Privacy Notice

1. Who is responsible for your data

Aldo Gabriel Hernández Estrella, a sole proprietor with business activity trading as Gallo AI Systems (“we”), with address at Av. Universo 2002, Edif. B, Depto. 34, Col. La Aurora, Puerto Vallarta, Jalisco 48338, México, is the party responsible for processing and protecting your personal data.

Contact for anything related to this notice: Gallo AI Systems, gabocapaldi@gmail.com.

2. What we do, in short

We are an agency. We build automations, websites and content, and we operate our clients’ social media accounts on their instruction: we schedule and publish content on their Facebook Pages and their Instagram professional accounts, and we read the metrics of those posts.

To do that, the client grants us access to their accounts through Meta Business, and that access is stored as a token we hold. We never enter anyone’s account without the account owner granting us access, and that access can be withdrawn at any time.

We do not sell personal data. We do not rent it, trade it, or use it to feed third-party advertising. Our business is charging for the service, not for the data.

3. What personal data we process

From clients and from anyone who contacts us:

• Identification and contact: name, email, phone or WhatsApp, business name and role.
• Conversation content: the messages you send us by WhatsApp, email or form, and the business information you share there.
• Billing data: the record of what service was contracted and paid. Payments are processed by Stripe on its own platform; neither this site nor our systems store card numbers.
• Tax data: whatever you give us for invoicing.

From the accounts we manage on our clients’ instruction:

• Account identifiers: Facebook Page ID, Instagram professional account ID and Meta Business ID.
• Delegated access credentials: the tokens the client grants us to publish on their behalf.
• Content and metrics: the posts we produce and schedule, and the aggregated reach and engagement statistics the platform returns.
• Public interactions from third parties: when the client contracts comment moderation or replies, we process the public username and the text of the comments and replies people leave on those accounts, solely in order to respond to them.

From visitors to this site:

• Aggregated, anonymous visit metrics through Vercel Analytics. We use no advertising tracking cookies and build no visitor profiles.

Sensitive data: we do not process sensitive personal data. We do not ask for and do not want racial or ethnic origin, health status, genetic or biometric information, religious, philosophical or moral beliefs, union membership, political opinions or sexual preference. If you send such data on your own, we will ask you not to and we will delete it.

4. Why we use your data

Necessary purposes — these create and sustain your relationship with us. Without them we cannot deliver the service:

• Handling your request, quoting and agreeing the scope of work.
• Delivering the contracted service, including producing, scheduling and publishing content on your accounts, and reporting back to you.
• Charging, invoicing and bookkeeping.
• Supporting and following up with you during and after the project.
• Complying with legal and tax obligations.

Additional purposes — not necessary for the service, and they require your consent:

• Sending you news, promotions or our own content.
• Using your project as a case study or portfolio piece, naming your brand.

You can refuse these additional purposes now or at any time: email gabocapaldi@gmail.comwith the subject “Limit use of data” stating which one you object to. Refusing costs you nothing, is never a reason for us to deny service, and does not affect what you already contracted.

5. How to limit the use or disclosure of your data

• Email gabocapaldi@gmail.com and we will remove you from any promotional communication.
• You may withdraw the consent you gave us at any time, through the same channel.
• If you are a client, you can withdraw our access to your accounts whenever you want from your Meta Business settings or your Facebook or Instagram account settings, removing Gallo AI Systems from the apps and partners that have access. You do not need to tell us first.
• The full deletion procedure is at Data Deletion Instructions.

6. Your ARCO rights and how to exercise them

Under Mexican law you have the right to access your data, rectify it if it is wrong or out of date, cancel it, and object to our using it for specific purposes.

How: email gabocapaldi@gmail.comwith the subject “ARCO rights”. Your request must contain:

1. Your name and an address or any other means to receive our reply.
2. Documents proving your identity or, if you act for someone else, your standing as their representative.
3. A clear and precise description of the data the right concerns, except for access requests.
4. Which of the four rights you are exercising, or what you are asking for.
5. Anything else that helps us locate your information. For rectification, also state the exact correction and attach what supports it.

Deadlines: we communicate our determination within a maximum of twenty days from receiving your request and, where it applies, we carry it out within the following fifteen days. That period may be extended once by an equal period where circumstances justify it, and we tell you if that happens. Exercising these rights is free; we could only charge shipping or reproduction costs if you ask for copies on physical media.

The person handling these requests is Aldo Gabriel Hernández Estrella, reachable at gabocapaldi@gmail.com.

7. How we store and protect access tokens

The access tokens our clients grant us are stored as environment variables outside the project’s public code, are never committed to repositories or shared with third parties, and access is limited to whoever operates the account. They are used exclusively for the actions the client authorised: publishing, scheduling and reading metrics for their own accounts.

When the engagement ends, when the client asks, or when the access is no longer needed, we revoke and destroy the token. If we detect a data breach that materially affects your rights, we will inform you so you can act on it.

8. Who we share data with

We do not sell or share your data with third parties outside the service. We do rely on providers that process data on our behalf and under our instructions, purely so the service works:

• Meta Platforms — to publish and read metrics on the client’s Facebook Pages and Instagram accounts.
• Stripe — to process payments. Stripe receives card data directly; we never see or store it.
• Vercel — to host this site and measure visits anonymously.
• Where the client contracts it, the other platforms their content is published on.

These providers process information under their own privacy policies and may store it outside Mexico. We may also disclose data where a competent authority legally requires it. Beyond those cases, any other transfer would require your consent.

9. How long we keep it

We keep your data for as long as the relationship lasts, and afterwards only as long as needed to meet legal obligations, chiefly tax and accounting ones, or to handle liabilities arising from the service. Once data is cancelled it is blocked — used for nothing else — for the applicable statutory period, and is then erased.

10. How to request deletion of your data

Email gabocapaldi@gmail.com with the subject “Data deletion”, or follow the step-by-step procedure at galloaisystems.com/en/data-deletion. That page also explains how to withdraw our access to your accounts yourself, and what we cannot delete because the law requires us to keep it.

11. Changes to this notice

Any change to this Privacy Notice is published at this same address, galloaisystems.com/en/privacy, with the effective date updated at the top of the page. That is the official channel for communicating changes, and we ask you to check it periodically.

If a change is material — new purposes or new transfers, for example — we will additionally notify you at the last email or WhatsApp number you gave us, before the change takes effect.

12. If you are not satisfied

If you believe your right to personal data protection has been violated, you may file a data protection request with the competent authority in Mexico, currently the Secretaría Anticorrupción y Buen Gobierno, under the Federal Law on Protection of Personal Data Held by Private Parties.

Last updated: July 26, 2026.