1. Mdhibiti na mawasiliano

The controller is Psiquepol LLC, a limited liability company organized in Texas, United States, which operates Psiquepol + AI. Address: Psiquepol LLC, 5900 Balcones Dr Ste 100, Austin, TX 78731, United States (address of its registered agent).

Requests about personal data are handled by the Psiquepol + AI Personal Data Department (Article 29 LFPDPPP), headed by Gonzalo Olivares Velázquez, at data-rights@psiquepol.ai.

Representative in the European Union: Psiquepol + AI is designating its representative under Article 27 GDPR. In the meantime, requests from people in the European Union are handled at data-rights@psiquepol.ai. General enquiries: contact@psiquepol.ai.

2. Data inayochakatwa

Platform users and clients:

• Identification and contact: name, email address, organization and job title and, if provided to receive WhatsApp alerts, phone number.
• Account: sign-in identity (the password is managed by the identity provider and Psiquepol + AI never sees it), profile, permissions, preferences, alerts, saved searches and monitoring profile.
• Content entered by the user: queries, AI Chat messages and files, notes, tags and uploaded documents.
• Billing: subscribed plan, tax details for invoicing and payment history. Card data is processed directly by Stripe; Psiquepol + AI does not store it.
• Technical and usage data: IP address, device and browser, pages visited, usage events tied to a pseudonymous identifier (no email or name) and, in the app, the identifier used to send notifications. On psiquepol.com, also the identifiers of the Meta and LinkedIn campaign measurement cookies (section 10).

Public figures: name, position, institution, level of government, public career, public biographical data, open-license images and institutional contact details (office email, phone and address) as published by official and transparency sources, and, for elected officials, the party affiliation under which they were elected. This data relates to the person’s public function or representative role and comes from publicly accessible sources: official gazettes, government websites, transparency platforms, parliamentary and electoral records, news media and open sources such as Wikidata. Every item keeps its provenance. A person’s tax or personal identification numbers, where an official source publishes them, are never shown to any user.

Business contacts and prospects: name, job title, company, sector and country, business email and phone, public professional profile and the history of communications with Psiquepol + AI (messages sent, replies and unsubscribe requests). This data comes from business contact data providers, company websites, public professional profiles, events or the person directly.

Data a client uploads about third parties (for example, its list of contacts or stakeholders): Psiquepol + AI processes it on the client’s behalf and on its instructions, as a processor. The client is the controller of that data and the party to whom rights requests are addressed; Psiquepol + AI helps the client handle them. The same applies to event registration that an organizer manages on psiquepol.com, which is governed by that organizer’s privacy notice.

Sensitive data. Users are not asked for sensitive data and should not include it in free-text fields. For public figures, the only sensitive data processed is the party affiliation of an elected official, which reveals a political opinion (Article 2, section VI, LFPDPPP and Article 9 GDPR); it is processed only as recorded in official electoral records, and no other sensitive data is inferred. Meeting content that a client records on the platform is processed only by models running on Psiquepol’s own infrastructure.

3. Madhumuni

Primary purposes, necessary for the relationship with the data subject:

• Creating and managing accounts, and authenticating users.
• Providing the contracted service: alerts, searches, monitoring, AI Chat, reports and API.
• Invoicing, collecting payments and handling billing enquiries.
• Providing support and answering requests.
• Protecting the security of the platform and preventing fraud and abuse.
• Meeting legal, tax and accounting obligations and responding to requests from authorities.
• Providing informational analysis of institutions and public figures, with the provenance of each item.
• Handling personal data rights requests.

Secondary purposes, which are not necessary for the service and can be refused:

• Sending marketing communications about Psiquepol + AI products, publications and events to clients, users and business contacts, including business-to-business prospecting.
• Measuring use of the website and the platform in aggregate to improve them.
• Inviting people to take part in surveys about the service.

To refuse the secondary purposes, it is enough to use the unsubscribe link included in every marketing message, turn off usage measurement on the web (Settings, Preferences, Privacy; the preference belongs to the account and also covers use of the mobile app, which has no such switch), or write to data-rights@psiquepol.ai with the subject “Refusal of secondary purposes”. The refusal can be expressed at any time and is never a reason to deny or condition the service.

Psiquepol + AI does not sell personal data and does not make decisions based solely on automated processing that produce legal effects on people or similarly significantly affect them. On psiquepol.com, the Meta and LinkedIn campaign measurement tags share visit data with those companies, which may also use it for their own advertising purposes (section 10).

4. Misingi ya kisheria

Mexico (LFPDPPP). The primary purposes rely on the tacit consent given by not objecting to this notice (Article 7) and on the legal relationship with the data subject (Article 9, section IV). Public figures’ data appears in publicly accessible sources (Article 9, section II). When a business contact’s data is not obtained from the person, this notice is provided in the first communication (Article 17).

