long we keep data

When a period ends, we delete the data or make it anonymous. Under Mexican law, data you ask us to cancel may first be blocked, and used for nothing else, while legal claims about it can still be brought. It is then deleted, and we tell you when that is done (LFPDPPP Article 24).

Your rights

Wherever you live, you can:

• see the personal data we hold about you and how we use it (access);
• have it corrected if it’s wrong or incomplete (rectification);
• have it deleted (erasure, called cancelación in Mexico);
• object to our use of it (objection, called oposición in Mexico);
• have its use restricted in some cases, for example while we check whether it’s accurate (restriction);
• receive the data you gave us in a common, machine-readable format, or have it sent to someone else (portability);
• withdraw your consent at any time. This doesn’t affect what we did before you withdrew it.

In Mexico, the first four are your ARCO rights (access, rectification, cancellation and opposition). Under the GDPR, you can also complain to a supervisory authority, as explained at the end of this notice, under Where to complain.

Your right to object. Where we rely on our legitimate interests (points 1, 2, 3, 5, 6 and 7), you can object at any time for reasons related to your situation. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims. You can object to direct marketing at any time, without giving a reason, and we then stop.

If you live in another country, for example Brazil (General Data Protection Law, LGPD) or Chile (Law 21.719, which is due to apply from December 1, 2026), you have the rights your local law gives you, and you exercise them the same way. Our contact channel for people and authorities in those countries is hello@plexormedia.com.

No automated decisions. We don’t make decisions about you based solely on automated processing that have legal effects or similarly significant effects on you. The only automatic step is the spam check in point 5.

How to exercise your rights

Write to hello@plexormedia.com. Please include:

1. your name, and an email or postal address for our reply;
2. what you want us to do, for example show you your data or delete it;
3. which data it’s about, unless you’re asking for access. To correct data, say what should change and attach anything that supports it;
4. anything that helps us find your data, such as the email address you used.

Identity. We must make sure the request comes from you or from your legal representative. Mexican law asks for a document that proves your identity, and a representative must also show that they can act for you (LFPDPPP Article 28). When a request is about data we hold only under your email address, writing from that address is usually enough for us to confirm that it’s you. If it isn’t, we’ll ask for an identification document. We use these documents only to check identity, and we delete them once the request is handled.

How we answer. We reply by email, to the address you wrote from or to the one you give us. If you ask for access, we send you your data as an electronic document attached to our reply. If your request is missing something we need, we ask you for it.

Deadlines. Under Mexican law, we tell you our decision within 20 business days of receiving your request. If it’s in your favor, we carry it out within 15 business days after that. Under the GDPR, we answer within one month. These periods can be extended once when the case justifies it: in Mexico, by the same length; under the GDPR, by up to two more months, for complex or numerous requests. If we need an extension, we tell you why within the original period.

Cost. Requests are free. We send data electronically, so there are no copy or shipping costs to pass on.

If we can’t do what you ask, for example because the law requires us to keep the data, we explain why.

How to withdraw consent or refuse marketing

• Newsletter: use the unsubscribe link at the bottom of any issue, or write to hello@plexormedia.com from the address you subscribed with. This stops the newsletter.
• Visitor statistics: nothing runs on your device, so there is nothing to block. To object, write to us, as explained in point 2.
• Anything else: write to hello@plexormedia.com and tell us what you want to stop.

When you write to us to withdraw your consent, we handle it like a rights request. We may first check that the request comes from you, and we confirm by email once it’s done, within the deadlines given above, under How to exercise your rights.

Withdrawing your consent doesn’t affect what we did before (LFPDPPP Article 7; GDPR Article 7(3)). Refusing a secondary purpose never affects your use of the site or our answer to your messages. Under Mexican law, these are also the ways we offer to limit the use and disclosure of your data.

Age

This site and our newsletter are meant for adults. If you are under 18, please don’t send us your data or subscribe. If we learn that we have received data from someone under 18, we delete it.

Security

• Your connection to plexormedia.com is encrypted (HTTPS), and so is the connection between Cloudflare and our host, Hostinger.
• The website doesn’t store form messages. They go straight to our mailbox, and our code doesn’t write your IP address or what you type into its logs.
• Only the people who run PlexorMedia can sign in to the accounts we use to run the site (Hostinger, Cloudflare, Zoho and EmailOctopus), and each of these accounts uses two-step login.
• Our providers protect the data they handle for us under the security terms of their contracts.
• If a security breach significantly affects your rights, we tell you immediately so that you can protect yourself. Where the GDPR applies, we also notify the supervisory authority when the law requires it.
• No way of sending or storing data is completely secure, and ordinary email is not end-to-end encrypted. Please don’t send us confidential client information through our forms or by email.

Changes to this notice

We update this notice when our services, our providers or the law change. Each update gets a new version number and date.

If a change matters to you, for example a new purpose, a new provider that receives your data or a new transfer, we announce it on this page before it takes effect, and we tell newsletter subscribers by email. If a change needs your consent, we ask for it first. Earlier versions are available on request.

People in the European Union

People in the European Union can write to us directly at hello@plexormedia.com.

Where to complain

We’d like to hear from you first, at hello@plexormedia.com. You can also go to a data protection authority:

• Mexico: the Secretaría Anticorrupción y Buen Gobierno (in Spanish). If you disagree with our answer to an ARCO request, or get no answer in time, you can file a solicitud de protección de datos with it within 15 business days of our answer, or once our deadline to answer has passed (LFPDPPP Article 40).
• European Union and European Economic Area: a data protection supervisory authority, usually the one where you live or work, or where you think the problem happened. In Spain, it’s the Agencia Española de Protección de Datos (AEPD). The European Data Protection Board publishes a list of every data protection authority in the EU and the European Economic Area.
• Other countries: the data protection authority where you live.