Privacy Policy
DRAFT — PENDING HUMAN LEGAL REVIEW. This English text is a reading translation of the Spanish Privacy Policy, prepared by an AI agent and not yet reviewed by a lawyer. It has no legal effect. The binding version is the Spanish one, published at /legal/privacidad; if the two differ, the Spanish text prevails.
Version: v4 (English draft of the Spanish v3) In force from: the publication date of the Spanish document Legal operator: Metamorfosis Ads Digital Empresa Individual de Responsabilidad Limitada (Metamorfosis Ads Digital R.L.), legal ID 3-105-917457, Costa Rica Brand: Agentic AI Systems Group · Product: IA Web Conversion Privacy contact: privacidad@metamorfosisadsdigital.com
0. Who is responsible for your data
The data controller is Metamorfosis Ads Digital Empresa Individual de Responsabilidad Limitada, legal ID 3-105-917457, Costa Rica, which operates the product IA Web Conversion under the brand Agentic AI Systems Group.
1. What we collect, and why
From your account
| Data | Why | Source |
|---|---|---|
| Your e-mail address | It is how you sign in; we use no passwords | You |
| User and session identifier | Keeping you signed in | Generated |
| One-time access codes | Verifying that it is you | Generated |
Codes are stored hashed, never in readable text, expire in 5 minutes and allow 3 attempts.
We do not store your IP address. To control abuse we store a salted hash of the IP, which lets us count requests without identifying the person.
We use no passwords and no social login, so no password of yours exists in our systems.
From the free audit
To analyze your site we ask only for your website address. You need no account and no card.
When the analysis ends, to show you the full audit and send it to you by e-mail we ask for:
| Data | Required? | Why |
|---|---|---|
| Your e-mail address | Yes | Sending you the report and keeping your access to it |
| Your name | No | Addressing you by name |
| Your business name | No; we read it from your site and you can correct it | Naming your business the way you name it |
| Delivery consent | Yes | Without it we cannot save or send you the audit |
| Commercial consent | No, and it is unticked | Only if you want to receive commercial information |
We also store the page language, which version of each consent text you accepted and when, the campaign parameters of the address you arrived through (for example utm_source; never the rest of the address), and a salted hash of your IP to control abuse.
We do not ask for a phone number.
From your website
Publicly accessible information from your site: business name, description, phone numbers, e-mail addresses, address, hours, services, products and prices your site publishes, together with the address of each page where we found it and a fragment of the text as evidence.
We also store a copy of the HTML of each page read, so we can explain later where each fact came from without bothering your server again.
We respect robots.txt. We do not try to access protected areas, we use no credentials, and we bypass no access control. If a page asks for authentication, we stop.
If your site publishes personal data —a person's mobile number, for example— that data enters our system because your site made it public. You declare that you have authority to ask us to process it.
From what you confirm to us
When you confirm, choose or correct a fact, we store your answer, who gave it and when. Your correction does not change what your site said: it is recorded separately, and the two are always distinguished.
From your billing
What we keep about your purchase: the opaque reference we generate ourselves so the payment can be linked to your account, the e-mail address you bought with on Hotmart, the subscription code when there is one, the payment status and the date.
That address may differ from the one you sign in with. We use that email only to send your purchase confirmation and the link needed to activate your access.
We do not see, receive or store your card number. That happens entirely inside Hotmart.
If you buy before creating your account
If you make a purchase before creating your account, we keep the information needed to relate that purchase to your audit and to complete the activation of your access.
Depending on the flow, this may include your confirmation that your business is located in a market where we sell (a statement of yours, not a verification of your location), the version and date of the terms you accepted, opaque internal references for the purchase and technical security data used to protect the process, such as a salted hash of your IP address (never the address itself).
Before the payment we do not ask you for a code, we do not create an account and we do not ask for your business's country or state. Your access is activated after the payment, when you confirm an e-mail address with a code. We then ask for the country and, in the United States, the state where your business is registered: that answer decides where we can publish.
IA Web Conversion does not receive or store your payment card data. The payment is processed by Hotmart.
From the ownership of your domain
Verification records: the domain, the method, when it was verified and who did it. The secret verification value is stored only as a hash.
From operations
An audit log of relevant actions —sign-in, claiming a business, confirmations, billing events, ownership changes, publication and withdrawal— with who, what and when.
2. What we use all of this for
Only to provide the service: analyzing your site, building and showing your business information, delivering the audit you asked for, charging you what was agreed, verifying ownership, protecting the service from abuse, and answering if something goes wrong.
The free audit and its delivery by e-mail
We use your e-mail address to deliver the audit you asked for: we show it to you on the page and send a report to that address. That is what the delivery consent is for, and why it is required.
What the report contains: the domain analyzed, the analysis date, the pages found and the pages analyzed (up to 20 in the free scan), the business facts we identified, contradictions between pages, the main findings, the limitations of the analysis and a secure link to reopen your audit. It is in the body of the e-mail and attached as a PDF. It contains no prices and no advertising.
The secure link is a random 256-bit code. We store only its hash, never the code. It expires after 30 days, stops working if you ask us to send the report again (the new e-mail carries a new link) and contains neither your e-mail, your name nor your domain. When you open it, your browser receives a 2-hour audit session cookie (section 8). Do not forward that e-mail: whoever has the link can see your audit while it is valid.
The commercial consent is optional and unticked. If you leave it unticked you still see and receive your full audit, and we send you no advertising. If you tick it, we store that decision with its date; today we send no commercial e-mails (section 9).