European Union and United Kingdom (GDPR), by purpose:

• Accounts and service delivery: performance of a contract (Article 6(1)(b)).
• Billing and legal obligations: compliance with a legal obligation (Article 6(1)(c)) or, where the obligation arises from a law outside the Union, legitimate interest in complying with it (Article 6(1)(f)).
• Security and fraud prevention: legitimate interest in protecting the platform and its users (Article 6(1)(f)).
• Informational analysis of public figures: legitimate interest in transparency and the analysis of public affairs (Article 6(1)(f)). The party affiliation of an elected official is data the person manifestly made public by running for and being elected to office (Article 9(2)(e)).
• Business-to-business prospecting: legitimate interest in presenting professional services to people whose role relates to them (Article 6(1)(f)). Only business data is used, every message identifies Psiquepol + AI and includes a simple way to object, and objections are always honored without any need to justify them (Article 21(2) and (3)). Where national law requires prior consent to send marketing email to a business address, consent is requested before sending.
• Marketing communications to clients and users: legitimate interest regarding services similar to those contracted, or consent where it was requested (Article 6(1)(a) and 6(1)(f)).
• Usage measurement: legitimate interest in improving the service, using a pseudonymous identifier and with the option to turn it off (Article 6(1)(f)).
• Handling rights requests: compliance with a legal obligation (Article 6(1)(c)).

United States. Data is processed for the purposes described in this policy, which are those reasonably necessary to provide the service and run the business.

5. Data inashirikiwa na nani

Data is disclosed to providers that process it on behalf of Psiquepol + AI, only to provide the service, under contract and with confidentiality and security obligations. By category:

• Hosting and infrastructure for the website, the API and the monitoring service: United States.
• Databases and file storage: United States and, for files, Western North America.
• Identity and authentication: United States.
• Payments: United States. All payments, including those from Mexico, are collected by Psiquepol LLC through Stripe.
• Transactional email, WhatsApp messaging and app notifications: United States.
• Usage measurement and error tracking (configured without email or name): United States.
• Language models for AI features: United States; one of the providers may process temporarily in Europe or Singapore when it lacks capacity.
• Business contact data and sending of marketing communications: United States.
• Corporate email: United States.
• Internal operations tools and engineering assistants used by the team: United States.
• Batch processing of public-source texts with a language model: one of the providers processes in China. It receives only information from public sources, never client or user data.

The list of providers by name, with the purpose and region of each, is available on request at data-rights@psiquepol.ai.

Transfers to third parties. Psiquepol + AI does not transfer personal data to third parties for their own purposes, and therefore makes no transfers that require the data subject’s consent (Article 35 LFPDPPP). It will only disclose data without that consent in the cases set out in Article 36 LFPDPPP, such as compliance with a law, a reasoned request from a competent authority or the defense of a right in court. If a transfer requiring consent were ever planned, consent would be requested first.

6. Uhamisho wa kimataifa

Psiquepol LLC is located in the United States, as is most of its infrastructure, so data about people in other countries, including Mexico, the European Union and the United Kingdom, is processed in the United States.

For EU and UK data disclosed to providers with a data processing agreement, the safeguard is the provider’s certification under the EU-US Data Privacy Framework (and its UK extension) where it holds one, or the European Commission’s Standard Contractual Clauses (with the UK addendum) included in that agreement.

One of the language model providers does not offer a data processing agreement, so there are no standard contractual clauses with it. Its use is limited to information from public sources. Since 4 October 2026, product features that process client and user data are being moved to another provider that processes in the United States and is contractually bound not to retain or train on what it receives; the AI Chat already runs on it, and until the move is complete some analysis features with client data still use the first provider, whose terms state that it does not retain or train on what it processes.

The public-source information that a provider processes in batches in China does not include client or user data. A copy of the applicable safeguards can be requested at data-rights@psiquepol.ai. Clients that require it can be offered, by contract, a deployment with data hosted in the European Union.

7. Akili bandia

AI features (AI Chat, summaries, selecting what is relevant to each client and monitoring profile suggestions) use language models from external providers. Those models receive the public information the feature needs and, where applicable, the client’s own data: its monitoring profile, the documents analyzed for it and AI Chat messages and files. Providers process this data to respond, do not keep it longer than needed to do so and do not use it to train models. Meeting content is never sent to an external provider.

8. Uhifadhi

• Account data and user content: while the account is active. When an account is deleted, the sign-in identity, the profile and its permissions, preferences and notifications, AI Chat conversations, saved searches and alerts are deleted immediately.
• Billing, usage records and the audit log: for the period required by applicable tax and commercial law, solely to meet legal obligations and resolve billing enquiries.
• Work product created for a client: as set out in the contract with that client.
• Public figures: while the person remains publicly relevant. Terminated positions are marked as historical rather than deleted, to preserve the institutional record.
• Prospects and business contacts with no commercial relationship: 24 months from the last contact, unless they object earlier.
• Suppression list: if a person objects to marketing communications, only their email address and the date of the objection are kept, so that they are not contacted again.
• Rights requests and their responses: for as long as needed to show they were handled.

Once the period ends, data is deleted or de-identified. Encrypted backups are rotated in cycles, and deleted data disappears from them when the cycle completes.

