Privacy Notice for U.S. Clients and Prospects
This notice explains what personal information we collect about people in the United States who deal with us as prospects, clients or vendors, why we collect it, who we disclose it to, and the choices and rights you have. It also serves as our notice at collection.
1. Who we are
Comuna 18 is a software and artificial intelligence (AI) consulting firm. We are a Mexican company (sociedad anónima de capital variable), Tax ID (RFC) COM1707063EA, with offices at Hegel 141, Int. 1A, Col. Polanco, 11560, Mexico City, Mexico. Our legal representative is Abraham Mercado Cherem, and privacy requests go to johana@comuna18.com.
Because we are based in Mexico, we also comply with Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties. Our Spanish-language privacy notice is available at johana.comuna18.com/privacidad.
2. When this notice does not apply
When a client gives us personal information about its own employees, users or customers so we can work on its project, we act as that client’s service provider (processor). We use that information only to provide services to the client, under the client’s instructions and our data processing agreement with it. The client’s own privacy notice governs that information, and requests about it should go to the client. If we receive one, we will forward it.
3. Personal information we collect
In the past 12 months we have collected the following categories of personal information. We do not collect sensitive personal information; please do not send it to us.
| Category | Examples | Collected? |
|---|---|---|
| Identifiers | Name, email address, phone or WhatsApp number | Yes |
| Customer records | Name, phone, billing details (tax ID, legal name, billing address). Card details are collected and stored by Stripe, not by us. | Yes |
| Professional or employment-related information | Job title, company, role in purchasing decisions, projects you work on | Yes |
| Commercial information | Services requested or purchased, proposals, contracts, invoices and payment history | Yes |
| Audio, electronic or similar information | WhatsApp messages, emails, shared documents, and meeting recordings and transcripts when you are told at the start of the meeting | Yes |
| Internet or network activity | This site uses no cookies or tracking technologies. Like any website, the server that hosts it may automatically log basic technical data, such as IP address, only to keep it running and secure. | Limited |
| Preferences | Preferred language and communication preferences, including opt-outs | Yes |
| Sensitive personal information | Such as health, precise geolocation, government ID numbers, account log-ins, or racial or ethnic origin | No |
| Biometric, geolocation, education, protected classifications, inferences or profiles | — | No |
4. Where we get it
- From you, when you message us, talk to Johana, join a meeting, sign a contract or request an invoice.
- From your company or colleagues, for example when they introduce you, copy you on an email or add you to a shared document or chat.
- From public sources, such as your company’s website, only to identify a new contact.
5. How we use it
To run our business with you:
- Respond to your requests and identify who is writing to us.
- Prepare proposals, quotes and contracts.
- Provide our consulting, software development and AI services.
- Follow up by WhatsApp and email, and prepare meeting minutes.
- Invoice and collect payment (including card payments through Stripe).
- Comply with legal, tax and accounting obligations and respond to lawful requests from authorities.
- Keep our systems secure and keep a log of what is sent on Comuna 18’s behalf.
Optional uses you can decline at any time: sending you news and marketing about Comuna 18, satisfaction surveys, and preparing anonymous case studies that do not identify you. To decline, reply “NO NEWS” on WhatsApp or email johana@comuna18.com. Every marketing email also includes an unsubscribe link. We only send promotional WhatsApp or text messages if you have opted in.
6. Johana, AI and automated decisions
Johana is Comuna 18’s AI-powered digital assistant, not a person. She works over WhatsApp and email (johana@comuna18.com): she takes contact details, logs requests, drafts minutes and proposals, and handles follow-ups.
To do this, Johana sends message content to AI models provided by a third party (Anthropic, PBC), which processes it on our behalf and under our instructions. Under their commercial terms, our AI providers do not use your information to train their models.
A human is always in charge. Abraham Mercado Cherem supervises Johana, and nothing commercial or critical goes out without human approval, including proposals, pricing, contracts, billing and any action that cannot be undone. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. You can ask for a person to handle your matter or review anything Johana did at any time: just tell her “I want to talk to a person” or email johana@comuna18.com.
