Privacy notice

What we do with your data.

Last updated: November 8, 2026. Version history.

1. Data controller

Prontazo, S.A. de C.V. (a company in formation), which operates Prontazo.com, with its address at Avenida Central 46, Col. Nueva Industrial Vallejo, Gustavo A. Madero, 07700, Mexico City, is the controller of the personal data we collect on this site, on the websites it creates and on WhatsApp, under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties. For any matter regarding your data, including your ARCO rights, contact us by email at prontazo.com@gmail.com or on WhatsApp (from the contact button on our site).

2. What data we collect

• To create your website: your WhatsApp number, your business name, your type of business, your city and what you tell us about your business. If you tell us by voice, the audio is converted to text on the spot; the recording is not kept, only the text.
• If you message us on WhatsApp: your number, your profile name and the messages, photos and documents you send us. Voice notes are converted to text; we don’t keep the audio.
• If you request the Business or Full Pro plan: your name, your email, the domain you want, whether you have a logo, whether you need an invoice and your notes; if you request an invoice, your tax details.
• If you pay for a plan: your card details are captured and stored by Stripe; we don’t see them. From Stripe we receive the status of your payments and the last four digits of your card, to notify you of your charges.
• If you sign in to your dashboard (My Prontazo): we send a single-use sign-in link to your WhatsApp or email (no password) and, once you’re in, your browser stores a session cookie that lasts 30 days and only serves to recognize you. We keep the changes you publish and a version history of your website.
• If you sign up for the online store: the connection with your Mercado Pago account (its identifier and the authorization to create your store’s charges) and your buyers’ data (name, phone, delivery address and orders). We process that buyer data on behalf of your business, which is its controller; we use it only to operate your store.
• If you sign up for the Full Pro plan: the data of the people you give access to your portal (name, email and role) and what you publish in it. You decide who gets in and you are responsible for having their consent; if they are minors, that of their parents or guardians.
• Which ad or campaign you came from: we explain it in section 4.
• Technical data: your IP address is used for one hour to limit abuse and is not associated with your website. For page reports and publishing limits we keep only an encrypted fingerprint of the IP and the email, which cannot be used to recover them.

3. What we use it for

Purposes necessary to provide the service:

• Building, publishing and maintaining your website, and operating your portal if you sign up for the Full Pro plan. Your WhatsApp appears on your website as a contact button, because that’s what you create it for.
• Assisting you on WhatsApp. You are answered by an automated artificial intelligence assistant, which also applies the changes you ask for. When it can’t resolve something (a payment, a complaint or a legal matter), it hands the conversation over to an authorized person at Prontazo.
• Writing to you on WhatsApp or by email about your website, your plan and your payment.
• Charging you for your plan and issuing your invoice if you request one.
• Showing you in your dashboard how many people visit your website, where they come from (search engine, social network, direct) and how many tap your contact buttons. These are daily counters, without cookies and without data about who visits your website: we don’t know who they are and we don’t follow them to other sites.
• Measuring, in aggregate and without identifying you, how many people visit the site and create their website.

Secondary purpose (you can refuse without losing the service): measuring which ad you came from and reporting your purchase to Meta to measure and optimize our ads (section 4). To refuse, use prontazo.com/no-contactar or email us at prontazo.com@gmail.com.

4. Advertising and measurement

We don’t sell your data or share it so others can advertise to you. What we do to measure our own ads:

• Which ad you came from. If you arrive at Prontazo.com from an ad or a campaign link, we store the campaign data carried by the link (utm parameters), Meta’s click identifier (fbclid) or Google’s (gclid), the page you landed on and the date. Your browser keeps them for 30 days and sends them with your website if you create one. If you message us on WhatsApp from a Meta ad, we store that ad’s identifier, its title and your click identifier (ctwa_clid). That’s how we know which ad brings in customers and how much each one costs us.
• Purchase events to Meta. If you came from a Meta ad and sign up for a plan, we send Meta, through its Conversions API, a purchase event with the amount and currency, to measure and optimize our ads. If you came through WhatsApp, the event carries your click identifier and our WhatsApp Business account identifier; if you came to our site, it carries Meta’s click identifier and your phone number converted into a code with a SHA-256 hash (your number does not travel as is). We don’t send your name, your email, your business name or your messages. Meta may use those events in accordance with its own policies.
• Google: we don’t send it events; we use Google’s click identifier only for counting in our dashboard.

How to object: at prontazo.com/no-contactar check “Don’t use my data to measure your ads” with your WhatsApp number, or email us at prontazo.com@gmail.com. From that moment on we don’t send your events to Meta. You can delete the campaign data your browser stores from its settings. Objecting doesn’t change your service.

