Privacy Notice

Who is responsible for your data

Bifrost Code is the trade name of an individual doing business in Mexico (persona física con actividad empresarial), who is responsible for processing your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), as enacted in 2025, and other applicable law.

For any matter about your personal data, write to [email protected]. The same address is how you exercise your rights and withdraw your consent. These are the details of the party responsible:

Trade name

Bifrost Code

Email

[email protected]

What personal data we collect

We collect only what we need to answer your request and to understand how the site is used. We do not collect sensitive personal data; please do not include any in your message.

Specifically:

• Contact details you type into the form: your name, email address, company (optional) and the message about your project.
• Project details you choose in the form: type of service, budget range and timeline.
• Anonymous usage data, even without your consent: pages visited, sections viewed, clicks on buttons and links, language, and device, browser and screen type. No cookies or persistent identifiers are stored, and this data is not linked to your name or email, so it does not identify you.
• Only with your consent: session recordings (cursor movement, clicks and scrolling, with every text field masked), heatmaps, and device and browser details linked to a random identifier stored in your browser.
• One transient technical detail: your IP address is not stored with your request or in our analytics; it is used in memory to limit how often the form can be submitted and to protect the site from abuse. Our hosting provider may keep it briefly in security logs, and our analytics provider receives it in transit and discards it.

Why we use your data

The primary purposes are necessary to handle the request you start. The secondary purpose is not, and you can refuse it without affecting your request.

• Primary: answering your messages and questions.
• Primary: preparing, sending and following up on quotes and project proposals.
• Primary: protecting the form and the site against automated submissions and abuse.
• Primary: measuring site usage in aggregate and anonymously, with no identifiers, to learn which pages and sections are viewed.
• Secondary, only if you accept it (“Analytics and site improvement”): reviewing session recordings, heatmaps and device details to improve the site's design and ease of use.

Your consent and how to refuse the secondary purpose

When you submit the contact form, you tick a box agreeing that we may use your data for the primary purposes. Without that data we cannot reply to you.

Session recordings and heatmaps start only if you choose “Accept” in the consent notice at the bottom of the screen, or turn on “Analytics and site improvement” in your preferences. Until you decide, they stay off.

You can refuse or change your mind at any time, free of charge and without affecting your request:

• Choose “Reject” in the consent notice.
• Open “Privacy preferences” in the footer of any page and turn off “Analytics and site improvement”.
• Turn on Global Privacy Control (GPC) in your browser: we treat it as a rejection.
• Email [email protected] saying that you do not want your data used for the secondary purpose.

Who we share your data with

We do not sell or rent your personal data, and we do not share it for targeted advertising or for advertising based on your activity on other sites. We make no transfers that would require your consent.

We may disclose data when a law or a competent authority requires it.

To run the site we rely on providers that process data only on our behalf, following our instructions and bound by confidentiality and security duties (under Mexican law, these are disclosures to processors, or remisiones):

• PostHog, Inc. (United States): site analytics and, only with your consent, session recordings and heatmaps. Its servers are in the United States.
• Our email provider: delivering the messages you send through the form and our replies.
• Our hosting provider in Mexico: hosting the site and processing the requests your browser sends to it.

Your ARCO rights and how to withdraw consent

You have the right to access your personal data, to rectify it if it is inaccurate or incomplete, to cancel it when you believe it is not needed for any purpose in this notice, and to object to its use for specific purposes (ARCO rights). You can also withdraw the consent you gave us and limit the use or disclosure of your data.

To exercise any of these rights, send your request to [email protected]. We will reply within 20 business days of receiving it, telling you whether it is granted; if it is, we will carry it out within the following 15 business days. These periods may be extended once, for an equal period, when the circumstances justify it, and we will let you know.

Exercising your rights is free; only justified shipping or copying costs, if any, may apply. If you disagree with our answer, you can go to the Mexican data protection authority, currently the Secretaría Anticorrupción y Buen Gobierno.

Your request must include:

• Your name and an email address or other way to send you our answer.
• A document proving your identity or, if you act for someone else, your representative's identity and authority.
• A clear description of the data and of the right you want to exercise.
• Anything that helps us find your information, such as the approximate date you wrote to us.
• For a rectification, the correction you request and, where relevant, a document supporting it.

How long we keep your data

We keep your data only while it is needed. When the periods below end, we delete it securely, unless a law requires us to keep it longer, for example tax records for a contracted project:

• Contact requests and related correspondence: up to 24 months after our last contact with you.
• Analytics data, including heatmaps: 12 months.
• Session recordings: 30 days.

Cookies, local storage and privacy signals

This site does not use cookies, and no third party tracks you on it for advertising.

Without your consent, analytics run in anonymous mode and the site stores only three things in your browser: your consent choice, your animation preference, and whether the intro animation was already shown. Each visit is counted separately.

Global Privacy Control (GPC): if your browser sends this signal, we treat it as a rejection of the secondary purpose at all times, even if you accepted before, and we do not show you the consent notice. GPC never turns recordings on.

Do Not Track (DNT): because there is no common standard for interpreting this signal, the site does not change its behavior when it receives it. Use GPC or the “Reject” button instead.

The only things the site keeps in your browser's storage are:

• Your consent choice (key bifrost:consent): whether you accepted or rejected, when, and which version of this notice applied.
• Your site preferences, such as “Pause animations”, and whether you already saw the loading animation during this session.
• Only if you accept “Analytics and site improvement”: a random PostHog identifier and session data, which are deleted when you withdraw your consent.
• Only if you accept “Analytics and site improvement”: a temporary session note (session storage, no identifier) used to report a language change; it is deleted on the next page.

Information for United States residents

This section supplements the notice for visitors from the United States, including under the California Online Privacy Protection Act (CalOPPA), and explains how we handle the requests provided for in state privacy laws.

Categories of personal information we collect: identifiers (name and email address), professional information (company), information you give us about your project and, only with your consent, internet activity on this site (session recordings and heatmaps). Also anonymous usage data from visits and, only if you accept, device and browser identifiers. Sources, purposes and providers are described in the sections above.

We do not sell or share personal information as those laws define it, including for cross-context behavioral advertising; we do not use sensitive personal information; and no third party collects information about your activity on this site to track you across other sites.

You may ask to know what personal information we hold about you, get a copy, correct it or delete it, and opt out of its sale or sharing (although we do neither). Email [email protected]; we will verify your identity using information we already hold and reply within 45 days. For access or deletion requests we may also ask for the identity document described in the ARCO rights section. You may act through an authorized agent with signed permission.

We will not discriminate against you for exercising your rights: we will not deny you services or charge you a different price for doing so.

This site is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has sent us data, write to us and we will delete it.

Effective date: the last-updated date shown at the top of this notice.

Changes to this notice

We may update this notice when our services, our providers or the law change. The current version is always published on this page, with its last-updated date and version number at the top.

If a change affects the purpose that needs your consent, we will ask for your choice again through the consent notice on your next visit. If the change matters for a request you sent us, we will also tell you by email.