Privacy Notice

1. Who we are

The Stuffs Company ("The Stuffs Co.", "we", "us") is an AI-native digital product studio headquartered in Mexico City, Mexico, operating the website thestuffs.company. For the purposes of applicable data protection laws, we act as the data controller for the personal data described in this Notice.

Contact: hello@thestuffs.company — attention: Data Protection / Privacidad.

2. Scope

This Notice applies to visitors of thestuffs.company, to prospects who contact us through our forms, and to clients and their representatives. It is drafted to comply, where applicable, with: the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (including its 2025 reform); United States federal and state privacy laws (including the California Consumer Privacy Act as amended by the CPRA); Canada's PIPEDA and Québec's Act 25; the data protection laws of Saint Vincent and the Grenadines; Panama's Law 81 of 2019; the EU General Data Protection Regulation (GDPR); and the Russian Federal Law No. 152-FZ "On Personal Data".

3. Personal data we collect

Contact data you give us: name, email address, company, project description, budget and timeline indicators, and any content you include in our forms or in messages you send us. When you submit our project form, an automated assistant may generate a structured summary ("project brief") of the information you provide.

Technical data collected automatically: IP address, browser and device characteristics, referring pages, and usage logs, used for security, debugging and aggregated analytics.

We do not collect special categories of data, and we do not knowingly collect data from minors.

4. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep the site secure and to remember preferences (such as your language). If we enable analytics or marketing cookies, we will request your consent beforehand where required (EU/EEA, and other jurisdictions with opt-in regimes), and you may withdraw it at any time. You can also control cookies through your browser settings; blocking strictly necessary cookies may affect site functionality.

5. Purposes and legal bases

We process personal data to: respond to your inquiries and prepare proposals (performance of a contract or pre-contractual steps); operate, secure and improve the website (legitimate interests); send communications you requested or, with your consent, occasional updates about our services (consent — you may withdraw it at any time); and comply with legal, tax and accounting obligations (legal obligation).

We do not sell or rent personal data, and we do not process it for cross-context behavioral advertising.

6. AI-assisted processing

Information you submit through our project form may be processed by third-party AI models (including Z.AI GLM models) to generate a summary that helps our team respond to you. This output is informational, may contain errors, and is always reviewed by a person before any decision is made. We do not make solely automated decisions that produce legal effects concerning you.

7. Retention

Lead and contact data: up to 24 months from our last interaction, unless a client relationship exists. Client and contract records: as long as required by Mexican tax and commercial law (generally five years). Technical logs: up to 12 months. Data may be kept longer where necessary for pending claims or legal obligations.

8. Sharing and processors

We share personal data only with service providers that host and operate our infrastructure (website hosting and edge network: Vercel and Cloudflare; database and authentication: Supabase; email delivery providers; and the AI provider described in section 6), each bound by data processing agreements and required to process data only on our instructions. We may also disclose data to professional advisers, or to public authorities when legally compelled. We do not sell personal data.

9. International transfers

Our providers may process data in the United States, the European Union and other countries. Where personal data is transferred from the EU/EEA or the UK, we rely on an adequacy decision or on Standard Contractual Clauses. Where it is transferred from Canada, México, Panamá or Saint Vincent and the Grenadines, we apply equivalent safeguards and process data only for the purposes described here.

Russia: if you access the site from Russia, note that our processing infrastructure is located outside Russia. We comply with Federal Law No. 152-FZ "On Personal Data", including its cross-border transfer rules, and we will respond to Roskomnadzor requests and to your rights requests as required by law. By submitting your data, you consent to the international transfer described in this Notice, in addition to the other legal bases that may apply.

10. Your rights

EU/EEA and UK (GDPR): access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), withdrawal of consent, and the right to lodge a complaint with your supervisory authority.

México: rights of access, rectification, cancellation and opposition ("ARCO"), revocation of consent, and limitation of use, under the Federal Law on the Protection of Personal Data Held by Private Parties (including its 2025 reform).

United States: depending on your state (including California under the CCPA/CPRA), rights to know, access, correct, delete, and opt out of the sale or sharing of personal information (we do not sell or share it), and freedom from discrimination for exercising these rights.

Canada (PIPEDA and Québec Act 25): access, correction, and — in Québec — de-indexation and cessation of dissemination; our privacy officer is reachable at hello@thestuffs.company.

Panamá (Law 81 of 2019): access, rectification, cancellation, opposition and revocation of consent. Saint Vincent and the Grenadines: the rights set out in its applicable data protection legislation. Rusia (152-FZ): access, clarification, blocking and deletion of data, and information on cross-border transfers.

11. How to exercise your rights

Write to hello@thestuffs.company with the subject "Privacy rights" ("Privacidad", "Confidentialité", "Privacy", «Конфиденциальность»). We respond within 30 calendar days (one month under the GDPR; 20 business days under Mexican law), verifying your identity when necessary. You will not be discriminated against for exercising your rights.

12. Marketing communications

We only send marketing emails with your consent or where permitted by law. Every message includes an unsubscribe mechanism, and we honor opt-outs (including under CAN-SPAM and Canadian anti-spam rules) within the legally mandated timeframes.

13. Security and breach notification

We apply technical and organizational measures aligned with ISO/IEC 27001 practices: encryption in transit (TLS), least-privilege access, monitoring and periodic reviews. If a personal data breach is likely to result in a risk to you, we notify the competent supervisory authority (within 72 hours where the GDPR applies) and affected individuals where the law so requires.

14. Changes to this Notice

We may update this Notice to reflect legal or operational changes. The "last updated" date above shows the current version; material changes will be highlighted on the site before taking effect.