Privacy
Privacy Policy and Personal Data Protection
Pursuant to Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and the EU General Data Protection Regulation (GDPR)
This document describes how LegalMetrics México collects, uses, shares, and protects your personal data, as well as the rights you have as the owner of such data. The platform operates pursuant to Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and the European Union General Data Protection Regulation (GDPR).
- Version
- 1.0
- Effective date
- June 2026
- Last updated
- June 2026
- Controller
- LegalMetrics México S. de R.L. de C.V.
- Privacy contact
- privacy@legalmetrics.mx
- Website
- legalmetrics.mx
- Primary jurisdiction
- Mexico — LFPDPPP
- Secondary jurisdiction
- European Union — GDPR
1.Data Controller
LegalMetrics México S. de R.L. de C.V., domiciled in Cancún, Quintana Roo, México, is the controller of your personal data under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and the EU General Data Protection Regulation (GDPR).
Privacy contact: privacy@legalmetrics.mx
2.Personal Data We Collect
Identity and contact data:
- Full name and email address.
- Password, stored in hashed/encrypted format and never in plain text.
- OAuth provider used for sign-in, Google if applicable.
Platform usage data:
- Chat conversation history with the AI legal assistant.
- Legal topics consulted and service categories used.
- Preferred language, English or Spanish.
- Usage frequency and session duration.
Payment data:
- Card data is processed directly by Stripe, Inc. LegalMetrics does not store or access full card numbers, only the last 4 digits, card brand and expiry date for display purposes.
- Transaction history and active subscription status.
Technical data:
- IP address and approximate geolocation.
- Device type, browser and operating system.
- Pages visited, session duration and interaction events.
- Technical error logs.
3.Purposes of Processing
Primary purposes, necessary to provide the service:
- Creating, authenticating and managing your user account.
- Providing AI-powered legal guidance through the chat interface.
- Processing and managing your Free or Pro Plan subscription.
- Maintaining conversation history, Pro Plan users.
- Scheduling and managing consultations with associate attorneys via Calendly.
- Sending payment confirmations, receipts and service notifications.
- Handling technical support requests and privacy rights requests.
Secondary purposes, you may opt out without affecting service access:
- Sending communications about new features, platform updates and legal content of interest.
- Statistical analysis of usage behavior to improve the platform.
- Displaying targeted advertising on social media via Meta Pixel, Facebook and Instagram Ads.
4.Legal Basis for Processing
We process your data on the following legal bases: contractual necessity for primary purposes; consent for secondary and marketing purposes; legitimate interests for security and service improvement; and legal obligation for regulatory requirements. You may withdraw consent for secondary purposes at any time by emailing privacy@legalmetrics.mx.
| Legal basis | When it applies | Legal foundation |
|---|---|---|
| Contractual necessity | Primary purposes, service operation | Art. 7° LFPDPPP · Art. 6(1)(b) GDPR |
| Consent | Secondary purposes, marketing and advertising | Art. 8° LFPDPPP · Art. 6(1)(a) GDPR |
| Legitimate interest | Security, fraud prevention and service improvement | Art. 7° LFPDPPP · Art. 6(1)(f) GDPR |
| Legal obligation | Requests from competent authorities | Art. 10° LFPDPPP · Art. 6(1)(c) GDPR |
5.Third-Party Service Providers
We share data with the following technology service providers acting as data processors under binding data processing agreements:
| Provider | Purpose | Country | Policy |
|---|---|---|---|
| Clerk, Inc. | User authentication and session management | USA | clerk.com/legal/privacy |
| Stripe, Inc. | Payment processing and subscription management | USA | stripe.com/privacy |
| OpenAI, L.L.C. | AI engine powering the legal chat assistant | USA | openai.com/privacy |
| Supabase, Inc. | Database and conversation storage | USA | supabase.com/privacy |
| Vercel, Inc. | Website hosting and deployment | USA | vercel.com/legal/privacy |
| Calendly, LLC | Attorney consultation scheduling | USA | calendly.com/privacy |
| Google LLC, GA4 | Platform usage analytics | USA | policies.google.com/privacy |
| Meta Platforms, Inc. | Digital advertising and retargeting | USA | facebook.com/privacy/policy |
| Microsoft, Clarity | Heatmaps and session recordings | USA | privacy.microsoft.com |
| HubSpot, Inc. | Lead management and customer communication | USA | legal.hubspot.com/privacy-policy |
7.Data Retention
| Category | Retention period |
|---|---|
| Account data, name and email | While account is active + 2 years after cancellation |
| Conversation history, Free Plan | 30 calendar days per conversation |
| Conversation history, Pro Plan | Duration of active subscription + 1 year |
| Payment metadata, no card data | 5 years under Mexican tax law, CFF Art. 30 |
| Security and access logs | 12 months |
| Analytics cookies, GA4 | Maximum 14 months |
| Marketing data, Meta Pixel | Per Meta retention policy, maximum 180 days |
8.Your Privacy Rights
Under Mexican law, LFPDPPP, ARCO Rights:
- Access
- Know what personal data we hold about you and how we use it.
- Rectification
- Request correction of inaccurate or incomplete data.
- Cancellation
- Request deletion of your data once no longer necessary.
- Opposition
- Object to processing for specific purposes, especially marketing.
Additional rights for EU/EEA residents, GDPR:
- Data portability, receive your data in a structured, machine-readable format.
- Right to erasure, right to be forgotten, beyond standard cancellation.
- Restriction of processing while a dispute is being resolved.
- Right not to be subject to automated decision-making with significant legal effects.
- How to exercise your rights
- Email privacy@legalmetrics.mx with subject "Privacy Rights Request — [your name]". Include a copy of a government-issued ID. We will respond within 20 business days, Mexico — LFPDPPP Art. 32, or 30 calendar days, EU — GDPR Art. 12.
9.Data Security
We implement appropriate technical and organizational measures, including:
- TLS 1.2/1.3 encryption for all communications.
- AES-256 encryption at rest.
- Mandatory multi-factor authentication for administrators.
- Role-based access control, RBAC.
- 12-month audit logs.
- Regular vulnerability testing.
- Data processing agreements with all providers accessing personal data.
10.International Data Transfers
All technology service providers listed in Section 5 operate in the United States. Data transfers are protected by Standard Contractual Clauses, SCCs, Data Processing Agreements, DPAs, with each provider, and where applicable, adherence to the EU-U.S. Data Privacy Framework.
11.Children's Privacy
LegalMetrics is intended exclusively for users aged 18 and over. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data through our platform, please notify us immediately at privacy@legalmetrics.mx and we will delete the information promptly.
12.Nature of the Service
LegalMetrics México is not a law firm and does not provide legal services as defined under applicable law. The responses generated by our AI constitute general informational guidance only and do not constitute legal advice, create an attorney-client relationship, or represent a binding legal opinion. For specific legal matters, we recommend consulting a licensed attorney.
13.Changes to This Policy
We reserve the right to modify this Privacy Policy at any time. Material changes will be notified at least 30 calendar days in advance by email to your registered address. Continued use of the platform after the effective date of changes constitutes acceptance of the updated policy.
14.Contact and Supervisory Authorities
- Controller
- LegalMetrics México S. de R.L. de C.V.
- Privacy Department
- Office of the General Director
- Website
- legalmetrics.mx
- Office hours
- Monday to Friday, 9:00 AM – 6:00 PM CST
- Mexican Supervisory Authority
- Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales, INAI — inai.org.mx
- EU Supervisory Authority
- The data protection authority of your EU member state of residence. Full list at edpb.europa.eu