Comprehensive Privacy Notice

Data controller

PLATAFORMAS MEDIX SAS, identified at the beginning of this notice, determines how personal data collected through Miss Materiales, Miss Materiales Studio, and our support channels is processed.

This is the comprehensive notice. We make it available when you interact electronically with the Services.

Personal data we process

Depending on how you use the Services, we may process:

• Account and contact: email, display name, avatar, language, currency, sign-in provider, and authentication data administered by Supabase.
• Purchases and membership: purchase email, products, amounts, currency, payment status, Stripe identifiers, subscription, renewal dates, and access. Stripe receives payment details directly; we do not store full card numbers.
• Teacher and classroom profile: name, school, group, grade, school year, time zone, schedules, evaluation periods, and work preferences.
• Students: first name, date of birth, optional sex, grade, evidence, observations, progress level, and curriculum links.
• Content: plans, projects, sessions, reports, edits, approvals, and requests submitted to AI features.
• Technical use: session, IP address, and security or error logs that our infrastructure providers may generate.

Free-text fields could contain sensitive information if a teacher enters it. Do not enter diagnoses, medical records, disabilities, beliefs, addresses, CURP identifiers, or information that is not essential for the educational purpose.

Purposes of processing

We use data for purposes necessary to our relationship with you:

• create and secure accounts, authenticate access, and recover passwords;
• process purchases, memberships, charges, cancellations, refunds, receipts, and material delivery;
• maintain your library, benefits, and preferences;
• support group, evidence, evaluation, planning, calendar, and report features;
• generate AI drafts when the teacher activates the feature and accepts its disclosure;
• handle support, ARCO rights, security, fraud, legal duties, and legal claims;
• measure operational usage and performance needed to maintain and improve the Service.

We may send transactional messages about your account, purchases, security, membership, or legal changes. Promotions are sent only with an applicable legal basis or consent, and you may opt out without losing essential service messages.

Children and student information

Studio is intended for adult teachers, not students. The teacher is responsible for obtaining any required authorization from the school, parent, guardian, or relevant data subject before entering a minor’s information.

We apply data minimization: use only a first name and essential educational information. Do not use Studio as the official record or upload photos, audio, video, surnames, CURP identifiers, addresses, phone numbers, emails, medical data, or diagnoses unless a future feature expressly requests them with an appropriate notice and consent.

You may delete students, observations, and plans through available features or request assistance. Deleted information may remain temporarily in security backups or records required by law.

Processing in artificial intelligence features

Planning features may send OpenRouter and the selected model provider the group observation, grade, school year, curriculum catalog, and published materials needed to generate a draft.

Individual report generation may send the student’s basic profile—including first name, date of birth, and sex—together with linked evidence and assessments. This occurs only after the teacher accepts the AI disclosure within Studio.

We do not send the AI provider your email, password, payment information, or other account data not needed to generate the result. AI does not make final decisions; its output remains a draft subject to teacher review.

Service providers, disclosures, and transfers

We may share data with providers acting on our instructions: Supabase for authentication, database, and storage; Stripe for payments and memberships; Resend for transactional email; Google when you choose Google sign-in; OpenRouter and the model provider for AI features; and hosting, security, and support providers.

These providers may process information outside Mexico under their contracts, security measures, and privacy notices. We may also disclose data when required by a competent authority, to protect rights or safety, or in a lawful business reorganization.

We do not sell personal data. When a transfer requires consent, we will request it before the transfer unless a legal exception applies.

Cookies and local storage

We use cookies or equivalent technologies required to maintain sessions and secure authentication. Your browser stores your selected currency and cart contents locally to remember them on that device.

We do not currently describe advertising cookies or third-party analytics because they are not part of the implemented Service. If we add non-essential technologies, we will update this notice and provide applicable controls.

Retention and security

We retain data while your account or commercial relationship remains active, while needed for the disclosed purposes, and for additional periods required by tax, accounting, fraud-prevention, complaint-handling, or legal-claims obligations. We then securely delete, anonymize, or block it.

We use proportionate administrative, technical, and physical safeguards, including authentication, user-level access, encryption in transit, operational logs, and database restrictions. No system is infallible; if a relevant breach significantly affects your rights, we will notify you as required by law.

ARCO rights and procedure

You may request access to your data, correction of inaccurate data, deletion where appropriate, or objection to certain processing. Email hola@missmateriales.com with:

• your name and a method for receiving our response;
• proof of identity and, if applicable, representation;
• a clear description of the data and right you wish to exercise;
• any information that helps locate the data or support a correction.

We will acknowledge and respond within the periods required by applicable law. We may request additional information only to verify identity or understand the request.

Withdrawal and limitation

You may ask to withdraw consent or limit the use and disclosure of data through the same email. Withdrawal is not retroactive and may not apply when processing is required to perform a contract, comply with law, or exercise legal rights.

You may stop future AI use by not starting new generations; prior consent records and output may remain while needed to document the service or comply with obligations. You may also opt out of promotional messages without affecting operational emails.

Notice changes and contact

We will publish changes on this page and show the update date. If a change materially affects purposes, sensitive data, or transfers that require consent, we will provide an additional notice and request authorization where applicable.

For questions, ARCO rights, withdrawal, or privacy complaints, email hola@missmateriales.com or write to the controller address stated above.