Privacy notice

In short

• We use your data to give you access to courses, issue your certificates, charge and invoice.
• We don't sell your data or use third-party advertising or trackers.
• If your company invited you, it can see your progress and certificates for the courses it assigned.
• You can ask to see, correct or delete your data by writing to privacidad@humanidades.mx.

1. Who is responsible for your data

[Razón social de HumanidadEs, S.A.S. de C.V.], located at [Domicilio fiscal completo], Ciudad de México, México, tax ID (RFC) [RFC], is responsible for processing your personal data.

For any privacy matter, write to privacidad@humanidades.mx.

2. What data we collect

Depending on how you use HumanidadEs, we may process:

• Identification and contact: name and email address.
• Sign-in: we don't use passwords. You sign in with a link we email you or with your Google account. If you choose Google, Google shares your name, email and, where available, your profile photo; we never receive your Google password.
• Learning: enrolled courses, lessons watched, progress, last activity date, certificates issued, reviews you publish and reports you send.
• Work data (only if your company invites you): department, job title, assigned courses and due dates. Your company provides this data.
• Payment: for individual purchases, the payment processor receives your card details directly; we only keep the purchase record. For business plans we keep the card brand, last four digits and expiry date.
• Invoicing: tax ID (RFC), legal name, tax regime, CFDI use, postal code and the email that receives invoices.
• Sales contact: company name, number of people, name and email when you request a quote or join a waitlist.
• Technical data: IP address, browser type and access logs generated by our servers to run and protect the service.

We don't request sensitive personal data (for example ethnic origin, health, beliefs or sexual orientation). Please don't include it in reviews or comments; if it is published, we may hide it.

3. Why we use your data

Primary purposes, required to provide the service:

• Create and manage your account and identify you when you sign in.
• Give you access to the courses you bought or your company assigned, and save your progress.
• Issue completion certificates and let anyone check their authenticity with the code.
• Process payments, issue invoices (CFDI) and meet tax obligations.
• Send transactional emails: welcome, invitations, assigned courses, due-date reminders, certificates and receipts.
• Provide your company with progress and certificate reports for the courses it assigned you.
• Handle support requests, content reports and ARCO requests.
• Keep the service secure, prevent fraud and comply with requests from competent authorities.

Secondary purposes, not required for the service:

• Send you information about new courses or HumanidadEs news.
• Produce aggregated, anonymous statistics to improve the courses and their accessibility.

If you don't want us to use your data for secondary purposes, write to privacidad@humanidades.mx at any time. Opting out doesn't affect your access to courses.

4. If your company invited you

When you join HumanidadEs through your company's invitation, the company contracts the service for its staff. To fulfil that contract, we share with the people in charge of training at your company:

• Your name, email, department and job title.
• Whether you accepted the invitation and your last activity date.
• Your progress percentage and whether you completed each course it assigned you, with its due date.
• The certificates for those courses, with their verification code.

Your company doesn't see courses you buy on your own, your reviews or your payment data. If you leave the company or your access is removed, you keep the certificates already issued.

5. Who we share your data with

We don't sell or rent your data. We only share it:

• With your company, as described in the previous section, to fulfil the contract you are part of.
• With Mexico's tax authority (SAT), through our authorized certification provider, when we issue an invoice.
• With competent authorities, when a law or a duly grounded order requires it.
• With the public, in a limited way: anyone with a certificate code can see the holder's name, the course and the issue date. Reviews are published with the name on your profile.

These transfers don't require your consent because they are needed to fulfil a contractual relationship or a legal obligation.

We also work with providers (processors) that handle data only on our behalf and under our instructions:

• Supabase: authentication and database.
• Railway and Amazon Web Services: hosting and delivery of the website and platform.
• Mux: course video streaming.
• Stripe: card payment processing.
• Postmark: email delivery, including sign-in links.
• Facturama: electronic invoice (CFDI) certification.

Some of these providers store data on servers outside Mexico, mainly in the United States, with security measures equivalent to those required by Mexican law.

6. Your ARCO rights and how to exercise them

You have the right to know what data we hold about you (Access), to correct it if it is inaccurate (Rectification), to ask us to delete it (Cancellation) and to object to certain uses (Opposition). You can also revoke your consent or limit the use of your data.

To exercise them, email privacidad@humanidades.mx with:

• Your name and the email linked to your account.
• A copy of an official ID; if someone acts on your behalf, also the document proving it.
• The right you want to exercise and a clear description of the data involved.
• For rectification, the correct data and, if applicable, a supporting document.

We will reply within 20 business days at most. If the request is granted, we will carry it out within 15 business days of our reply. These periods may be extended once where the law allows.

We cannot delete data we must keep by law (for example tax records). If you cancel your certificate data, the certificate can no longer be verified.

If your company invited you, you can also send your request to your company's HR team.

7. Cookies and browser storage

We only use cookies and local storage that the service needs to work:

• Session: keeps you signed in across the website and the platform.
• Accessibility preferences (he_prefs): remembers text size, high contrast, reduced motion and language.

We don't use advertising cookies or third-party analytics. If we add them in the future, we will update this notice and ask for your consent where required.

You can delete cookies in your browser; if you do, you will need to sign in again and choose your preferences again.

8. How long we keep your data

• Account and learning data: while your account is active. If you ask us to delete it, we delete or anonymize it within 30 days, except as noted below.
• Certificates: kept so they can be verified, unless you request their cancellation.
• Payment and invoicing data: for the period required by tax law, generally five years.
• Sales contacts and waitlists: up to 24 months, or until you ask us to delete them.
• Technical logs: up to 90 days, unless needed to investigate a security incident.

9. How we protect your data

We apply administrative, technical and physical safeguards: encrypted connections (HTTPS), role-based access, signed and time-limited video links, and providers with recognized security certifications.

If we detect a breach that significantly affects your rights, we will notify you without delay so you can take action. To report a security issue, write to seguridad@humanidades.mx.

10. Minors

HumanidadEs is intended for people aged 18 or over. If you are a minor, you may only use the service with the consent of your parent or guardian. If we learn that we collected a minor's data without that consent, we will delete it.

11. Changes to this notice

We may update this notice because of changes in the law, our services or our providers. We will publish the current version on this page with its update date. If the change is significant, we will also let you know by email or inside the platform.

12. Authority

If you believe your right to personal data protection has been violated, you can contact the competent authority, currently Mexico's Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno).