Privacy Notice

This Privacy Notice explains how Sara Maria Mendoza Alvarez (“Sara Mendoza,” “I,” “me,” or “my”) collects, uses, stores, and shares personal information through saramendoza.com, inquiry forms, communications, client onboarding, and the provision of design services.

1. Who is responsible for your information?

The person responsible for processing your personal information is:
Sara Maria Mendoza Alvarez
Independent professional operating as a persona física under Mexico’s RESICO regime
Mexico City, Mexico
Email: hello@saramendoza.com

This Privacy Notice is issued in accordance with Mexico’s Ley Federal de Protección de Datos Personales en Posesión de los Particulares and other laws that may apply to a particular person or processing activity.

2. Information I collect

The information collected depends on whether you are visiting the website, submitting an inquiry, discussing a potential project, or engaging me to provide services.

Website and technical information

When you visit the website or an embedded form, the website platform and service providers may automatically receive limited technical information, such as:

• IP address;
• browser and device information;
• operating system;
• requested pages and URLs;
• dates, times, and duration of activity;
• security and diagnostic information; and
• cookie or similar-technology identifiers.

Inquiry information

When you submit an inquiry, I may collect:

• first and last name;
• email address;
• business or company name;
• website address;
• optional social-media profile;
• services in which you are interested;
• information about your business, audience, brand, and project;
• challenges you are experiencing with your current brand;
• reasons you are interested in working with me; and
• any other information you choose to include in your responses or subsequent communications

Please do not provide sensitive personal information that is not necessary for your inquiry.

Prospective-client and scheduling information

If we discuss a potential project, I may also collect:

• telephone number;
• scheduling preferences;
• calendar and meeting information;
• communications relating to project suitability, availability, scope, timing, and budget; and
• notes from discovery calls or related correspondence.

Client and project information

If an inquiry progresses toward a client engagement, I may collect:

• legal name;
• company name, if applicable;
• telephone number;
• mailing address;
• city and country of residence;
• project email address;
• proposal selections and project scope;
• contract contents and electronic-signature records;
• invoice and payment records;
• preferred payment processor;
• project questionnaires, communications, files, feedback, and approvals;
• client-portal account information; and
• other information reasonably necessary to establish, administer, and complete the engagement.

Clients may be required to create an account directly with Tezzera using an email address and password. Tezzera manages those login credentials. I do not receive or have access to your complete password.

Payment information

Payments may be processed through Stripe or PayPal. Complete payment-card, bank-account, and payment-authentication credentials are intended to be collected directly by the selected payment processor rather than by me.

I may receive and retain limited transaction information, such as:

• processor selected;
• invoice and payment amount;
• billing contact details;
• payment date and status;
• transaction reference; and
• records of refunds, disputes, or failed payments.

For information about how payment credentials are handled, please review the privacy notice of the payment processor you select.

3. How I use your information

I use personal information for the following primary purposes:

• receiving, reviewing, and responding to inquiries;
• determining whether a potential project is a suitable fit;
• communicating about services, availability, scope, timing, and next steps;
• scheduling and conducting discovery calls and project meetings;
• preparing and delivering proposals;
• entering into and administering contracts;
• creating and managing client-portal access;
• issuing invoices and facilitating payments;
• providing brand, website, and related design services;
• communicating with clients and managing projects;
• maintaining records of decisions, feedback, approvals, and deliverables;
• providing customer support;
• protecting accounts, communications, contracts, and transactions;
• preventing fraud, abuse, unauthorized access, and security incidents;
• establishing, exercising, or defending legal rights;
• complying with tax, accounting, contractual, and other legal obligations; and
• maintaining necessary business and professional records.

I do not currently use inquiry information to send newsletters or general promotional marketing. If I introduce a newsletter or similar marketing communication, I will request a separate optional subscription and update this Privacy Notice as appropriate.

I do not sell personal information.

I do not personally use automated systems to accept or reject potential clients or to make decisions that produce legal or similarly significant effects.

4. Legal grounds and consent

Depending on the circumstances and applicable law, information may be processed:

• with your express or implied consent after this Privacy Notice has been made available;
• to take steps at your request before entering into a contract;
• to establish, perform, and administer a contractual relationship;
• to comply with tax, accounting, legal, or regulatory obligations;
• to protect my legitimate business and legal interests, provided those interests do not override applicable privacy rights; or
• under another ground permitted by applicable law.

You may withdraw consent where processing depends on consent. Withdrawal will not operate retroactively and may not affect information that must be retained or processed to fulfill a contract, comply with law, resolve a dispute, or protect legal rights.

5. Service providers and international processing

I use third-party providers to operate the website, receive inquiries, communicate, schedule meetings, administer projects, enter into contracts, and process payments.

These providers may include:

• Showit, for the website;
• Tezzera, for forms, lead and client management, proposals, contracts, invoicing, project administration, and the client portal;
• Google Workspace and Google Calendar, for email, communications, and scheduling;
• Zoom, for calls and meetings;
• Stripe, for payment processing; and
• PayPal, for payment processing.

These providers may use additional service providers and infrastructure to deliver their services. Their own handling of information is governed by their contracts and privacy notices.

