Privacy Policy

Last updated: March 26, 2026 · Effective: March 26, 2026

1. Who We Are

Certexi is operated by Red Sustentable Internacional S.A. de C.V. ("RSI", "we", "us"), a company organized under the laws of Mexico, with registered offices in Veracruz, Mexico.

Certexi provides Operational Evidence Infrastructure — software deployed on customer-controlled infrastructure to capture, structure, validate, seal, and govern operational records.

Contact: privacy@certexi.com

2. Scope

This policy applies to personal data we collect through:

• Our website at certexi.com and its subdomains
• Communications with us (email, forms, architecture sessions)
• Our platform when hosted by us (Certexi Cloud)

On-premise deployments: When Certexi is deployed on your own infrastructure, operational data never reaches our servers. You are the data controller for all data processed within your deployment. This policy does not apply to data stored exclusively within your infrastructure.

3. Data We Collect

3.1 Account & Contact Data

• Name, email address, organization name
• Role / title (when provided)
• Billing information (processed by Stripe; we do not store card numbers)

3.2 Usage Data

• Pages visited, features used, session duration
• Browser type, OS, device type
• IP address (truncated for analytics)

3.3 Communications

• Emails and messages you send us
• Architecture session notes and feedback

3.4 Operational Data (Cloud deployments only)

If you use Certexi Cloud (hosted by us), the platform processes operational evidence on your behalf. We act as a data processor under your instructions. A Data Processing Agreement (DPA) is available upon request.

4. How We Use Your Data

5. Data Sharing

We do not sell personal data. We share data only with:

• Stripe — payment processing
• Infrastructure providers — hosting (only for Cloud deployments)
• Legal authorities — when required by law

We do not use third-party advertising networks. We do not share operational evidence data with any third party under any circumstances.

6. Data Retention

• Account data: Retained while your account is active, plus 12 months after closure
• Usage analytics: Aggregated and anonymized after 90 days
• Operational data (Cloud): Retained per your instructions; deleted within 30 days of contract termination unless legally required
• Communications: Retained for 24 months

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Data portability
• Withdraw consent (where consent is the legal basis)

To exercise any right, contact privacy@certexi.com. We respond within 30 days.

8. International Transfers

RSI is based in Mexico. If you are located in the EEA, UK, or another jurisdiction with data transfer restrictions, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards. For on-premise deployments, no data crosses borders unless you configure it to do so.

9. Security

We implement technical and organizational measures including TLS encryption in transit, encryption at rest, role-based access controls, and regular security reviews. For on-premise deployments, security is managed by your organization under your own policies.

10. Children

Certexi is not directed at individuals under 16. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via email or a notice on our website. Continued use of the service after changes constitutes acceptance.

12. Contact

Red Sustentable Internacional S.A. de C.V.
Veracruz, Mexico
privacy@certexi.com
legal@certexi.com