Data handling

1. Who owns what

You own your data. IntegrAI processes it on your instructions, for the purposes set out in your agreement, and for nothing else. We do not sell it, rent it, share it with other customers, or use it to build products for anyone but you. Under Mexico's LFPDPPP, you are the data controller for the personal data inside your systems and we act as your processor.

2. What we process

The categories depend on which processes your AI employees run. In a typical engagement they include:

We ask for the minimum needed to run the process. Where a field is not required, we prefer not to receive it at all.

3. Where it lives

Operational data is stored in managed cloud infrastructure in Mexico or the United States. The region is chosen with you at the start of the engagement and documented in your agreement. Data is encrypted in transit and at rest, and each customer's data is logically isolated from every other customer's.

4. Sub-processors

We use a small number of established providers to deliver the service. Each is bound by contractual confidentiality and data protection obligations, and none is permitted to use your data for its own purposes.

The current named list of sub-processors, with their regions, is available on request and is provided to every customer as part of onboarding. We notify customers before adding a sub-processor that processes their operational data.

5. How models process your data

When an AI employee reasons over a record, the relevant content is sent to a foundation model provider under an enterprise agreement.

• Content is used to produce that one response, not to train models.
• We use no-training tiers and, where available, limited or zero data retention.
• We send the narrowest relevant context rather than whole systems or full databases.
• Where a step can be done deterministically — a lookup, a calculation, a validation — we do it in code rather than sending data to a model.

6. Who can access it

• Your team, through your own systems and the AI employee's interface, with the roles you define.
• IntegrAI personnel assigned to your engagement, under least-privilege access, for implementation and support.
• Sub-processors, limited to what their function requires.
• Nobody else. Administrative access to your environment is logged and reviewed.

7. Retention and deletion

• Operational data is retained while your agreement is active and for as long as the process requires.
• Audit logs are retained for the period set in your agreement — by default, longer than operational data, because they are the record of what was done.
• On termination, we delete or return your operational data within 30 days of your request, in a format you can load elsewhere.
• Residual copies in encrypted backups expire on the backup rotation schedule, within 90 days.
• We retain data beyond these windows only where law requires it, and only for as long as it requires.

8. Export and portability

You can request an export of your operational data and audit logs at any time during the engagement, in a machine-readable format. There is no charge for a reasonable number of exports, and no technical lock-in: the configuration that defines how a process runs is documented and handed over with it.

9. Requests from the people in your data

If a customer, vendor, or employee of yours exercises their ARCO rights — access, rectification, cancellation, or opposition — over personal data held in your systems, that request goes to you as the controller. We will assist you in locating, correcting, or deleting the relevant data within the timeframes the law sets for you. If such a request reaches us directly, we forward it to you rather than acting on it ourselves.

10. Cross-border transfers

If your data is stored in the United States, or processed by a provider outside Mexico, that transfer is made under the conditions permitted by the LFPDPPP and the terms of your agreement, with equivalent confidentiality and security obligations imposed on the recipient. If your operation requires data to stay inside Mexico, tell us at the start and we will architect the engagement that way.

11. Incidents involving your data

If we confirm a security incident affecting your data, we notify you without undue delay and in any case within 72 hours, with the categories of data involved, what we know about the cause, what we have done to contain it, and what we recommend you do. We support you in meeting any notification obligation you have to authorities or to the people affected.

12. Changes to this page

We may update this page as our practices and providers change. Material changes affecting how we handle customer data are communicated to active customers directly, not only published here.

13. Data contact

For questions about data handling, sub-processor lists, data processing agreements, or export and deletion requests:

• Email: privacy@integrai.com.mx
• Website: integrai.com.mx