Privacy notice

1. Data controller

The controller of your personal data is Adair Isai Vargas Pastrana, an individual trading under the Galio Labs name, with address at Av. Mazatlán B 4726, entre 47 y 48, Col. Solidaridad, San Luis Río Colorado, Sonora, Mexico.

For anything related to this notice you can write to contact@galiolabs.com.

2. Personal data collected

The form on this site collects four pieces of data, all four provided by you directly and voluntarily:

• Name. So I can address you correctly.
• Email address. So I can reply.
• Company. So I know who you are writing on behalf of.
• What is stalling for you. A free-text field. So I can judge whether the case fits before the call, instead of spending the first reply asking. You write it, in as much detail as you choose: the request is perfectly understandable without third-party data or confidential company information.

Three further things happen without you typing them:

• IP address. Two of the site's functions read it, and both do the same thing with it: count how many requests arrive from that address within a one-minute window, so that a burst has a ceiling. The first is the one that receives the form, which is how abuse of the submission is contained. The second is the MCP server published at /api/mcp, the route through which an AI client queries the same copy these pages already publish; browsing the site never goes through it, and only someone who deliberately points a client at that address reaches it. In both cases the address lives only in the function's memory for as long as that window lasts: it is not written to any database, it does not travel in the email I receive, and it is lost when the provider recycles the function. The hosting provider keeps its own server logs independently, under its own policies.
• Two preferences of yours, kept on your device. If you dismiss the bar suggesting the other language version, or if you turn measurement off at the foot of this notice, your browser stores those two decisions in its local storage. They are not cookies, they never reach the server, they identify nobody, and you can clear them from your own browser.
• Site usage measurement. Every visit leaves a record of: the address visited, including any parameters it carries; the address you arrived from; your country, region and city; your operating system and browser, with versions; your device type; your connection speed; the date and time; and the loading and responsiveness metrics your own browser measures, among them the path of the element you interacted with. That list comes from the tables the provider publishes, and it is set out here in full on purpose.
  
  The content of what you type into the form travels in none of those metrics. What can be recorded is that you interacted with a field, never what you put in it.
  
  As with any request to a server, the measurement request carries your IP address to the provider, which uses it to derive your location and a value for counting visitors. That value is computed from the request itself and discarded after twenty-four hours, so it cannot recognise you from one day to the next; the provider states that it does not retain data tied to an IP address.
  
  The measurement sets no cookie and writes nothing on your device. If your browser sends the Global Privacy Control or Do Not Track signal, it never even loads. And at the foot of this page there is a switch to turn it off in this browser.

No sensitive personal data is collected, and no financial or asset data either. There is no advertising, no tracking across other sites and no profiling. The site sets no cookies, and the only things that may be stored on your device are the two preferences described above, both of them set by you.

The form is not the only route: the contact section also publishes a direct email address and, whenever that channel is available, a WhatsApp number. If you write to the email address, your message arrives and is kept in the mailbox described in section 4. If you write over WhatsApp, your phone number and the content of your messages pass through Meta, which handles them under its own terms and not under mine. Through either of those two routes only what you choose to write arrives, and neither is needed in order to ask for the call: the form collects the same thing.

3. Purposes of processing

Primary purposes, necessary for our dealings:

• Responding to your request for a call.
• Judging whether the case fits the work I do.
• Sustaining the correspondence arising from that request.
• Where applicable, preparing and sending you a professional services proposal.

One further purpose, which is not necessary in order to answer your request:

• Measuring how many people visit the site, which pages they read and how fast those pages load, in order to keep the site working and fix it.

Each visit is sent as its own record, and the totals are read afterwards, in aggregate, from the provider's dashboard. None of it is matched against what you type into the form. Your data is not used for marketing, commercial prospecting, newsletters or profiling, and is not added to any mailing list.

To refuse this further purpose there are two routes, and either is enough on its own: the Global Privacy Control or Do Not Track signal in your browser, which this site honours without you having to tell me, or the switch at the foot of this page, which stores your decision in your own browser.