9. Haki na jinsi ya kuzitumia

All requests are received at data-rights@psiquepol.ai. A request states the data subject’s name and a way to reply, includes documents proving their identity (or the identity and authority of anyone acting on their behalf), describes the data concerned, except for access requests, and what is being requested; a rectification request also states the change sought and supporting documentation. Exercising these rights is free of charge; only the reproduction or delivery costs the law allows may be charged.

Mexico (ARCO rights). Access, rectification, cancellation and objection; in addition, withdrawing consent and limiting the use or disclosure of data, for example through the marketing suppression list. The decision is communicated within at most twenty business days of receiving the request and, if the request is granted, carried out within the following fifteen business days; both periods may be extended once by an equal period when the case justifies it (Article 31 LFPDPPP). Access is provided by making the data available or delivering an electronic copy.

European Union and United Kingdom. Access, rectification, erasure, restriction of processing, portability of the data the person provided, objection, and withdrawal of consent at any time without affecting prior processing. Objections to direct marketing, including business prospecting, are always honored. The response is given without undue delay and within one month at most, extendable by two further months for complex requests, with notice of the extension within the first month (Article 12(3) GDPR).

United States. Depending on the state of residence: to know about and access the data, correct it, delete it and obtain a copy, and to opt out of its sale or of its use for targeted advertising. Psiquepol + AI does not sell data; to opt out of the campaign measurement tags on psiquepol.com, it is enough to write to data-rights@psiquepol.ai or block them in the browser. Exercising a right never leads to different treatment. If a request is denied, the response explains how to appeal the decision.

Public figures. For public-function data processed on legitimate-interest grounds, each erasure or objection request is weighed against the public interest in transparency, and the response explains the decision.

Account. A subscription can be canceled without deleting the account, from the mobile app (Settings, Account) or the web (Settings, Account and subscription); access continues until the end of the paid period. The account can be deleted at any time from the same places or by writing to contact@psiquepol.ai from the account email address; any active subscription is canceled at the same time and no further charges are made. The steps and what is kept are at psiquepol.ai/account-deletion.

10. Vidakuzi na teknolojia zinazofanana

• Essential cookies: keep users signed in and protect the platform. The service does not work without them, so they cannot be turned off.
• Platform usage measurement: records pages visited and usage events with a pseudonymous identifier, without email or name. It is kept in the browser’s session storage, which is cleared when the tab is closed, and uses no cookies. It can be turned off on the web, in Settings, Preferences, Privacy; the preference belongs to the account and also covers the usage events of the mobile app, which has no such switch.
• Website performance metrics: aggregated and cookieless.
• Sign-up origin (psq_signup_origin cookie): when a sign-up starts, it keeps for one hour the campaign or page the sign-up comes from, to learn how the platform was found. It does not identify the person. Only the Psiquepol team uses it; it is not sold or used for advertising.
• Preferences (NEXT_LOCALE, NEXT_LOCALE_MODE and MAP_PROJECTION cookies): remember for one year the chosen language, whether the language should follow the browser, and the map projection, so they do not have to be chosen on every visit. They do not identify the person.
• Psiquepol + AI does not use advertising cookies on psiquepol.ai.
• On psiquepol.com: aggregated, cookieless visit measurement, and the Meta and LinkedIn campaign measurement tags. These tags set cookies from those companies and send them visit data (page, IP address, browser and their cookie identifiers) to attribute visits to advertising campaigns; those companies may also use it for their own purposes. They currently load when the site is opened, without a prior consent notice.

Cookies can be blocked or deleted in the browser settings or with tracking-blocking extensions; if the essential cookies of psiquepol.ai are blocked, it will not be possible to sign in.

11. Watoto

Psiquepol + AI is a service for professionals and is not directed at people under 18. Data from minors is not knowingly collected; if it is found to have been collected, it is deleted.

12. Usalama na uvunjaji

Data is protected with administrative, technical and physical measures: server-side access control, encryption in transit, separation of each client’s data, automated review of every code change and encrypted backups. Everyone involved in the processing is bound by confidentiality, including after their relationship with Psiquepol + AI ends.

If a security breach significantly affects the rights of data subjects, they are informed immediately so they can take action, and authorities are notified within the deadlines each law sets.

13. Mabadiliko ya sera hii

Any change is published on this page with its update date. Changes that affect the purposes, the data processed, transfers or rights are also announced by email to account holders and with a notice inside the platform before they take effect.

14. Mamlaka za ulinzi wa data

If a response is unsatisfactory, or does not arrive in time, the competent authority can be approached:

• Mexico: the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), the authority for personal data held by private parties since the 2025 law, before which a rights protection request is filed within fifteen business days of the response, or from when the deadline to respond expires (Article 40 LFPDPPP).
• European Union: the supervisory authority of the Member State of habitual residence, place of work or place of the alleged infringement (Article 77 GDPR). In Belgium it is the Autorité de protection des données / Gegevensbeschermingsautoriteit. The list of authorities is available at edpb.europa.eu.
• United Kingdom: the Information Commissioner’s Office (ico.org.uk).
• United States: the attorney general of the state of residence or the relevant state privacy authority.

15. Mawasiliano

Personal data rights: data-rights@psiquepol.ai. General enquiries: contact@psiquepol.ai. Security: security@psiquepol.ai.