5. Who it’s shared with

We use these providers to operate. They process your data on our behalf and only for what is stated:

• Cloudflare: hosts the site and the websites, the database and the photos; sends our emails; registers domains, and its artificial intelligence (Workers AI) transcribes voice notes and helps write and review websites.
• Anthropic: its artificial intelligence model (Claude) writes your website, applies the changes you ask for and replies on WhatsApp. It receives what you tell us about your business and the messages in the conversation.
• Meta (WhatsApp Business): carries the WhatsApp messages between you and Prontazo. It also receives the purchase events in section 4.
• Stripe: charges for the plans and captures your card details.
• Mercado Pago: if you have an online store, it charges your buyers into your business’s Mercado Pago account, in your business’s name and not Prontazo’s.
• Facturapi: issues your invoices (CFDI) once our invoicing is enabled; it receives your tax details and those of your payment.
• Google: the site and the websites use Google Fonts typefaces, and websites may show a Google Maps map. When they load, your browser connects to Google, which receives your IP address and technical data about your browser. The map only loads if you open it.
• The registry for your domain’s extension (for example, NIC México for .mx) receives the domain holder’s data.
• Authorities, only when the law requires it (for example, the SAT, Mexico’s tax authority).

International transfer: these providers process data in the United States and may do so in other countries. By using Prontazo, your data is transferred to the United States for the purposes of this notice. Meta and Google may also process what they receive in accordance with their own privacy policies. If we add a provider that receives your data, we add it here before using it.

6. Businesses in INEGI’s directory (data you didn’t give us)

This section is for businesses that haven’t given us their data. Prontazo consults INEGI’s National Statistical Directory of Economic Units (DENUE), a public directory of businesses (INEGI is Mexico’s national statistics office). From it we take, only for businesses that don’t have a website, the business name and legal name, its type of business, its address, the phone number and email the directory publishes, its size and its registration date.

• What for: to prepare a private preview of what your business’s website would look like (it isn’t published or shown in search engines; it only opens with its link) and, where applicable, to offer it to you.
• Why we can use it: it is business data that INEGI publishes in a publicly accessible source, and we use it only for this purpose.
• If we contact you, in that first message we tell you where your data came from and give you the link to this notice and to the do-not-contact list.
• So we don’t contact you: go to prontazo.com/no-contactar and leave your business phone or email, or email us at prontazo.com@gmail.com. We add it to our do-not-contact list, honor it in every message we send (even if the directory brings your business up again) and delete the preview made for you. From that list we keep only your phone or email, so we can honor it.
• We keep the directory data while it serves this purpose; you can ask us to delete it.

7. How long we keep it

While your website exists or while we have a business relationship with you. If you ask us to delete your website and your data, we do so, except for what we must keep for tax obligations. If you cancel the online store, we disconnect your Mercado Pago account and keep your orders only while your plan remains active, so you can look them up. The do-not-contact list is kept so we can honor it.

8. Your rights (ARCO)

You can ask us to access your data, rectify it, cancel it or object to its use, and also to revoke your consent or limit the use of your data. Write to us by email at prontazo.com@gmail.com or on WhatsApp (from the contact button on our site) with your name; the WhatsApp number or email you use Prontazo with; which right you want to exercise and over which data, and how you want us to reply. To protect your data, we may ask you to confirm the request from that same WhatsApp or email. We reply within the time limits set by law. If you believe we didn’t handle your request properly, you can go to the personal data protection authority (currently, the Ministry of Anti-Corruption and Good Governance).

9. Cookies and local storage

We don’t use advertising cookies. On Prontazo.com, your browser stores a key that identifies you as the person who created your website (so you can publish it from the same browser), a marker to count your visit only once and, if you came from an ad or a campaign link, that campaign’s data for 30 days (section 4). If you sign in to your dashboard, a session cookie (30 days) keeps you signed in; it’s deleted when you sign out. Business websites don’t set their own cookies on visitors; those with an online store keep only the products in the buyer’s cart in their browser, and if a visitor opens the map, Google Maps may set its own cookies. You can delete all of this from your browser settings.

10. Changes to this notice

If it changes, we publish the new version here with its date and a summary in the version history. If a change adds a purpose or a provider, we publish it before applying it.

Version history

• November 8, 2026 (current): the controller’s address and email and the means to exercise your rights; providers named with their purpose and transfer to the United States; new advertising and measurement section (source ad and purchase events to Meta) with how to object; new section for businesses in INEGI’s directory (DENUE) and the do-not-contact list; WhatsApp conversations with an artificial intelligence assistant; Google Fonts and Google Maps.
• November 1, 2026: previous version.