Legal & Compliance
Privacy Policy
What this website collects, why, who it reaches, and what you can ask us to do about it.
Not yet reviewed by counsel. The technical description below is accurate — it was written from what this website's code actually does — but the identity slots, retention periods and rights framework must be completed and approved before publication. Run grep -n mx-todo site/privacy.html to list what is outstanding.
1. Who is responsible
The controller of personal data collected through this website is FULL REGISTERED COMPANY NAME of REGISTERED ADDRESS. Privacy enquiries: contact@mexas.io.
ADD: dedicated privacy contact or DPO address, if one is appointed.
2. The short version
This is a static marketing website. It sets no cookies of its own, runs no analytics, no advertising pixels and no visitor tracking. The only personal data you give us is what you type into the contact form. Two third parties are involved in serving the site — Cloudflare and Google Fonts — and both see your IP address as a technical necessity of delivering content to you.
3. What we collect
Contact form
When you submit the contact form we receive the name, email address and message you enter. That is all the form sends. Do not include sensitive personal information, account credentials, wallet seed phrases or private keys in a message to us — we will never ask for them.
Spam protection
The form is protected by Cloudflare Turnstile, which assesses whether a submission is automated. To do this, Cloudflare receives your IP address and technical signals about your browser and device. The form also contains a hidden field that human visitors never see; if it is filled in we treat the submission as automated and discard it.
Server logs
The site is served from Amazon Web Services. Its infrastructure records standard technical request data — IP address, timestamp, requested URL, referrer, user agent and response status — which we use to keep the service running and secure.
Fonts
Typography is loaded from Google Fonts. Requesting those files discloses your IP address and user agent to Google. No font request identifies you by name, and we send Google no other information about you.
What we do not collect
We do not operate analytics, advertising or tracking of any kind on this website. We do not build visitor profiles, do not track you across other websites, and do not sell or rent personal data to anyone.
4. Why, and on what legal basis
| Data | Purpose | Basis |
|---|---|---|
| Name, email, message | To read and reply to your enquiry | Your consent, and our legitimate interest in responding to people who contact us |
| Turnstile signals | To stop automated abuse of the form | Our legitimate interest in keeping the service usable and secure |
| Server logs | Availability, security, fault diagnosis | Our legitimate interest in operating a secure service |
| Font requests | To render the page as designed | Our legitimate interest in presenting a functional website |
CONFIRM: the lawful-basis framework above is drafted in GDPR terms. Counsel to confirm the correct framing for the issuing jurisdiction — in Mexico, the LFPDPPP consent and privacy-notice regime applies and may require a differently structured aviso de privacidad.
5. Who else sees it
- Amazon Web Services — hosting, content delivery, and the email delivery of contact-form submissions to us.
- Cloudflare — Turnstile spam protection on the contact form.
- Google — web font delivery.
We may also disclose personal data where we are legally required to, or to establish, exercise or defend legal claims. We do not otherwise share it.
ADD: any CRM, ticketing or email tool that contact-form submissions are forwarded into, if one is introduced.
6. Cookies
This website sets no cookies of its own and uses no cookie-based analytics, so there is no cookie banner to click through. Cloudflare Turnstile may set its own strictly necessary cookies or local storage entries as part of assessing whether a form submission is automated; these exist to prevent abuse and are described in Cloudflare's own privacy documentation.
7. Blockchain data
Mexas is issued on several public networks — Ethereum, Arbitrum One, Avalanche C-Chain, Base, BNB Smart Chain and the Liquid Network. Wallet addresses, balances and transfers on the EVM networks are public, permanent and outside our control. We did not publish them and we cannot amend or erase them — no one can. Liquid uses Confidential Transactions, which keep asset types and amounts hidden from third parties by default, though transaction graphs remain public. A wallet address is not, by itself, linked to your name by us; if you acquire Mexas through a regulated distributor, that distributor collects identity information under its own privacy policy and its own anti-money-laundering obligations.
8. How long we keep it
Contact-form correspondence is kept for as long as needed to handle your enquiry and for a reasonable period afterwards for record-keeping. Server logs are kept for a limited operational period and then deleted.
REQUIRED: state actual retention periods, e.g. correspondence 24 months, CloudFront and Lambda logs 30 or 90 days. Check the configured CloudWatch log retention in the Terraform stack and state the real number.
9. International transfers
Our service providers operate globally, so personal data may be processed outside your country of residence, including in the United States. Where such transfers occur we rely on the safeguards those providers offer, including standard contractual clauses where applicable.
CONFIRM: the AWS region the site and contact Lambda run in, and name it here.
10. Your rights
Subject to applicable law, you may ask us to give you a copy of the personal data we hold about you; correct it if it is inaccurate; delete it; restrict or object to our processing of it; or withdraw consent you previously gave. In Mexico these are known as your ARCO rights — acceso, rectificación, cancelación y oposición.
Write to contact@mexas.io. We will respond within the period required by applicable law. We may need to verify your identity first. If you are dissatisfied with our response you may complain to your data protection authority — in Mexico, the competent supervisory authority for personal data.
CONFIRM: name the current competent authority and its complaint route. Do not name a body without checking it still holds the mandate.
11. Security
The site is served over HTTPS. The contact form is submitted to an endpoint on the same domain and is protected against automated abuse. Access to submitted correspondence is limited to people who need it to answer you. No system is perfectly secure, and we cannot guarantee absolute security of data transmitted over the internet.
12. Children
This website is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Changes
We may update this policy. The revised version takes effect when published here and the “last updated” date will change. Where a change is significant we will take reasonable steps to bring it to your attention.
14. Contact
Privacy questions or requests: contact@mexas.io, or write to REGISTERED ADDRESS.