Privacy Policy

1. Who is responsible for your data

The controller of your personal data is Méndez Labs, a brand operated by César Francisco Méndez García, an individual with business activity (the “Operator”, “we”), located at Clemente Amaya 1159, Col. El Rincón, Autlán de Navarro, Jalisco, Mexico. For any privacy matter, write to us at cesarfmg58@gmail.com.

2. Data we collect

We only collect the data needed to run and improve our services:

• Contact data you provide voluntarily (for example, your email when you subscribe or reach out).
• Usage and device data: pages visited, actions on the site and in the Academy, browser and device type, and recordings of your browsing session with what you type masked (see section 6).
• Payment data where applicable: processed by our payment provider (Stripe). We do not store full card numbers on our servers.
• Cookies and similar technologies for site functionality and analytics.

3. How we use your data

• Respond to your messages and requests.
• Operate, maintain and improve our sites and products.
• Send communications you requested (for example, launch notices), which you can unsubscribe from at any time.
• Process payments and subscriptions through Stripe.
• Comply with legal obligations and prevent fraud or abuse.

4. Legal basis and consent

We process your data in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, based on your consent, the performance of a contract, or our legitimate interests, as applicable.

5. Processors and third parties

We do not sell your personal data. We share data only with providers that help us operate, under confidentiality obligations:

• Stripe — payment processing.
• Google Cloud / Firebase and Vercel — infrastructure and hosting.
• Resend — email delivery.
• PostHog Inc. (United States) — product analytics and session recording, as a processor under a data processing agreement (see section 6).

6. Cookies, analytics and session recording

To understand and improve how cesarmendez.dev and the Academy are used, we use PostHog, by PostHog Inc. (United States), acting as our processor. Data is sent through our own domain and hosted in PostHog's cloud in the United States.

What we measure: the pages you visit (without any data the address may carry), specific Academy funnel actions (for example, signing up, completing a lesson, submitting a quiz with its score, or starting a payment), where on the page you click (heatmaps), and technical browser and device data. We do not measure your location: PostHog discards your IP address and we instruct it not to compute city or country.

Session recording: we record your browsing on the public site and in the Academy (movements, clicks, scrolling and what is shown on screen) to find bugs and confusing parts. Whatever you type into any field — email, password, quiz answers, notes — is recorded masked, never its content, and we also mask other students' names and posts, your name and your project. We do not record network traffic or the browser console. Recordings are kept for 30 days and then deleted.

If you have an Academy account, we identify you to PostHog only with a random internal identifier, never with your name, email or phone; alongside it we keep only your plan, your subscription status and whether you are a founder. If you have no account, we do not create a person profile: your visits are counted anonymously. When you sign out, that browser stops being associated with your account.

PostHog stores a cookie and a local storage entry in your browser (with names starting with “ph_”) to recognize the same visit and session; we do not use them for advertising or share them with third parties. We do not measure or record the site's private admin panel.

How to opt out: if your browser sends the Global Privacy Control (GPC) or Do Not Track signal, PostHog is not loaded and we measure or record nothing. You can also block or clear cookies and local storage in your browser, or email us at cesarfmg58@gmail.com to object or to ask us to delete whatever was recorded about you.

7. Retention

We keep your data only for as long as needed for the purposes described or as required by law, then delete or anonymize it.

8. Security

We apply reasonable technical and organizational measures to protect your data. No system is 100% foolproof, but we work to reduce risk.

9. International transfers

Some of our providers operate outside Mexico (for example, PostHog, Stripe, Vercel and Google Cloud, in the United States). By using our services, you understand your data may be processed in other countries under appropriate safeguards, such as data processing agreements with each provider.

10. Children

Our general services are not directed to children under 13. Products designed specifically for children (for example, Chispa) have their own privacy policy with additional protections and parental controls.

11. Your rights

You have the right to access, rectify, erase or object to the processing of your data, and to withdraw consent. To exercise them, email us at cesarfmg58@gmail.com with your request; we will respond within the timeframes set by law.

12. The Academy: account, payments and community

If you sign up for the Méndez Labs Academy we process additional data to deliver the educational service.

Payments are processed by Stripe. We do not store your card details: Stripe handles them under its own policies. We only keep your subscription status (active/inactive) and a Stripe customer identifier to manage your access.

Your posts and comments in the community are visible to other signed-in students. Do not share information there that you would not want others to see.

• Account data: name and email (authenticated with Firebase).
• Learning data: your progress, quiz results, guiding project and achievements.
• Community data: posts, comments and your Founder badge if applicable.
• Payment data: subscription status and Stripe customer ID (never your card number).
• Legal basis: performance of the service contract and your consent; you may request access, correction or deletion by emailing us.

13. Connected social accounts

The Méndez Labs Content Studio publishes to the social accounts of our own brands. To do that, the owner of those accounts (César Méndez) connects them from a private dashboard, and we store only what is required to post on their behalf.

We do not connect or process third-party accounts: only accounts owned by Méndez Labs and its products. We do not read private messages or other platform users' data.

• Platforms: TikTok, X, Threads, Instagram, Facebook and LinkedIn.
• What we store: the access and refresh tokens, the account identifier and the public username.
• Why: to upload or publish the content we generate for that brand, and to show in the dashboard which account is connected.
• Where: encrypted at rest on Google Cloud / Firebase, with access restricted to the owner.
• Revocation: the connection can be removed at any time from the dashboard or from the platform's own settings; when that happens we delete the tokens.
• Our use of information received from TikTok is also governed by the TikTok Developer Terms of Service.

14. Changes to this policy

We may update this policy. The current version will be posted on this page with its update date.

15. Contact

Questions about your privacy? Email us at cesarfmg58@gmail.com.