Protection and processing of personal data.

JAAK ('The Controller'), with operational headquarters and data center in Monterrey, Nuevo León, Mexico, is responsible for processing personal data provided through the Mailack website and forms (mailack.com), in compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and other applicable rules. For any matter related to this notice, the Controller's contact is hola@mailack.com.

Through the contact and inquiry form, we collect only the following data provided directly by the data subject:

• Full name
• Company or organization name
• Corporate email address
• Estimated monthly volume of transactional or certified email
• Operational category or use case (legal, fintech, payroll, etc.)
• Details and messages transmitted in the inquiry
• IP address from which the form is submitted, used exclusively as a technical anti-abuse security measure (rate limiting)

When a customer contracts Mailack, The Controller additionally processes the data required to operate the certified email service, exclusively for that purpose:

• Customer account data: name, contact email address, billing information, and access credentials (API keys).
• Data contained in messages handled on behalf of the customer: sender and recipient addresses, message content, and technical transmission metadata (SMTP transcripts, DSN receipts).
• Technical evidence derived from each certified message: cryptographic fingerprint, Merkle inclusion proof, and NOM-151 preservation certificate.

Personal data collected is used exclusively for the following primary and necessary purposes:

• Handling, follow-up, and response to commercial requests, quotes, and demo scheduling.
• Technical and operational evaluation for admission into pilot programs and assisted onboarding.
• Direct communication from engineering and integration support.
• Provision of the contracted service: transmission of messages and generation and preservation of the associated NOM-151 evidence.
• Billing, collections, and compliance with tax and legal obligations.
• Abuse prevention and protection of the security of the website, the contact form, and the platform.

The legal basis for processing your personal data, under the LFPDPPP, is the consent granted when voluntarily submitting the contact form expressing commercial or technical interest in the service and, for customers, the legal relationship arising from contracting the service. No sensitive personal data is collected through this website.

Data is retained for the following periods, after which it is securely deleted:

• Contact form data: the time strictly necessary to address the preliminary inquiry or a maximum of 12 months if no service contract is formalized.
• Account and billing data: for the duration of the contractual relationship and the periods required by tax and commercial law.
• Certified message evidence (fingerprints, Merkle proofs, and NOM-151 certificates): in accordance with NOM-151-SCFI-2016 and the terms of service, including the export window after the customer's termination.

To operate the website and the service, the Controller relies on the following infrastructure providers, which act as data processors or sub-processors on behalf of the Controller under contractual confidentiality and security obligations:

• Oracle Cloud Infrastructure (Mexico region): compute and storage infrastructure hosting the Mailack platform and its evidence.
• Cloudflare, Inc.: DNS resolution for the website and perimeter protection against attacks (distribution and mitigation network).
• Vercel, Inc.: hosting and deployment of the public website mailack.com, including technical processing of the contact form.

Apart from the processors listed in the previous section, the Controller does not sell, rent, or share personal data with third parties outside the operation. Data on the email platform remains within the infrastructure environment of JAAK in Mexico. No commercial transfers to unauthorized third parties take place; any legally required transfer will be carried out in accordance with the LFPDPPP.

As the data subject, you have the right to Access, Rectify, Cancel, or Oppose the processing of your personal data (ARCO Rights), as well as to revoke your consent at any time and to limit the use or disclosure of your data. To exercise any of these rights, please send an email to hola@mailack.com specifying your name, registered email, and specific request. The Controller will respond within the time limits set by the LFPDPPP. If you believe your data protection rights have been violated, you may file a complaint with the competent personal data protection authority in Mexico.

The Controller may update this privacy notice to reflect regulatory or operational changes. The current version will always be published at mailack.com with its last-updated date.