Privacy Notice

This Privacy Notice explains what personal data we collect when you visit this website or get in touch with us, why we collect it, who we share it with, and the rights you have over it. It is issued in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and, for visitors in the European Union and the European Economic Area, the General Data Protection Regulation (GDPR).

Who is responsible for your data

The party responsible for your personal data (the "data controller") is Isaac Chargoy Vivaldo, which operates the software studio under the CiudadByte (ciudadbyte.com) and Byte City (bytecity.net) brands and websites. This notice applies to both websites.

Address: Alhambra 921, Col. Portales Sur, 03300 Benito Juárez, Ciudad de México, México

Privacy contact: hello@bytecity.software

For any question about this notice or to exercise your rights, write to us at that address.

What data we collect

We only collect the data we need for the purposes described below.

Data you give us

Contact and project forms: your name, email address, phone number, company, a description of your project, and, when you choose to share them, your approximate budget and timeline.
Chat assistant: the messages you write in the chat on this site. If you decide to be contacted, the assistant also collects your name, email, phone number and, optionally, your company, together with a summary of your project.
Newsletter: your email address and preferred language.
Quotes and payments: if you accept a proposal and pay online, payment is processed by our payment provider. We receive confirmation of the payment and its amount, but we never see or store your full card details.
Any other communication you send us by email, phone or messaging.

Data collected automatically

Usage and technical data: pages visited, referring page, date and time of the visit, browser and device type, IP address, and an approximate location (country, region and city) derived from the IP address. We use it to understand how the site is used and to protect it against abuse.
Visit identifiers: a random visitor identifier and a session identifier stored in your browser, which let us count visits and link a conversation or inquiry to the visit it came from.
Campaign attribution: when you arrive from an advertisement or a campaign link, we store the campaign parameters of that link (for example utm_source, utm_campaign or the Google Ads click identifier gclid), the landing page and the referring site. They are sent together with your inquiry so we know which campaign it came from.

We do not collect sensitive personal data (such as health, religious beliefs or biometric data) and we ask you not to include it in your messages.

Why we use your data

We use your data to:

Respond to your inquiries and messages.
Prepare proposals, quotes and estimates you ask for, and follow up on them.
Manage the business relationship and, if you hire us, provide the contracted services and process payments.
Send you our newsletter, only after you confirm your subscription through the link we email you (double opt-in).
Keep the website secure, prevent abuse and spam, and troubleshoot errors.

Additionally, and only if you accept it in the cookie banner, we use your data to:

Measure the performance of the website with Google Analytics.
Measure the results of our advertising campaigns in Google Ads (for example, whether a visit that started from an ad ended in an inquiry) and show our ads to people who have visited the site.

Purposes 1 to 5 are necessary for the relationship you start with us. Purposes 6 and 7 are secondary: you can refuse them at any time without affecting anything else, and we will never make our services conditional on them. We do not sell your personal data and we do not use it for automated decisions that have legal effects on you.

Legal bases (visitors in the EU/EEA)

If you are in the European Union or the European Economic Area, we rely on the following legal bases under the GDPR:

Steps prior to entering into a contract, and contract performance (Article 6(1)(b)): answering your inquiries, preparing proposals and providing our services.
Consent (Article 6(1)(a)): the newsletter, and analytics and advertising measurement with Google. You can withdraw your consent at any time.
Legitimate interest (Article 6(1)(f)): our own aggregate, first-party statistics about the use of the site, campaign attribution attached to your inquiry, website security and fraud prevention, and following up on proposals you requested.
Legal obligation (Article 6(1)(c)): keeping accounting and tax records when you become a client.