7. Who we disclose it to
We disclose personal information to the following service providers for the business purposes described above. They are contractually bound to use it only to provide their services to us and to protect it.
| Service provider | Purpose | Location | Categories disclosed |
|---|---|---|---|
| Anthropic, PBC | AI models used by Johana | U.S. | Identifiers, professional, commercial, electronic communications |
| Meta Platforms (WhatsApp Business) | Messaging | U.S. and other countries | Identifiers, electronic communications |
| Google LLC (Google Workspace) | Email, calendar, documents and storage | U.S. and other countries | All categories we collect |
| Amazon Web Services | Server that runs Johana | U.S. | All categories we collect |
| Neon | Database | U.S. | Identifiers, professional, commercial, electronic communications |
| Vercel | Receiving WhatsApp messages | U.S. | Identifiers, electronic communications |
| GitHub (Microsoft) | Code and project documentation repositories | U.S. | Identifiers, professional (incidental) |
| Stripe | Card payments | U.S. | Identifiers, customer records, commercial |
| Facturapi | Mexican electronic invoices (CFDI) | Mexico | Identifiers, customer records, commercial |
We may also disclose personal information to government authorities when required by law (for example, to Mexico’s tax authority, SAT, when we issue an invoice), or to establish, exercise or defend legal claims.
We do not sell or share personal information
We do not sell or share personal information, as those terms are defined under the California Consumer Privacy Act (CCPA), and we have not done so in the past 12 months. We do not use or disclose personal information for targeted (cross-context behavioral) advertising, and we do not knowingly sell or share personal information of anyone under 16. Because we do not collect sensitive personal information, we do not use it for any purpose.
8. Your privacy rights
Several U.S. state privacy laws (such as those of California, Virginia, Colorado, Connecticut, Texas and Oregon) give residents the rights below. Some of these laws may not apply to a company of our size or to business contacts, but we offer these rights to all of our U.S. contacts as good practice, whether or not a particular law applies to us.
| Right | What it means |
|---|---|
| Know and access | Ask what personal information we have about you, where it came from, why we use it and who we disclose it to, and get a copy. |
| Delete | Ask us to delete your personal information, subject to legal exceptions (for example, records we must keep for tax purposes). |
| Correct | Ask us to correct inaccurate information. |
| Portability | Get a copy of your information in a usable format. |
| Opt out | Opt out of the sale or sharing of personal information, targeted advertising and profiling. We do none of these, but we will honor your request and recognize Global Privacy Control (GPC) browser signals. |
| Non-discrimination | We will not treat you differently for exercising your rights. |
| Appeal | If we deny your request, you can appeal our decision (see section 9). |
9. How to exercise your rights
- Email johana@comuna18.com with the subject “U.S. Privacy Request”. Johana logs every request and passes it to Abraham Mercado Cherem, our legal representative. A person reviews and decides every request; Johana does not resolve them on her own.
- Verification: we will verify your identity by matching information we already hold, such as the email address or phone number you use with us. We will only ask for additional information if needed, and we will use it only to verify you.
- Authorized agents may submit a request on your behalf with your signed permission; we may still ask you to confirm your identity directly.
- Timing: we will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time (up to another 45 days), we will tell you why.
- Appeals: if we deny your request, reply to our decision with the subject “Appeal”. We will respond in writing within 60 days. If you are not satisfied, you may contact your state attorney general.
10. How long we keep it
We keep personal information only as long as needed for the purposes above and our legal obligations, then block and securely delete it.
| Information | Retention |
|---|---|
| Prospects who do not become clients | 2 years after last contact |
| WhatsApp and email conversations | 12 months after the relationship ends, except what must be kept for tax or contractual obligations |
| Meeting recordings | 90 days |
| Accounting and tax records (invoices, contracts, payment records) | 5 years |
| Opt-out list | For as long as you want to stay on it |
11. Cookies and tracking
This site does not use cookies or tracking technologies. If that ever changes, we will update this notice first.
12. Security
We use reasonable administrative, technical and physical safeguards, including least-privilege access with two-step verification, encryption in transit and (where available) at rest, secrets managers for keys and passwords, logs of what Johana sends, human review of all commercial or critical actions, and contracts requiring our providers to protect data. If a security incident significantly affects you, we will notify you as required by law.
13. International transfers
We are based in Mexico, and most of our service providers store data in the United States. Your information may therefore be processed in Mexico, the United States and other countries where our providers operate, always under contracts that require them to protect it.
14. Children
Our services are for businesses and professionals. We do not knowingly collect personal information from children under 16.
15. Changes to this notice
We will post any update at johana.comuna18.com/privacy with a new “last updated” date. If we make a material change, we will also let you know by email or WhatsApp before it takes effect.
16. Contact us
Comuna18, S.A. de C.V. · Attn: Abraham Mercado Cherem, Legal Representative
Hegel 141, Int. 1A, Col. Polanco, 11560, Mexico City, Mexico
johana@comuna18.com
Last updated: October 7, 2026.