Legal
Privacy notice
What we collect, what we use it for, and how you ask us to stop.
Last updated: August 18, 2026
Who is accountable for your data
Emerald Digital is the controller of the personal data we collect on this site.
This notice follows the Mexican Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Journal of the Federation on March 20, 2025.
Address
Blvd. Mariano Escobedo Pte. 4502-Int. 401 A, San Isidro C.P. 37530 León de los Aldama, Guanajuato, Mexico [email protected]What we collect
We collect what you give us and what your browser sends when it requests a page. We never collect sensitive personal data: the site asks you for no phone number, no address, no government ID and no financial information.
- From the contact form: your name, your email, the description of the part of your operation you want to solve, and the originating IP address, which we use to detect abuse.
- From booking a meeting: your name, email, message, requested date and time, originating IP address, security signals and classification, notification status, internal reference, access link and the appointment technical identifier.
- From your visit: the IP address you arrive from, the country inferred from it, your browser type and the language it is set to.
- From your path through the site: which sections you open, where you linger, and any text you type into the exploration fields.
If you include any of that data inside a free-form message, we handle it with the same care as the rest.
Contact requests and unconfirmed booking attempts, their security signals and classification, and the status of their emails are retained in PostgreSQL for up to 180 days and then erased. For a confirmed booking, that period runs from the appointment so data needed to hold it is not deleted beforehand. Duplicates and blocked requests are also recorded for that period so abuse can be audited and contained.
What we use it for
The law requires separating the purposes we need in order to serve you from the ones you can decline. Here are both lists.
Necessary. Without these we cannot handle what you asked for:
- Answering your contact message and following up on it.
- Booking, confirming and holding the meeting you schedule.
- Protecting the forms against automated submissions.
- Classifying contact requests as legitimate, suspicious, spam, abuse or duplicates, and deciding whether to send the confirmation and the notice to the commercial team.
- Choosing the language of the site: your saved preference first, and when there is none yet, the country inferred from your connection and the language your browser is set to.
- Keeping the site available and secure, and detecting abuse.
These require your consent. You can decline them and keep all of the above:
- Adapting the content of the site to what you type and the sections you explore.
- Measuring how the site is used with Google Analytics, to decide what to improve.
To limit them, write to us: the address and the procedure are in the section on your rights. For measurement you can also install the Google Analytics opt-out add-on in your browser.
Cookies and browser storage
The site uses three cookies and three session storage keys. One cookie is ours and remembers your language; the other two come from Google Analytics and measure audience. Our own code never uses persistent local storage, never stores a visitor identifier and never keeps history from one visit to the next.
- emerald_lang is a cookie holding the language you picked. It lasts one year, travels with the SameSite=Lax attribute, and it is your own click on the language switch that writes it.
- emerald_session and emerald_session_text live in your browser session storage. They hold the context of your path while the tab is open: they vanish when you close it and expire on their own after thirty minutes of inactivity.
- emerald_contact_journey temporarily stores your contact draft and journey state so they survive a reload. It disappears when you close the tab and expires after thirty minutes of inactivity.
- The Google Analytics cookies, _ga and _ga_ followed by the data stream identifier, hold a pseudonymous identifier for your browser. They last two years and make it possible to tell a new visit from a returning one. They carry neither your name nor your email address.
You can erase all of the above from your browser settings whenever you want. The Google Analytics opt-out add-on, if you install it, keeps its two cookies from being written again.
How the content adapts
The site changes what it shows you based on what you type and what you explore. This is exactly how far that goes.
- Today: the context of your path is built and stays inside your browser. No server receives it. It is erased when you close the tab or after thirty minutes of inactivity, and it never survives from one visit to the next.
- Once we turn on the interpretation layer: that same context, including any text you typed, will travel to Emerald servers and from there to the language model provider that interprets it. That provider is not chosen yet; we will name it in this notice before the layer goes live.
- What happens to that transmission: our service runs with no database. It holds the interpretation result for a short window, under a key computed from the context that cannot be used to rebuild it, and discards it when that window closes.
There is never an account, never a visitor identifier, and that data is never cross-referenced with anything else of yours. You already hold the control: adaptation starts with your first signal, so if you neither type nor interact, the site stays on its base version.
Who else processes your data
These providers process data on behalf of Emerald so the site can work. Each one has its own policy, and we link it so you can read it. DeepSeek only participates in the contact-form security filter when that feature is enabled; it is not the future content-adaptation layer, whose provider is still pending.
-
Cloudflare, Inc.
Delivers the site and protects it at the edge. It sees your IP address and infers the country you arrive from, which is what the site uses to pick your language the first time you land.
Cloudflare privacy policy -
Cloudflare Turnstile
Tells a person apart from an automated program before a form is accepted. It works without asking you for anything: it processes your IP address, the fingerprint of your connection, your browser identifier and the site key.
Turnstile privacy policy -
Hangzhou DeepSeek Artificial Intelligence Co., Ltd.
When the security classifier is enabled and its quotas are available, it reviews contact and booking requests that local rules have not already blocked as an exact duplicate or abuse, including low-risk cases. It receives neither the submitted name or email nor the IP address; before transmission we replace detectable email addresses, phone numbers and URL paths. The remaining free text and aggregate signals may still contain data the filter did not detect. Its policy states that data is processed in China and that inputs may be used to operate, secure, develop and improve its services and models.
DeepSeek privacy policy -
Microsoft Corporation
Runs Microsoft Bookings, the tool we use to reserve the meeting. Microsoft receives the name and message needed to create the appointment, as well as its schedule; the email remains with Emerald so we can send our own confirmation. Appointment data is shared with those who attend the meeting.
Microsoft privacy statement -
Google LLC
Runs Google Analytics, which we use to measure how the site is used. It receives navigation events and infers an approximate location from your IP address.
Google privacy policy
Transfers
The providers in the section above operate outside Mexico, so your data leaves the country as it passes through them. Mexican law calls that a remission: the provider handles the data under our instructions rather than its own, and your consent is not required for it.
When the DeepSeek classifier is enabled and available, the scrubbed text of any non-blocked request that reaches the classifier and its aggregate signals are processed on servers in the People's Republic of China. The feature remains disabled until the corresponding legal and contractual review is complete.
Emerald Digital never sells your personal data. We never rent it, trade it or hand it to anyone for advertising purposes. Beyond the providers named above, we would share it only if a competent authority required it from us in writing and in accordance with the law.
Your rights
You hold four rights over your personal data:
- Access: knowing what data of yours we hold and how we use it.
- Rectification: correcting it when it is wrong or incomplete.
- Cancellation: asking us to erase it from our records.
- Objection: asking us to stop using it for a specific purpose.
You can also withdraw the consent you gave us at any time, and limit the use or disclosure of your data. To exercise any of these, write to us at [email protected] with your name, a way to reach you, a document proving your identity, and a clear description of which data and which right you want to exercise.
We will tell you the outcome within twenty days of your request. Where it applies, we will act on it within fifteen days of that answer.
If you believe your request was mishandled, you can turn to the Secretaria Anticorrupcion y Buen Gobierno, the Mexican authority for the protection of personal data held by private parties.
Changes to this notice
This notice can change when the tools of the site, our practices or the law change. We will publish every new version on this same page, with its update date at the top. It is worth reviewing before you send us anything.
The Spanish version is the binding one. This English translation exists for your convenience and, where the two differ, the Spanish text prevails.