Privacy Notice

1. Controller and processor

This notice covers users in the United States and in Mexico. For Mexico it is issued under the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette (DOF) on March 20, 2025 and in force since March 21, 2025.

• Neuri LLC is the controller for the data of people who open and use a neuri.bazar account (owners, managers, cashiers and staff) and of visitors to neuri.tech. Address: [Neuri LLC postal address — pending], Phoenix, Arizona, USA. Privacy contact: [Legal contact name and email — pending] and hola@neuri.tech.
• Each store is the controller for its vendors', customers' and booth applicants' data. For that data Neuri acts as a processor / service provider: we process it only on the store's behalf and instructions. If you are a vendor or customer of a store, the store should give you its own notice; you can exercise your rights with the store or write to us and we will pass it on.

2. Data we process

Sensitive data: we do not ask for or process sensitive data (ethnic origin, health, beliefs, sexual orientation, etc.). Financial data: we do process vendors' balances, payouts, bank account and card-charge authorization; they are entered by the store or by the vendor in My Booth.

3. Why we use it

Purposes needed to provide the service

• Create and protect your account, sign you in (Google or email link) and enforce role permissions.
• Run the register, inventory, tags, layaways, returns and gift cards.
• Calculate commissions, rent, fees and balances; produce statements, reports and bank payout files.
• Charge, on the store's behalf, backup-card rent or first month's rent, only with the vendor's authorization (Stripe Connect).
• Send service notices by email and, only with consent, by WhatsApp.
• Publish to the store's Facebook/Instagram the promotions the store approves, if it connected its accounts.
• Bill stores for their plan (Stripe Billing), provide support, prevent fraud and abuse, back up data and comply with legal obligations.

Optional purposes (you can say no)

• Emailing owners about Neuri news or offers. Every such email has an unsubscribe link, or write to hola@neuri.tech. Saying no does not affect the service.
• Measuring, in aggregate, which features are used, to improve the product.

We do not sell personal data, use it for advertising, or use it to train AI models.

4. Consent

• WhatsApp: optional. Sent only to vendors the store marked as having consented; each vendor chooses WhatsApp, email or nothing and can change it or ask to stop at any time.
• Card charges: only if the vendor checks the authorization box in My Booth. We keep the accepted text and date. They can have the card removed by asking the store.
• Financial data: by entering their bank account or saving a card, the vendor expressly consents to its use for payouts and rent charges.
• You can withdraw consent as explained in Your rights.

5. Who we share it with (subprocessors)

We use these providers to deliver the service. They process data only for that purpose, under contract. Most are in the United States, so data from Mexico is transferred internationally to the US.

If the owner connects an AI assistant (Claude, ChatGPT or another), the data that assistant reads goes to that provider at the store's choice and under its terms. Beyond this, we only disclose data when a competent authority lawfully requires it.

6. How long we keep it

• While the store has an account, we keep its data to provide the service.
• When the store is closed: it is locked for 30 days (it can be restored or downloaded) and then permanently deleted; encrypted backups expire on their own within the following 30 days.
• Sign-in links: 20 minutes (24 hours for the signup link). My Booth link: expires after 90 days without use. IP for rate limiting: 1 day. Server errors and job logs: 30 days.
• Anything the law requires us to keep (for example, billing records for our plan) is kept only for the legal period.

7. Your rights

You can ask to access, correct or delete your data, or object to its use (the "ARCO" rights under Mexican law), and you can withdraw consent or limit use (for example, stop WhatsApp messages or marketing emails).

• How: email hola@neuri.tech (or [legal contact email — pending]) with your name, how to reach you, what you are asking for and, if relevant, which store you are a vendor or customer of. We may ask you to verify your identity (or your representative's).
• Timing: we reply within 20 business days and, if your request is granted, carry it out within the following 15 business days. [Confirm deadlines under the new LFPDPPP during legal review]
• If you are a store's vendor or customer: the store is the controller. Ask the store directly, or write to us and we will pass it on right away.
• Self-service: owners can download everything from Settings → Your data and can close the store; vendors see their data in My Booth and can ask the store to stop messaging them.

Mexican authority: since March 21, 2025, the former INAI's powers over personal data held by private parties belong to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance). If you believe your request was not handled properly, you may go to it.

8. Cookies and analytics

• In the app (bazar.neuri.tech) we use only the session cookie needed to keep you signed in, and we store the open ticket and the offline catalog on your device so the register works without internet. No advertising cookies.
• On neuri.tech we use PostHog in anonymous mode: no cookies or browser storage, no session recording, no personal data, and nothing is counted if your browser sends "Do Not Track".

9. Security

Each store is isolated in the database (row-level security), money history cannot be edited, access is role-based, sessions can be ended instantly, connections are encrypted (HTTPS), social media tokens are stored encrypted, vendors' bank accounts are encrypted at the application level (AES-256, with a key kept outside the database) and shown masked (last 4 digits): the full number is only decrypted to build the bank payout file and when the store asks to see it to correct it, and it is not included in the data export and the daily backup is encrypted. If a breach significantly affects your rights, we will tell you without undue delay.

10. US and Arizona

• We do not sell or "share" personal information for targeted advertising.
• If there is a data breach, we will notify affected individuals as required by Arizona law (A.R.S. § 18-552, within 45 days of determining the breach) and other applicable state laws.
• Commercial email follows CAN-SPAM: it identifies Neuri LLC, includes a postal address and an unsubscribe link, and opt-outs are honored within 10 business days.
• neuri.bazar is for businesses and is not directed to children under 13; we do not knowingly collect their data.

11. Changes to this notice

We will post any change on this page with its date and, if it is material, email store owners. If a change requires new consent, we will ask for it.

12. References

• LFPDPPP — current text (Mexican Chamber of Deputies)
• EY Mexico: DOF publication on Mar 20, 2025, in force Mar 21, 2025, INAI's powers transferred to the Secretaría Anticorrupción y Buen Gobierno
• Garrigues: privacy notice contents and ARCO rights under the new law
• FTC: CAN-SPAM Act compliance guide
• A.R.S. § 18-552 (Arizona breach notification)

Draft for legal review. Not legal advice.