PRIVACY
POLICY.

1. Responsible party

Eric Zamudio Gallegos, operating under the Kreative Studio brand, is the responsible party for personal information collected directly through this website and the KREATIVE AI project brief, subject to the applicable Mexican private-sector privacy framework.

Privacy domicile: 4a Sur Oriente 906, Colonia Terán, C.P. 29059, Tuxtla Gutiérrez, Chiapas, México.
Business operations: Playa del Carmen, Quintana Roo, Mexico.
Privacy contact: hello@kreativestudio.com.mx
WhatsApp: 9841978406

2. Personal information we collect

Depending on how you contact us, we may process information that you voluntarily provide, including:

• full name and company or brand name;
• email address, WhatsApp or telephone number, and preferred contact method;
• service interest, project summary, objectives, budget context and timeline;
• website or social-media URL;
• files, brand materials, images, copy or other content you later choose to send through an appropriate communication channel; and
• follow-up communications related to an inquiry or project.

The public project brief does not request government identification, passwords, payment-card data, financial credentials or sensitive personal data. Please do not place sensitive, confidential or unnecessary personal information in the KREATIVE AI chat or project brief.

3. KREATIVE AI chat

KREATIVE AI is an automated assistant used to answer questions about Kreative Studio and help visitors explore potential project needs. Chat messages and the recent conversation context needed to generate a reply are sent from our server to OpenAI's API.

Kreative Studio does not automatically retain ordinary KREATIVE AI conversations. When a visitor chooses to submit the brief and checks the consent box, recent context may be used to generate and retain a structured sales summary linked to the contact; the complete conversation is not copied into the database.

Our server requests OpenAI responses with application-state storage disabled for the response request. OpenAI states that API data is not used to train its models unless the API customer explicitly opts in, while default abuse-monitoring logs may retain API inputs and outputs for up to 30 days unless a different approved data-retention control applies. OpenAI's own current data controls govern that provider-side processing.

4. KREATIVE AI project brief

The START A PROJECT form may be prefilled with information the visitor already shared in the chat. A record is written only after the visitor reviews the details, checks the consent box and successfully submits the brief.

The stored record is limited to the structured fields needed to understand and respond to the inquiry, a sales summary of recent context, follow-up recommendations, a random conversation identifier, consent version and timestamp, source, creation timestamp and internal lead status.

The lead database intentionally does not store the complete transcript, IP address, browser user-agent, geolocation, cookies, API keys, passwords or local/server file paths.

5. Purposes of processing

Primary purposes directly related to the inquiry or potential relationship are to:

• receive and respond to project inquiries;
• understand requirements and recommend relevant Kreative Studio services;
• contact the visitor through the method they selected;
• prepare consultations, scopes, proposals or estimates;
• maintain records necessary to manage an inquiry or resulting client relationship;
• protect the website, communications and systems from abuse or security incidents; and
• comply with applicable legal obligations and lawful requests.

Secondary marketing purposes: the KREATIVE AI project brief does not subscribe you to newsletters, advertising lists or unrelated promotional campaigns. If we later want to use your information for a separate marketing purpose that requires consent, we will request that consent separately.

6. Consent, refusal and limitation of use

The project brief requires an affirmative checkbox before submission. You may review and correct any prefilled details, or choose not to submit the form if you do not want the structured project information, contact details and sales summary stored for the purposes described above.

You may request that we limit use or disclosure of your personal information, or revoke consent where processing depends on consent, by emailing hello@kreativestudio.com.mx with the subject “Privacy Request”. A revocation does not retroactively invalidate processing already carried out and may be subject to legal or contractual retention obligations.

7. Hosting, technical logs, cookies and similar technologies

The website and lead database are hosted using Hostinger infrastructure. Hosting and security systems may generate ordinary technical records needed to deliver and protect the service, such as IP address, timestamps, requested paths and browser/network information. Those infrastructure records are separate from the structured KREATIVE AI lead database.

As currently implemented, Kreative Studio does not intentionally deploy advertising pixels or third-party analytics trackers on this website. If non-essential analytics, advertising or personalization technologies are added later, this Policy and any consent mechanism required by applicable law will be updated before their use.

8. Service providers, remissions, transfers and third-party platforms

We use technology providers to operate the website and communications. This currently includes Hostinger for hosting/database infrastructure and OpenAI for KREATIVE AI response generation. These providers may process information on our behalf according to the services used, their contractual terms and applicable law.

This website also links to independent services such as WhatsApp, Gmail and social networks. When you choose to leave our website or communicate through those platforms, the platform provider processes information under its own privacy terms and systems.

Some providers may process information outside Mexico. Any national or international remittance or transfer of personal information will be handled subject to the requirements and exceptions of applicable Mexican law. We do not sell personal information as a commercial database.

9. Retention and deletion

Our current operational retention schedule for a project-brief lead that does not become a client relationship is up to 12 months from the last substantive contact. After that period, the structured lead record should be deleted unless a documented legal, contractual, security or dispute-related reason requires longer retention.

If an inquiry becomes a client relationship, relevant records may be retained for the duration of that relationship and for any additional period required by applicable contractual, accounting, tax, limitation or other legal obligations. Records subject to a valid cancellation request will be blocked and deleted when legally appropriate.

Kreative Studio does not maintain its own database copy of complete ordinary KREATIVE AI chat transcripts. Only after a consented brief submission may the linked sales summary be retained under the same schedule. Provider-side retention for API processing and hosting/security logs follows the applicable provider configuration and policies described above.

10. Security and confidentiality

We use administrative and technical measures appropriate to the nature of the information and the way it is processed. The lead endpoint applies same-origin controls, validation, request-size limits, rate limiting and parameterized SQL statements; database credentials are kept in server-side environment variables and are not exposed to browser JavaScript.

No online system can be guaranteed to be completely secure. If a security incident affecting personal information requires notice under applicable law, we will take the required steps and communicate with affected persons as appropriate.

11. ARCO rights

Under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares, people may exercise rights of Access, Rectification, Cancellation and Opposition (ARCO).

To make a request, email hello@kreativestudio.com.mx with the subject “Privacy / ARCO Request” and include:

• your name and a means to receive our response;
• documents reasonably necessary to verify your identity and, if applicable, representation;
• a clear description of the personal information involved;
• the ARCO right you want to exercise or the action requested; and
• any information that reasonably helps us locate the relevant records.

The current federal law provides a maximum period of 20 days from receipt of an ARCO request to communicate the determination and, when the request is granted, an additional period of up to 15 days to make it effective, subject to the extensions and exceptions permitted by law.

12. Children and sensitive information

The public Kreative Studio website is directed to professional and business-service inquiries and is not designed for children. We do not intentionally request sensitive personal data through KREATIVE AI or the project brief.

If we learn that information requiring special authorization has been submitted without the authorization required by law, we will take reasonable steps to restrict, delete or otherwise address it as appropriate.

13. Changes to this Privacy Policy

We may update this Policy when our website, KREATIVE AI, service providers, data practices or legal obligations change. The current version will be posted at this same URL with its latest update date. Where a material change requires new consent, we will request it before using personal information for the new purpose.

14. Questions and competent authority

Questions about this Policy or our handling of personal information can be sent to hello@kreativestudio.com.mx.

The current federal framework assigns private-sector personal-data oversight functions to Mexico's Secretaría Anticorrupción y Buen Gobierno. Nothing in this Policy limits rights or remedies available under applicable law.