The Tezzera platform states that it hosts information in the United States and uses service providers to operate its platform. Information submitted through Tezzera may therefore be processed and stored in the United States. You can learn more in Tezzera’s Privacy Policy.

Information may also be processed in other countries in which the relevant provider or its service providers operate. Those countries may apply privacy laws different from those in your country of residence. Where required, I will rely on appropriate contractual or legal mechanisms for international processing.

I may also disclose information:

• when required by law, legal process, or a competent authority;
• when reasonably necessary to protect a person, my services, or my legal rights;
• in connection with professional advice, claims, or disputes; or
• as part of a legitimate business transfer, subject to appropriate confidentiality and privacy protections.

6. Cookies and similar technologies

The website and embedded services may use cookies or similar technologies required for security, network delivery, session management, form operation, client authentication, and other essential functions.

I do not currently use Google Analytics, Meta Pixel, behavioral advertising, retargeting, or similar advertising technology on my website.

You may be able to restrict cookies through your browser settings. Disabling essential technologies may prevent forms, portals, or other features from operating correctly.

7. Information about Tezzera’s platform processing

Tezzera provides the embedded inquiry form and is expected to provide client-management functionality used in future engagements.

Tezzera’s Privacy Policy states that its platform may process form responses, client-generated content, account information, IP addresses, browser and device information, activity records, and related technical data. It also states that it may use limited lead and workflow information for analytics, including certain AI-supported analytics.

I do not use Tezzera or any other service to make automated decisions about whether to work with a prospective client. Additional information concerning Tezzera’s platform practices is available directly from Tezzera.

8. Retention

I retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Notice, including legal, tax, contractual, security, and dispute-resolution requirements.

As a general standard:

• inquiries that do not result in a client engagement will ordinarily be retained for up to 12 months after the last substantive communication;
• information may be retained longer when you request continued communication or when it is reasonably necessary to document an important business or legal matter;
• contracts, invoices, transaction records, and information required for tax or accounting purposes will ordinarily be retained for at least five years, calculated in accordance with applicable legal requirements; and
• client and project records may be retained for approximately five years after the engagement, or longer when reasonably necessary to fulfill an ongoing obligation, preserve agreed portfolio or intellectual-property rights, resolve a dispute, or comply with law.

At the end of the relevant period, information will be deleted, anonymized, or securely isolated unless continued retention is permitted or required.

Information deleted from active systems may remain temporarily in restricted backups until those backups are overwritten under the provider’s ordinary retention process.

9. Security

I use reasonable administrative, technical, and organizational measures appropriate to the nature of the information processed. These measures include controlled account access, password management, encrypted password storage through a password manager, two-factor authentication where supported, and the security controls supplied by service providers.

No online service or storage system can guarantee absolute security. If I learn of a security incident that significantly affects your rights or interests, I will investigate and provide notice as required by applicable law.

10. Your privacy rights

Under Mexican law, you may exercise rights of:

• Access: request confirmation of and access to personal information held about you;
• Rectification: request correction of inaccurate, incomplete, or outdated information;
• Cancellation: request cancellation and, where applicable, deletion of information;
• Opposition: object to particular processing in circumstances permitted by law;
• Limitation: ask to limit the use or disclosure of your information; and
• Revocation: withdraw consent where the processing is based on consent.

Depending on where you live and which law applies, you may also have rights concerning erasure, restriction, portability, objection, or complaints to an appropriate privacy authority.

To exercise a right, email hello@saramendoza.com with the subject line “Privacy Request.”

Your request should include:

• your name;
• an email address or other means for receiving a response;
• sufficient information to verify your identity;
• a clear description of the information involved; and
• the right or action you wish to exercise.

If someone submits a request for you, I may require evidence of their authority and reasonable verification of both identities.

I will respond within the periods required by applicable law. Under Mexican law, a determination concerning an ARCO request will ordinarily be communicated within 20 business days after receipt of a complete request. If the request is approved, it will ordinarily be implemented within the following 15 business days. These periods may be extended where permitted by law.

A request may be denied or limited when retention or processing remains necessary for an existing contract, legal obligation, tax requirement, legal claim, security purpose, or another exception permitted by law. If that occurs, I will explain the applicable reason where required.

11. Children’s information

The website and services are intended for adults and are not directed to children under 18. I do not knowingly solicit personal information from children.

If you are a parent or guardian and believe a child has submitted personal information, contact hello@saramendoza.com so that I can review and, where appropriate, delete it.

12. Third-party websites and services

The website, communications, or client workflow may link to services operated by other organizations. Their privacy practices are governed by their own notices and are not controlled by this Privacy Notice.

Relevant notices include:
Tezzera Privacy Policy
Google Privacy Policy
Zoom Privacy Statement
Stripe Privacy Policy
PayPal Privacy Statement

13. Changes to this Privacy Notice

I may update this Privacy Notice to reflect changes in my services, providers, technology, or legal obligations.

The current version will be published on the website with a revised “Last updated” date. Material changes affecting information already collected will be communicated through additional means when required by law.

14. Contact

For privacy questions, requests, or concerns, contact:
Sara Maria Mendoza Alvarez
Email: hello@saramendoza.com