We do not sell or rent your personal data. We share it only with service providers that process it on our behalf and under our instructions:

Hosting and database providers, which host this website and store the data described above.
Email service providers (Mailgun or an SMTP provider), which deliver our emails, including contact notifications and newsletter confirmations.
OpenAI, which processes the messages you write in the chat assistant in order to generate its replies.
Google (Google Analytics and Google Ads, loaded through Google Tag Manager), for website and advertising measurement, only with your consent.
Fathom Analytics, a privacy-focused analytics service that does not use cookies and does not collect personal data to identify you.
Stripe, our payment processor, when you pay a quote online.

We may also disclose data when required by law or by a competent authority, or to defend our legal rights.

International transfers

Several of these providers are based in, or store data in, the United States and other countries outside Mexico and the European Union. Under Mexican law, transfers to service providers acting on our behalf do not require your consent. For visitors in the EU/EEA, these transfers rely on the adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

Cookies and similar technologies

This site uses browser storage (cookies, local storage and session storage) for the following purposes:

Strictly necessary: a locale cookie that remembers your language, and the record of your cookie choice (cb_consent).
First-party statistics: the visitor and session identifiers described above, used only for our own aggregate statistics and never shared with third parties for advertising.
Campaign attribution: the campaign parameters of the link you arrived from, stored in your browser and sent only with an inquiry you submit.
Google Analytics and Google Ads: these load through Google Tag Manager in Google Consent Mode. Until you accept, they do not set analytics or advertising cookies and send only cookieless signals without identifiers. If you accept in the cookie banner, they may set cookies to measure visits and conversions, and Google may use this data to measure and personalize ads (for example, to show our ads again to people who visited the site), under Google's own privacy policy.

Changing your choice: your decision in the cookie banner is saved in your browser. To change it, clear this site's data in your browser settings (cookies and site data); the banner will appear again on your next visit and you can make a new choice. You can also block or delete cookies through your browser settings at any time.

How long we keep your data

We keep personal data only for as long as needed for the purposes it was collected for:

Inquiries, chat conversations and proposals that do not lead to a contract: up to 24 months from our last contact, so we can follow up on your request.
Client data: for the duration of the relationship and afterwards for the periods required by tax, commercial and accounting laws.
Newsletter: until you unsubscribe.
Usage and technical data: up to 24 months, after which it is deleted or kept only in aggregate form.

When the retention period ends, we delete the data or anonymize it so that it can no longer identify you.

Your rights

ARCO rights (Mexico)

Under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, you have the right to:

Access the personal data we hold about you and the conditions under which we process it.
Rectify your data if it is inaccurate or incomplete.
Cancel your data, so that it is removed from our records when it is no longer needed.
Oppose the processing of your data for specific purposes.

You may also revoke your consent to the processing of your data and limit its use or disclosure, for example by asking us to stop sending you the newsletter.

If you are in the European Union or the European Economic Area, you also have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest, as well as the right to withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal. You have the right to lodge a complaint with the data protection authority of your country of residence.

How to exercise your rights

Send an email to hello@bytecity.software with:

Your name and an email address or other means to reply to you.
A document that proves your identity (or, if acting on someone's behalf, the legal representation).
A clear description of the data and the right you want to exercise.
Any information that helps us locate your data.

We will reply within 20 business days from receiving a complete request, as provided by Mexican law, and, if your request is granted, we will make it effective within the following 15 business days. For requests under the GDPR, we will reply within one month, which may be extended by two further months for complex requests, in which case we will let you know. Exercising your rights is free of charge.

If you believe your rights have not been respected, you may file a complaint with Mexico's competent data protection authority (at the date of this notice, the Secretaría Anticorrupción y Buen Gobierno).

To stop receiving the newsletter, simply reply to any of our emails or write to hello@bytecity.software.

Minors

This website and our services are aimed at businesses and adults. We do not knowingly collect personal data from people under 18. If you believe a minor has sent us personal data, contact us and we will delete it.

Changes to this notice

We may update this Privacy Notice to reflect changes in the law or in how we operate. We will publish the updated version on this page with its date of last update and, when the changes are significant, we will tell you through the website or by email.