Privacy Notice
Yoshimitzu Calderón Mozqueda, operating commercially under the brand YCM360 (the "Controller"), with address at Calle Mirador 404, Col. V. Carranza, C.P. 26070, Piedras Negras, Coahuila de Zaragoza, Mexico, is responsible for the processing of your personal data, under Mexico's Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), published in the Official Gazette of the Federation on 20 March 2025 and last amended on 14 November 2025, and other applicable regulations.
1. Personal data collected
Depending on the channel you use to reach us:
| Channel | Data |
|---|---|
| Your phone number, the name shown on your WhatsApp profile, and the full content of the messages you send, whether text or voice notes. Voice notes are converted to text so they can be read. If you provide them in the conversation: your name, your email, your company's name and industry, your department and the size of your operation, the challenge you describe, and an alternate contact number | |
| Call scheduling | Full name, work email, phone, company, role, industry, department, size of your operation, the challenge you describe, what you have already tried, and how urgent it is |
| Whatever you include in your message | |
| Client portal | Your email address and the access record (date and outcome of the attempt). Your password is not retained in readable form |
Sensitive personal data: none is collected. The automated assistant is expressly instructed not to request passwords, banking details, or identity documents.
Cookies and tracking. This site uses no cookies, no analytics tools, and no social media pixels. It stores two of your preferences in your browser (language and reduced motion), which do not identify you and never leave your device.
Other people's data. If you provide us with a third party's data during the conversation (for example, a partner's or your accountant's phone number), you represent that you are authorized to do so and undertake to inform them of this Notice.
Minors. These services are addressed to adults acting in a professional capacity. Minors' data is not knowingly collected. If we detect that we have received a minor's data, it is deleted.
2. Purposes of processing
Primary purposes, necessary in order to assist you: to answer your query, to understand your operation so we can quote, and to schedule and hold a call.
Secondary purpose, not necessary in order to assist you: to follow up commercially once your request has been resolved. You may refuse this purpose at any time, by the means set out in section 4, without this affecting how your query is handled or any call you have scheduled.
Automated decisions. The assistant that replies to you on WhatsApp is generated by a language model. Your data is not used to make automated decisions producing legal effects concerning you or similarly significantly affecting you: the assistant informs and takes note, and every commercial decision is made by a person. Your voice notes are also transcribed automatically, solely so that what you said can be read.
Should your data be needed in the future for a purpose other than those stated here, fresh consent will be requested beforehand.
3. Transfers
Your data is not transferred to third parties for those third parties' own purposes. To deliver the service, the Controller relies on processors that handle data on its behalf and under its instructions (see section 6), which does not constitute a transfer.
The processors listed in section 6, and any sub-processors they use, are incorporated outside Mexico and their data centers operate in the United States and in Europe. Your data is processed there on behalf of and under the instructions of the Controller.
If at any point a provider were to process your data for its own purposes, that would cease to be processing on our behalf and would constitute a transfer; in that case you would be informed and your consent would be requested before it took place.
4. How to limit the use of your data and how to exercise your ARCO rights
To stop receiving commercial follow-up, you only have to ask: you can tell the assistant on WhatsApp, reply to any message of ours asking for it, or write to [email protected]. You do not need to prove your identity or wait any period of time. We stop contacting you for commercial purposes; your query is still handled, and your data is retained for the periods set out in section 5.
To exercise your ARCO rights, which is a different and broader matter, the procedure is as follows.
You may exercise your rights of Access, Rectification, Cancellation and Opposition (known in Mexico as ARCO rights), as well as withdraw your consent, by writing to [email protected].
Your request must include your name, a means of replying to you, a document proving your identity, and a clear description of the data and of the right you wish to exercise.
If your request does not include those elements, we will let you know within five business days of receiving it, so that you can complete it. In that case, the period described in the next paragraph starts to run on the day we receive what was missing.
We will communicate our determination within a maximum of 20 business days from the date we receive your complete request, and where the request is well founded, we will give effect to it within 15 business days following that communication.
If you are not satisfied with our response, you may turn to the Personal Data Protection Unit of Mexico's Ministry of Anti-Corruption and Good Governance (Unidad de Protección de Datos Personales de la Secretaría Anticorrupción y Buen Gobierno).
5. Retention and deletion
Your data is retained for as long as a relationship or an active request of yours exists, subject to the following maximum periods per channel, after which it is blocked and then deleted. Blocking is the period during which the data is no longer used and is kept only in case a legal responsibility remains pending:
| Channel | Data | Period |
|---|---|---|
| The text of conversations | 90 days | |
| The transcript of your voice notes | 90 days, along with the rest of the conversation | |
| Your contact details and the summary of your request | 2 years from your last contact | |
| Call scheduling | Your complete booking, including questionnaire answers | 2 years |
| Call scheduling | The technical copy sent by the scheduling platform | 90 days |
| Client portal | Password recovery requests | 30 days |
| Client portal | Your account | For as long as the contractual relationship lasts |
| The correspondence we exchange | 2 years from last contact |
The periods for the first four rows and for recovery requests are enforced by automated processes. Email correspondence is cleared in an annual review.
The audio file of your voice notes is not retained in our systems: it is transcribed and discarded, and what is stored is the resulting text. The provider that performs the transcription may retain it for up to 30 days under its own policy, and WhatsApp retains its copy under Meta's policies.
The document proving your identity when exercising your rights (section 4) is retained only for as long as your request is being handled, and is deleted once it is closed. It is not used for any other purpose and is not added to your contact record.
When you request cancellation of your data, deletion from active systems takes place within the period stated in section 4. Backup copies are overwritten according to their rotation cycle, so complete deletion takes effect once that cycle ends.
6. Processors
As of the last-updated date of this notice, technical processing relies on the following processors, which handle data on behalf of and under the instructions of the Controller. If any of them changes, this table is updated and the date at the foot reflects it:
| Processor | Purpose |
|---|---|
| Meta Platforms | Operation of the WhatsApp channel you write to |
| Anthropic | Generation of the automated assistant's replies. The text of your messages is sent to it in order to produce each reply, and its commercial terms state that such content is not used to train its models |
| Cal.com | Form and management of call scheduling. Receives your name, your email, your phone number, your company, and the reason for the call |
| Contabo | Hosting of the server and the database where your data is stored. The data center is operated by Contabo Inc., its sub-processor in the United States |
| Storage of the database backup copies, and the calendar where the scheduled call is recorded, with your name and your email | |
| OpenAI | Transcription to text of the voice notes you send via WhatsApp. Receives only the audio file. Its terms for business use state that data submitted through its API is not used to train its models, and is retained for a maximum of 30 days |
| Hostinger | Operation of @ycm360.com email, including the mailbox through which you exercise your rights |
7. Changes to this notice
This notice may be updated. Changes will be published on this same page, and the date of the latest update is shown at the foot.
Last updated: 19 August 2026.