Comprehensive Privacy Notice

Data controller

PLATAFORMAS MEDIX SAS, identified at the beginning of this notice, determines how personal data collected through Miss Materiales, Miss Materiales Studio, and our support channels is processed.

This is the comprehensive notice. We make it available when you interact electronically with the Services.

Personal data we process

Depending on how you use the Services, we may process:

• Account and contact: email, display name, avatar, language, currency, sign-in provider, and authentication data administered by Supabase.
• Purchases and membership: purchase email, products, amounts, currency, payment status, Stripe identifiers, subscription, renewal dates, and access. Stripe receives payment details directly; we do not store full card numbers.
• Teacher and classroom profile: name, school, group, grade, school year, time zone, schedules, evaluation periods, and work preferences.
• Students: first name, date of birth, optional sex, grade, evidence, observations, progress level, and curriculum links.
• Content: plans, projects, sessions, reports, edits, approvals, and requests submitted to AI features.
• Technical and product use: session, IP address, browser, device, navigation, interactions, session-replay data, and security or error logs that our infrastructure and analytics providers, including LogRocket, may generate.

Free-text fields could contain sensitive information if a teacher enters it. Do not enter diagnoses, medical records, disabilities, beliefs, addresses, CURP identifiers, or information that is not essential for the educational purpose.

Purposes of processing

We use data for purposes necessary to our relationship with you:

• create and secure accounts, authenticate access, and recover passwords;
• process purchases, memberships, charges, cancellations, refunds, receipts, and material delivery;
• maintain your library, benefits, and preferences;
• support group, evidence, evaluation, planning, calendar, and report features;
• generate AI drafts when the teacher activates the feature and accepts its disclosure;
• handle support, ARCO rights, security, fraud, legal duties, and legal claims;
• measure operational usage and performance needed to maintain and improve the Service.

We may send transactional messages about your account, purchases, security, membership, or legal changes. Promotions are sent only with an applicable legal basis or consent, and you may opt out without losing essential service messages.

Children and student information

Studio is intended for adult teachers, not students. The teacher is responsible for obtaining any required authorization from the school, parent, guardian, or relevant data subject before entering a minor’s information.

We apply data minimization: use only a first name and essential educational information. Do not use Studio as the official record or upload photos, audio, video, surnames, CURP identifiers, addresses, phone numbers, emails, medical data, or diagnoses unless a future feature expressly requests them with an appropriate notice and consent.

You may delete students, observations, and plans through available features or request assistance. Deleted information may remain temporarily in security backups or records required by law.

Processing in artificial intelligence features

Planning features may send OpenRouter and the selected model provider the group observation, grade, school year, curriculum catalog, and published materials needed to generate a draft.

Individual report generation may send the student’s basic profile—including first name, date of birth, and sex—together with linked evidence and assessments. This occurs only after the teacher accepts the AI disclosure within Studio.

We do not send the AI provider your email, password, payment information, or other account data not needed to generate the result. AI does not make final decisions; its output remains a draft subject to teacher review.

Service providers, disclosures, and transfers

We may share data with providers acting on our instructions: Supabase for authentication, database, and storage; Stripe for payments and memberships; Resend for transactional email; Google when you choose Google sign-in; OpenRouter and the model provider for AI features; LogRocket for product analytics, session replay, and diagnostics; and hosting, security, and support providers.

These providers may process information outside Mexico under their contracts, security measures, and privacy notices. We may also disclose data when required by a competent authority, to protect rights or safety, or in a lawful business reorganization.

We do not sell personal data. When a transfer requires consent, we will request it before the transfer unless a legal exception applies.

Cookies and local storage

We use cookies or equivalent technologies required to maintain sessions and secure authentication. Your browser stores your selected currency and cart contents locally to remember them on that device. We also use LogRocket to understand product usage, diagnose errors, and review session replays.

The current integration does not configure automatic personal-data sanitization. Before operating in production, we will review and configure DOM-content, input, and network-traffic redaction according to the Service's needs. If we add additional non-essential technologies, we will update this notice and provide applicable controls.

Retention and security

We retain data while your account or commercial relationship remains active, while needed for the disclosed purposes, and for additional periods required by tax, accounting, fraud-prevention, complaint-handling, or legal-claims obligations. We then securely delete, anonymize, or block it.

We use proportionate administrative, technical, and physical safeguards, including authentication, user-level access, encryption in transit, operational logs, and database restrictions. No system is infallible; if a relevant breach significantly affects your rights, we will notify you as required by law.

ARCO rights and procedure

You may request access to your data, correction of inaccurate data, deletion where appropriate, or objection to certain processing. Email hola@missmateriales.com with:

• your name and a method for receiving our response;
• proof of identity and, if applicable, representation;
• a clear description of the data and right you wish to exercise;
• any information that helps locate the data or support a correction.

We will acknowledge and respond within the periods required by applicable law. We may request additional information only to verify identity or understand the request.

Withdrawal and limitation

You may ask to withdraw consent or limit the use and disclosure of data through the same email. Withdrawal is not retroactive and may not apply when processing is required to perform a contract, comply with law, or exercise legal rights.

You may stop future AI use by not starting new generations; prior consent records and output may remain while needed to document the service or comply with obligations. You may also opt out of promotional messages without affecting operational emails.

Notice changes and contact

We will publish changes on this page and show the update date. If a change materially affects purposes, sensitive data, or transfers that require consent, we will provide an additional notice and request authorization where applicable.

For questions, ARCO rights, withdrawal, or privacy complaints, email hola@missmateriales.com or write to the controller address stated above.

External Studio resources

Studio uses YouTube API Services, Openverse, Pixabay and Brave to suggest videos and images. By using this feature you agree to the YouTube Terms of Service. Suggestions require teacher review and are not a guarantee of suitability for children.

External searches use public curriculum concepts, without student rosters or private observations. We store activity references, metadata and your hidden-resource preferences; external metadata is deleted or refreshed within 30 days. We store private copies of selected Pixabay images and delete them when their references expire; previews require authorization and temporary links. Brave provides web images with strict safe search; thumbnails load from Brave, and we do not store original images or guarantee reuse permissions. Review the source and suitability before use. Other image providers receive browser requests and YouTube players load when opened; they may receive your IP address and device information, use cookies and show advertisements. We do not request access to your YouTube account. Permanently deleting a plan deletes its references and preferences.

YouTube Terms of Service · Google Privacy Policy · Privacy notice