Privacy notice

Privacy notice

This is a courtesy translation of a document originally written in Spanish. Peaking is operated by Magnesia Healthtech SAPI de CV, a Mexican company, and the processing of personal data described here is governed by Mexican law. In the event of any discrepancy, the Spanish version prevails.

At Magnesia Healthtech SAPI de CV (hereinafter Peaking) we are committed to protecting the privacy and security of your personal data. This policy describes how we collect, use, store and protect your information in compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and other applicable regulations.

1. Glossary

For the purposes of this privacy notice, the following terms mean:

• Privacy notice: A document, in physical, electronic or any other format, produced by the Data Controller and made available to the Data Subject prior to the processing of their personal data, in accordance with the Law.
• Databases: An organized set of personal data relating to an individual or legal entity.
• Consent: The expression of the Data Subject will by which the processing of their data is carried out.
• Personal data: Any information relating to an individual or legal entity.
• Sensitive personal data: Personal data that touches on the most private sphere of the Data Subject, or whose misuse could give rise to discrimination or carry a serious risk for them.
• ARCO rights: The rights of access, rectification, cancellation and objection.
• The Law: The Mexican Federal Law on the Protection of Personal Data Held by Private Parties.
• Data Controller: Magnesia Healthtech SAPI de CV, a private legal entity that decides on the processing of personal data.
• Data Subject: The individual to whom the personal data belongs.
• Processing: The collection, use, disclosure or storage of personal data, by any means.

2. Identity and address of the Data Controller

The party responsible for processing your personal data is Magnesia Healthtech SAPI de CV, with an address at Avenida Fuente del Parque 218, San Luis Potosí, San Luis Potosí 78280, Mexico.

Contact details:

Email: admin@peaking.ai

Phone: +52 (33) 51 23 08 80

3. Personal data collected

Magnesia Healthtech SAPI de CV may collect the following personal data:

• Identification data: First name, last name, email address, phone number.
• Billing data: Credit card information, billing address.
• Technical data: IP address, device type, browser type, information about use of the website (pages visited, time on site, clicks).
• Contact data: Information provided when contacting Magnesia Healthtech SAPI de CV support or customer service.
• Preference data: Preferences regarding use of the website and the Services.

If sensitive personal data is collected, such as financial data, customer information or data relating to a company operational processes, Magnesia Healthtech SAPI de CV will require the express written consent of the Data Subject.

Data received from Meta platforms (Facebook, Instagram and WhatsApp): When the User connects their Meta assets (such as Facebook pages, Instagram accounts or WhatsApp Business numbers) through Facebook Login or Facebook Login for Business, Peaking may receive from Meta the following data about the administrator performing the connection: first name, last name, profile picture, email address, account or business identifiers and the permissions associated with those assets, in accordance with the policies and terms of Meta Platforms, Inc.

4. Purposes of processing

Personal data will be used exclusively for the purposes described here. Should we wish to use it for any other purpose not specified, the express consent of the User will be requested.

Primary purposes

• To carry out analysis and assessment for the implementation of Peaking services.
• To provide consulting and technical support services.
• To manage confidential information belonging to client companies.
• To communicate with clients in order to inform them about services.
• To comply with legal and regulatory obligations.
• For the sale of products and the contracting of services.
• To fulfil delivery of the product or performance of the services.
• To enter into a services agreement.
• To request the corresponding invoice or tax receipt.
• To process payment or transfer for the product, good or service contracted.

The identification and contact data we receive from Meta, such as name, profile picture, email address and account identifiers, is used for the following purposes:

• To authenticate and identify the administrator connecting their Meta assets to Peaking.
• To correctly associate those assets (pages, Instagram accounts and WhatsApp Business numbers) with the User organization inside Peaking.ai.
• To display the administrator name and image inside the Peaking panel for traceability and internal audit purposes.
• To send communications relating to the account, the status of integrations, technical notifications and billing notices connected to the use of Peaking Services.

This data is not used for advertising purposes, and it is neither sold nor shared with third parties outside the provision of the Services, except for necessary technology providers (for example, cloud infrastructure services), who are contractually obliged to protect the data in accordance with this Privacy Notice and with applicable regulations.