I do not offer to do it by email, and the reason is that I could not deliver on it: the measurement keeps nothing that would let me know who you are, so there would be no record to erase and no visitor to exclude. Only you can switch it off, from your browser.

4. Processors and transfers

To run the site, deliver the emails and keep them I rely on three providers acting as data processors, meaning they process the data on the controller's behalf and under its instructions. All three are established in the United States:

• Vercel Inc.: site hosting, execution of the function that receives the form, execution of the MCP server published at /api/mcp (the route through which an AI client queries the copy these pages already publish, and which reads the caller's IP address on the terms set out in section 2), execution of the edge code that decides whether a page is served as HTML or as Markdown depending on what the requester asks for, and measurement of page usage and speed.
• Resend (Plus Five Five, Inc.): delivery of the email carrying your request.
• Google LLC: hosting of the contact@galiolabs.com mailbox, which is where everything written to that address arrives and is stored. That includes the ARCO rights requests of section 6 and the copy of official identification accompanying them, for the periods declared in section 5.

With each one there is a data processing agreement obliging it to handle the information on the controller's behalf and under its instructions. Each provider in turn relies on its own infrastructure and its own sub-processors, which it publishes on its site.

One more is added to those three, and only if you are the one who chooses that route:

• Meta Platforms, Inc.: when the contact section publishes a WhatsApp number and you decide to write there instead of using the form or the email address, your phone number and the content of your messages are handled by Meta under its own terms, not under mine. If you do not use that channel, or if it stops being published, Meta takes no part in any processing.

In the specific case of site usage measurement, it is the provider that decides which fields are captured, how the counting value is computed and how long it keeps it, and its terms allow it to use aggregate, non-identifiable information to operate and improve its own service. That is why this measurement is declared here explicitly, why the provider carrying it out is named, and why you are given a real means of refusing, regardless of how the communication of the data is characterised in law.

All of this processing takes place outside Mexican territory. The providers named above are incorporated in the United States, and the hosting provider's network is distributed, so processing may occur in any country where its infrastructure operates. The United States does not hold a general adequacy recognition, so the safeguard is contractual rather than geographical: it is the processing agreements that bind the three processors to the same obligations this notice assumes.

Beyond the providers named in this section and their sub-processors, your data is not transferred, sold or shared with third parties, except on a founded request from a competent authority.

5. Retention period

Form data is kept for 24 months from your last contact, or until you request its deletion, whichever comes first. If the request leads to a contractual relationship, it will be kept for the duration of that relationship and for the periods required by applicable tax and commercial law.

Site usage measurement is not written to any database of mine and is not linked to your name or your email address. The value the provider uses to count visitors is discarded after twenty-four hours; the aggregate statistics live in the provider's dashboard and are retained under that provider's policy, which you can consult on its site.

Any identity document accompanying an ARCO rights request is kept only for as long as it takes to verify your identity and resolve that request, and is deleted once it has been dealt with.

6. ARCO rights

You have the right to access your personal data, to request its rectification where it is inaccurate or incomplete, to seek its cancellation where you consider it is not needed for the stated purposes, and to object to its processing for specific ends.

To exercise them, send a request to contact@galiolabs.com stating your name, a means of replying to you, a clear description of what you are requesting, and a copy of official identification proving your identity. A response will be issued within a maximum of 20 business days and, where it succeeds, acted on within the following 15 business days.

You may also withdraw consent at any time, through the same channel.

7. Limiting use or disclosure

As there are no promotional communications, there are no exclusion lists to manage.

The only further purpose is site usage measurement, and it is switched off from your own browser by either of the two routes described in section 3.

For everything else, if at any point you want me to stop processing your data, simply request it at the address above and it will be deleted.

8. Changes to this notice

Any change to this notice will be published at this same address, updating the date shown at the top. It is on you to review it periodically; substantial changes will additionally be communicated by email to anyone with an active request.

9. Supervisory authority

If you consider that your right to personal data protection has been infringed, you may approach the competent Mexican authority for personal data protection.