Privacy notice

Last updated: October 9, 2026 · Preliminary version 0.1

Important: this document is a preliminary version, subject to legal review. Its content may change once that review is complete; the version in force is always the one published on this page, with its update date. In case of any discrepancy, the Spanish version prevails.

1. Identity and address of the data controller

[PENDING: exact legal name of DM4 Digital Business] ("DM4"), doing business as DM4 Digital Business, Mexican Taxpayer ID (RFC) [PENDING: RFC], with its address at [PENDING: full address (street, number, neighborhood, municipality, ZIP code, state)], is the controller of the personal data collected through the Dairi IA ONE platform (the "Platform"), its web portal [PENDING: final portal URL; provisionally https://www.daairi.app/Daairi/] and the website dm4digitalbusiness.com.

This Comprehensive Privacy Notice is issued pursuant to Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette (DOF) on March 20, 2025 and in force since March 21, 2025 (the "Law"), and other applicable regulations.

2. Scope of this notice

This notice applies to the personal data of the individuals who sign up for, purchase or use the Platform (the "Customers" and their authorized users), as well as visitors to the portal and anyone who contacts DM4.

The Platform also processes data about our Customers' own end customers, leads and contacts (for example, people who call a Customer or message it on WhatsApp). For that data, DM4 acts as a processor and the Customer is the controller. That processing is governed by the Customer's own privacy notice, by section 9 of this notice and by our Data Processing Policy.

3. Personal data we collect

For the purposes described in this notice, DM4 may collect the following categories of personal data:

DM4 does not request sensitive personal data from Customers to operate their accounts. If a Customer chooses to upload sensitive information to the Platform (for example, in its knowledge base or conversations), it does so at its own responsibility and in accordance with section 9.

4. Purposes of processing

4.1 Primary purposes (required to provide the service)

• Creating, managing and securing the accounts of Customers and their authorized users.
• Providing the Platform's services: AI agents for phone calls, WhatsApp and web chat, CRM, conversation inbox, tickets, outbound campaigns, knowledge base, connectors, analytics and any other features purchased.
• Managing the free trial, plan subscriptions, billing, renewals and cancellations.
• Issuing CFDI invoices and complying with tax and accounting obligations.
• Providing technical support and handling requests, questions, complaints and disputes.
• Sending service communications, such as security, billing and service-change notices, or notices of changes to these documents.
• Keeping the Platform secure, preventing fraud and misuse, and maintaining access and audit logs.
• Complying with legal obligations and lawful requests from competent authorities.

4.2 Secondary purposes (not required for the service)

• Sending marketing communications, news, promotions and content about DM4's products and services.
• Conducting satisfaction surveys and research to improve the Platform.

If you do not want your data to be used for these secondary purposes, you can tell us at any time by writing to [PENDING: privacy email address] or by using the unsubscribe link included in every message. Opting out will not affect your access to the service.

5. Data sharing with processors and third parties

To operate the Platform, DM4 relies on service providers that process personal data on DM4's behalf (sub-processors). They are contractually bound to process data only on DM4's instructions and to maintain appropriate security measures. Some of them are located outside Mexico, so international data transfers may occur.

DM4 may also disclose personal data without your consent where the Law allows it, including: to competent authorities under a legal mandate or a duly grounded request; to the Mexican Tax Administration Service (SAT) for tax purposes; and where necessary to establish, exercise or defend a right in legal proceedings. DM4 does not sell or rent personal data.

6. ARCO rights and withdrawal of consent

You have the right to access your personal data, rectify it if it is inaccurate or incomplete, cancel (delete) it when you believe it is not needed for the stated purposes, and object to its processing for specific purposes (known in Mexico as "ARCO" rights). You may also withdraw any consent you have given, to the extent permitted by law and without retroactive effect.

To exercise these rights, send a request to [PENDING: privacy email address] or deliver it to the address in section 1. Your request must include:

1. Your full name and a way to send you our response.
2. Documents proving your identity or, where applicable, your legal representation.
3. A clear and precise description of the data involved and the right you wish to exercise.
4. Any information or documents that help locate the data.
5. For rectification requests, the changes requested and supporting documentation.

DM4 will respond within the time limits set by the Law (as a guideline, within 20 business days of receiving the request, implementing any decision within the following 15 business days) [PENDING: confirm applicable deadlines with legal counsel]. Requests are handled by [PENDING: name of the person or department in charge of personal data].

You can view and correct some account data directly in the portal's profile section. Please note that certain data must be kept to meet legal obligations (for example, tax obligations), so it may not always be possible to delete it immediately.

7. Limiting use or disclosure

In addition to your ARCO rights, you can ask us to limit the use or disclosure of your personal data by writing to [PENDING: privacy email address]. You can also unsubscribe from marketing emails through the link in each message.

8. Cookies and similar technologies

The portal uses only cookies that are strictly necessary for it to work. We do not use advertising cookies or third-party tracking cookies.

You can delete or block cookies in your browser settings, but if you do, you may be unable to sign in or use some portal features.

9. Data about our Customers' end customers

When a Customer uses the Platform, the Platform processes third-party data on that Customer's behalf, such as phone numbers, names, WhatsApp and chat messages, voice notes, call recordings and transcripts, AI-generated summaries and extracted data, imported contacts, tickets, campaign results and queries to the Customer's own systems.

With respect to this data:

• The Customer is the controller and must have its own privacy notice, inform its customers that they are being served by an AI-powered virtual assistant and that calls may be recorded, and obtain any required consents.
• DM4 acts as a processor: it processes the data solely to provide the service to the Customer, on the Customer's instructions, and does not use it for its own purposes.

If you are an end customer of a business that uses Dairi IA ONE and wish to exercise your rights, we recommend contacting that business directly. If you contact DM4, we will forward your request to the relevant Customer. Further details are set out in our Data Processing Policy.

10. Security measures

DM4 applies administrative, technical and physical safeguards to protect personal data, including: HTTPS encryption in transit; password hashing; AES-256 encryption of connector credentials; read-only connections to Customers' systems; role-based access control (owner, administrator, supervisor, agent and read-only); and an audit log. No system is completely infallible; if a security breach significantly affects your rights, DM4 will notify you as required by the Law.

11. Data retention

Data is kept while the account is active. After an account is cancelled or suspended, data is kept for 30 days (to allow reactivation or data export) and is then deleted or anonymized, except for data that must be retained by law, such as tax and accounting records, for the periods required by applicable regulations. Access and audit logs are kept for [PENDING: retention period for access and audit logs].

12. Minors

The Platform is intended for businesses and individuals aged 18 or older. DM4 does not knowingly collect data from minors as Platform users.

13. Changes to this notice

DM4 may update this notice due to legal changes, changes to the Platform or changes in its practices. Updates will be posted on this page with their update date and, when material, notified to your registered email address or through a notice in the portal.

14. Supervisory authority

If you believe your right to personal data protection has been violated, you may file a complaint with the competent authority, which under the current Law is the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), which took over the data protection functions of the former National Institute for Transparency, Access to Information and Personal Data Protection (INAI).

15. Contact

• Privacy email: [PENDING: privacy email address]
• Phone: [PENDING: contact phone number]
• Address: [PENDING: full address]
• Website: dm4digitalbusiness.com