Privacy Notice

The party responsible for processing your personal data (the data controller) is Carlos Trujillo Puente, doing business as WeEvolveIT (an individual engaged in business activities (persona física con actividad empresarial)), Mexican tax ID (RFC) TUPC9311273P1, with address at Av. Plan de Ayala 1208, Int. 204, Col. Chapultepec, C.P. 62450, Cuernavaca, Morelos, Mexico. Notepress, the newsroom platform available at usenotepress.com, is a WeEvolveIT product (weevolveit.com).

For any matter regarding your personal data or this notice, including the exercise of your rights, contact our personal data department at legal@weevolveit.com.

This notice applies to the people whose data we process as controller:

• people who visit the public pages of usenotepress.com;
• people who create an account or use the Notepress dashboard as members of a publication, and
• people who write to us through the contact form or by email.

It does not cover readers of the websites of publications that use Notepress: each publication is responsible for its own website and its own privacy notice. Nor does it cover other people's data that a publication includes in its content; for that data we act as the publication's processor (see Data we process on behalf of your publication).

• Account data: first and last name, email address, phone number (optional), the name of the publication or company and the address of its website (optional). Also your role in the publication (administrator, editor or writer) and, if you write one, your personal writing style.
• Sign-in data: Notepress doesn't use passwords. To sign in, we email you a six-digit code that works only once, expires after 10 minutes and is stored encrypted. Your session is kept with a cookie (see Cookies).
• Billing data: the plan you subscribe to, the status of your subscription and trial, your AI credit balance and history, and the customer and subscription identifiers Stripe returns to us. Your card details are received and processed directly by Stripe; Notepress never receives or stores them.
• Content you upload or write: articles and drafts, images, videos, source documents, quotes and links, and author profiles (name, title, bio, photo and social links). Images and videos you upload are converted to optimized formats and stripped of their metadata, such as the GPS location of a photo taken with a phone.
• Contact form data: name, email, publication, website, topic and message.
• Technical and browsing data: IP address, browser and device type, pages visited and interactions on the public pages (see Cookies), and security and error logs. In sign-in attempt logs, the email address and IP address are stored pseudonymized.

Primary purposes (necessary for the service)

1. To create and manage your account and your publication's account, and to confirm that the email address you sign up with is yours.
2. To give you access with one-time codes and keep your session open.
3. To provide the service: to store and edit your content; to generate drafts, translations, images and keyword studies, and to publish it on your publication's website through its Content API.
4. To charge your subscription, manage the free trial, and grant and deduct AI credits.
5. To send you the emails the service needs: your sign-in code, the welcome email and notices about your account, your subscription or changes to this notice and to the Terms of Use.
6. To answer your contact messages, support requests and ARCO rights requests.
7. To protect the service: to limit sign-in attempts, prevent fraud and abuse, and diagnose and fix errors.
8. To comply with legal obligations and respond to requests from competent authorities.

Secondary purposes (you can opt out)

1. To measure, with analytics tools, how the public pages of usenotepress.com are used, in order to improve their content and design.
2. To produce internal statistics on how the product is used in order to improve it.

If you don't want us to use your data for the secondary purposes, write to legal@weevolveit.com with the subject line “Secondary purposes.” You can also block analytics cookies (see Cookies). Opting out will not be a reason to stop providing the service to you.

To run Notepress we hire providers that process personal data on our behalf (processors, or “encargados” under the LFPDPPP). We give each one only the data it needs for its task. Several are outside Mexico, mainly in the United States.

• Application hosting and cloud database

  What data

  Your account data, your publication's data and your content.

  Where

  United States

• File storage

  What data

  The images, videos and documents you upload or that are generated for your publication.

  Where

  In the provider's cloud; it may be located in the United States or other countries.

• Content delivery and protection network

  What data

  The IP address and technical data of each visit, to serve the site and protect it from attacks.

  Where

  The provider's global network

• Transactional email delivery

  What data

  Your email address and the content of each message (sign-in code, welcome email, notices). Contact form messages also reach us this way.

  Where

  United States

• Payment processing (Stripe)

  What data

  Your card details, name, email address and the billing details you enter on its checkout page.

  Where

  United States and other countries where Stripe operates

• Artificial intelligence model providers (text and image)

  What data

  The content each task needs: your instructions, drafts, source documents, style profiles and texts to translate. We don't send them your email address, phone number or payment details.

  Where

  United States

• Search data for SEO

  What data

  Keywords, topics and public domains, for keyword and competitor studies. It receives no personal data.

  Where

  Not applicable

• Web analytics: Google Analytics (Google) and Microsoft Clarity (Microsoft)

  What data

  Browsing data on the public pages (see Cookies).

  Where

  United States

Stripe, Google and Microsoft also process data under their own privacy notices.

Transfers

We don't transfer your personal data to third parties other than our processors, except where the LFPDPPP allows it without your consent (article 36): for example, when a law or a competent authority requires it, or when it is necessary to establish, exercise or defend a right in legal proceedings. If we ever need to make a transfer that requires your consent, we will ask you first.

The content you publish goes out to your publication's website through its Content API and is public from there. Your publication decides what is published.

The content your publication stores in Notepress may include other people's personal data: people who appear in articles, guest authors, sources or people quoted. For that data, the publication is the controller and WeEvolveIT acts as processor: we process it only to provide the service to the publication, following its instructions and this notice.

The publication must have a legal basis to process that data and its own privacy notice. If someone asks us to exercise their rights over data a publication included in its content, we will direct them to that publication.