Secondary purposes

• Sending commercial and promotional information.
• Conducting satisfaction surveys.
• Producing statistics.
• Sending materials and event invitations.

5. Transfers of personal data

Your personal data may be transferred to:

• Third party service providers necessary for the implementation of Magnesia Healthtech SAPI de CV services, whose corporate purpose is information technology services.
• Competent authorities, in compliance with legal obligations.

In the event of international transfers of data, Magnesia Healthtech SAPI de CV will take the measures necessary to ensure that the data is processed in accordance with applicable data protection regulations.

6. ARCO rights and how to exercise them

You have the right to access, rectify, cancel or object to the processing of your personal data. To exercise these rights, you must send a request to: admin@peaking.ai.

The request must contain:

• Your name and address.
• A copy of your official identification.
• A clear and precise description of the personal data you wish to access, rectify, cancel or object to.
• Any other element that helps locate your data.

The Data Controller has 20 days to respond to the request and, where it is granted, a further 15 days to act on it.

Person responsible for handling ARCO rights: Fabio Soto Felegrino.

At Peaking we protect the privacy of the people who interact with our clients intelligent agents through platforms such as Facebook, Instagram and WhatsApp. To provide this service, Peaking AI accesses, through the official Meta APIs, only the minimum data necessary for the AI agent to work correctly. That data may include:

• Public identifiers such as the platform user ID or phone number.
• The content of the messages exchanged with the agent.
• The channel used for the conversation (Messenger, WhatsApp or Instagram).
• The date and time of the interaction.

This data is used exclusively so that the intelligent agent can process the conversation and reply to the end User on behalf of our client. We do not use it for advertising purposes, we do not build separate profiles from information belonging to different clients, and we neither sell nor share this information with third parties outside the provision of the service.

The data is deleted automatically after a period of time, and anyone may request manual deletion of their information by writing to admin@peaking.ai, following the procedure described in this Privacy Notice.

7. Limiting the use and disclosure of data

To limit the use and disclosure of your personal data for direct marketing purposes, you may join our exclusion list by sending an email to admin@peaking.ai. We will process your request and ensure that you do not receive unwanted commercial communications.

8. Security measures

Magnesia Healthtech SAPI de CV has implemented physical, technical and administrative security measures to protect your personal data against damage, loss, alteration, destruction or unauthorized access. These measures include:

Physical measures

• Restricted access to offices and data centers, through card based or biometric access control systems.
• Constant monitoring of facilities through security cameras.
• Clean desk policies, to avoid exposing sensitive information in work areas.

Technical measures

• Firewalls and intrusion detection systems to protect the network and the servers.
• Encryption of data in transit and at rest, using secure protocols such as TLS/SSL.
• Periodic backups of information, stored in secure locations.
• Continuous updating of software and operating systems to correct security vulnerabilities.
• Role based access controls, to limit access to information to authorized personnel.
• Up to date antivirus and antimalware software on all devices.

Administrative measures

• Ongoing staff training on personal data protection and information security.
• Internal policies and procedures for handling and protecting personal data.
• Internal and external audits to assess the effectiveness of the security measures in place.
• Confidentiality agreements with third party service providers that have access to personal data.
• Security incident response protocols, to act promptly in the event of a possible breach.

In the event of a security breach, Magnesia Healthtech SAPI de CV will take the measures necessary to mitigate the risks and will notify affected users in accordance with applicable legislation.

Use of Google Calendar data

Our application allows users to connect their Google Calendar in order to schedule meetings directly from conversations on WhatsApp, Instagram, Messenger or our web chat. When a user explicitly asks the AI agent to create a meeting, we use the calendar.events scope to insert a new event into the calendar the user selected.

Events may include a title, a description, start and end times, attendee email addresses and a Google Meet link. We also use the calendar.freebusy scope to check availability before scheduling.

We do not read, edit or delete existing events, and we do not access historical calendar data. We store only the ID of the calendar chosen by the user and the minimum metadata needed to create the event.

Calendar data is used strictly to fulfil the user scheduling request and is never sold, shared or used for advertising purposes. Our use of Google data complies with the Google Limited Use Requirements.