• Account and content: for as long as the publication's account is active.
• Closing the account: an administrator of the publication can close it under My account → Danger zone. Closing starts a 30-day grace period during which the account can be reactivated, and the subscription is canceled at the end of the period already paid. When the 30 days are over, the publication and all its content (articles, images, videos and documents) are permanently deleted and cannot be recovered.
• Your user data (name, email address and phone number): we keep it for as long as it is needed for the purposes of this notice. You can ask us to delete it at any time (see Your ARCO rights).
• Payments: Stripe keeps payment records for the periods required by applicable law.
• Security and error logs: up to 90 days.
• Sign-in codes: they expire after 10 minutes and work only once.
• Contact messages: they are not stored in the Notepress database. They arrive in our inbox and are kept for as long as needed to help you and follow up.
• Backups: database backups may retain already deleted data for a limited time, until they are renewed.

When we delete data that may still be needed to address liabilities arising from our relationship, we block it — we keep it without using it — only for the applicable limitation period, and then we erase it.

Your content is yours. Under My account → Export you can download, at any time, a ZIP file with a CSV of all of the publication's articles, in any status, and a folder with its images. Any member of the publication can do it, free of charge and without using credits. We recommend exporting before you close the account.

You have the right to:

• Access: know what personal data about you we hold and how we process it.
• Rectification: correct it if it is inaccurate, incomplete or out of date.
• Cancellation: ask us to delete it from our records and systems.
• Objection: object to its processing for a legitimate reason, or to automated processing that produces unwanted legal effects for you or significantly affects your interests, rights or freedoms.

You can also revoke your consent at any time, without retroactive effect, through the same channel described below.

You can make some changes yourself in the dashboard: your name and phone number are edited under My account → Profile, and your content is downloaded under My account → Export. For everything else:

1. Write to legal@weevolveit.com with the subject line “ARCO rights.”
2. Include your name and an email address or other means to receive our reply; a valid official ID (or, if you act on behalf of someone else, the document proving your authority and both people's IDs); a clear description of the right you want to exercise and the data it concerns, and any detail that helps us locate it, such as your account email and the name of your publication.
3. If you ask for a rectification, state what needs to be corrected and attach, where applicable, the supporting document.

We will send you our answer within 20 business days of receiving your request and, if it is granted, we will carry it out within the following 15 business days. These periods may be extended once, for an equal period, when the case justifies it; if that happens, we will tell you. We will reply and deliver data electronically.

Exercising your rights is free of charge. Only reproduction or shipping costs could apply, under article 34 of the LFPDPPP. We may deny a request in the cases listed in article 33 of the law — for example, if identity is not proven or if it would harm the rights of third parties — and, if we do, we will explain why.

Revoking your consent or deleting certain data may prevent us from continuing to provide the service: without an email address, for example, we cannot send you the code to sign in.

• Ask us not to use your data for the secondary purposes by writing to legal@weevolveit.com.
• Block or delete analytics cookies in your browser settings, or install the Google Analytics opt-out browser add-on.
• Leave optional fields empty, such as your phone number or your website address.

We use cookies — small files the site stores in your browser — and measurement scripts. These are all the ones we use:

• Session (authjs.*)

  Purpose

  To keep you signed in and protect the sign-in process. They are necessary: without them you can't access the dashboard.

  Duration

  Up to 30 days

  Where

  Sign-in, sign-up and dashboard

• Language (locale)

  Purpose

  To remember the language you chose for the site and the dashboard.

  Duration

  1 year

  Where

  The whole site

• Google Analytics (_ga, _ga_*)

  Purpose

  To measure, statistically, how many visits the site gets, where they come from and which pages are read.

  Duration

  Up to 2 years

  Where

  Public pages, including the sign-in and sign-up pages. Never in the dashboard.

• Microsoft Clarity (_clck, _clsk and other Microsoft cookies)

  Purpose

  Heatmaps and recordings of how a page is browsed (scrolling, clicks and movements), to improve its design.

  Duration

  _clck up to 1 year; _clsk, 1 day

  Where

  Content pages: home, guides, comparisons, blog, contact and legal pages. It does not load on sign-in, on sign-up or in the dashboard.

Google Analytics runs with Google's consent mode (Consent Mode v2) and with advertising features always turned off: we don't do remarketing or personalized advertising. For visitors from the European Economic Area, the United Kingdom or Switzerland, Analytics starts without cookies. On the contact form, what you type is hidden from Clarity recordings.

You can block or delete cookies in your browser settings. If you block the session cookies, you won't be able to sign in.

We apply administrative, technical and physical security measures in line with the risk, including:

• an encrypted connection (HTTPS) across the whole site;
• passwordless sign-in, with one-time codes that are stored encrypted, expire quickly and allow only a few attempts;
• isolation between publications: each publication sees only its own content, and permissions are checked on every operation;
• security logs with email and IP addresses pseudonymized, and
• administrative access restricted to the people who operate the service.

No measure is infallible. If a security breach occurs that significantly affects your property or moral rights, we will inform you immediately so you can take the appropriate steps.

Notepress is a professional service for publications and is not directed at anyone under 18. We don't knowingly collect data from minors; if we find that a minor has created an account, we will delete it.

By creating your account, or by sending us your data through the contact form, after this notice has been made available to you, you consent to the processing described here. The data needed for the contractual relationship — your account and your billing — is processed to perform it, under article 9, section IV, of the LFPDPPP.

We may update this notice because of changes in the law, in the service or in our providers. The current version will always be on this page, with its last-updated date. If a change is substantial — for example, a new purpose that requires your consent — we will also notify you by email, at your account address, before it takes effect.

This notice is governed by the Federal Law on the Protection of Personal Data Held by Private Parties and other applicable provisions in Mexico. It is published in Spanish and English; in case of any discrepancy, the Spanish version prevails.