The free audit, the report and its delivery cost nothing and sign you up for no plan.
We do not sell your information. We do not share it with advertisers. We do not train AI models with your data.
3. What becomes public, and when
Nothing is published until you explicitly approve it. Neither the analysis, the review, the domain verification nor the payment publishes anything.
When you approve publication, the business information you reviewed becomes publicly accessible in machine-readable format. Anyone can read it, including automated systems.
Your sign-in e-mail, your user identifier, your billing data, and any fact we decided to withhold because we could not read it reliably are never published.
You can ask us to withdraw the publication at any time —the active version or everything, including earlier versions— and we do so. Whatever third parties copied before the withdrawal is beyond our reach.
4. How long we keep each thing
| Category | How long | Why |
|---|---|---|
| Account and e-mail | While the account exists | It is your access |
| Sessions | 7 days, renewed with use | Security |
| Access codes | 5 minutes | Security |
| Content read from your site (HTML, evidence) | While the business is active with us | Explaining the source of each fact |
| Observations and resolved information | While the business is active | It is the product |
| Version history and superseded information | While the business is active | Explaining what changed and when |
| Your confirmations and corrections | While the business is active | They stand as yours |
| Domain verifications | While the business is active | They support ownership |
| Audit log | While the business is active, and after closure the period the law requires | Answering what happened and who did it |
| Billing | The applicable accounting and tax period | Legal obligation |
| Purchase started and not paid | The link back to the purchase works for 72 hours. The record is not deleted automatically: it is kept until you ask for its deletion | Linking a payment that arrives late and showing what was accepted and when |
| Paid purchase, including one made before creating the account | Like billing: the applicable accounting and tax period | Legal obligation and support of your access |
| Purchase activation link | 30 days from the payment confirmation; its hash only | Security |
| Free analyses, their contacts and the report delivery record | Until you ask for deletion. They are not deleted automatically today | Reopening the audit and showing what was sent and when |
| Secure audit link | 30 days; its hash only | Security |
| Audit session (cookie) | 2 hours | Security |
| Published artifacts | Until withdrawal; the publication record remains | Traceability |
5. Your rights
You can ask us for:
- Access — a copy of your account and business information.
- Correction — inside the product for your business data; by e-mail for your account data.
- Deletion — of your account and your business information.
- Withdrawal of the publication — immediate.
Write to privacidad@metamorfosisadsdigital.com. Today these requests are handled manually, not with a button in the application.
Response times. We apply your country's period when its law sets one, and when it does not, the shortest we know of:
| Country | Access | Rectification / deletion |
|---|---|---|
| Costa Rica | 5 business days | Without undue delay |
| Argentina | 10 calendar days | 5 business days |
| Mexico | 20 days, extendable once | 15 more days to make it effective |
| El Salvador | Without undue delay | Without undue delay |
| The other countries we serve | Without undue delay, 15 days maximum | Without undue delay, 15 days maximum |
Where your law sets a period shorter than this table, the shorter one applies.
In addition, in Costa Rica: we act on a withdrawal of consent within five business days and notify, within the same period, anyone we transferred data to, and we confirm the end of processing within three business days, at no cost.
If we deny a request, we justify it in writing, and you can go to the data protection authority of your country — PRODHAB in Costa Rica, the SIC in Colombia, the AAIP in Argentina, the federal authority in Mexico, the ACE in El Salvador, ANTAI in Panama, and whichever corresponds in your jurisdiction. Where your country does not yet have a functioning data protection authority, we tell you so instead of naming one that does not exist.
What we cannot delete immediately: the audit and billing records that must be kept by legal or accounting provision. The Regulation to Costa Rica's Law 8968 itself provides that the right of deletion does not apply when the data must be kept by constitutional, legal or judicial provision.
In that case we delete your account and your business's active and public information, keep only the minimum record required, use it for no other purpose, and tell you so.
5 bis. If your data appears on someone else's site
If you are an identifiable person —an employee, a contact— and your name, phone or e-mail appears on the website of a business that uses IA Web Conversion, you have the same rights over that data even if you are not our customer.
Write to privacidad@metamorfosisadsdigital.com. We can:
- tell you what we hold and which page we took it from;
- correct it or delete it from our system;
- withdraw the publication immediately while we review your request, without waiting to settle who is right.
What we cannot do is change the business's website: its owner controls that, and that is where the data was made public.
6. Who we share information with
Only with the providers needed to operate, and there are three:
- Cloudflare — infrastructure and database.
- Hotmart — checkout and payment processing.
- Resend — transactional e-mail. To send you the audit report it receives your e-mail address, the report content and the attached PDF.
Meta Platforms receives advertising measurement only if you accept it. If you do, Meta receives from your browser: which step of the journey happened — the page was seen, the form was touched, an analysis was started or completed, an e-mail was left, the result or the letter was seen, or the buy button was pressed — our pixel's identifier, a random per-event identifier, the published Agent Ready Build price (US$199) and the page address. Meta may additionally collect, on its own account, whatever your browser sends with any request, and its _fbp / _fbc cookies.
We never send it: your e-mail, your name, your phone, the domain you typed, the address we analysed, or the content of your diagnosis.
We use it to measure whether our advertising campaigns work — how many people arrive, how many try the analysis and how many buy — not to decide anything about you in particular. If you do not accept, nothing is sent.
Anthropic is listed as a planned provider for extraction with artificial intelligence; it is not active today —zero model calls in the system— and if it is activated, we update this policy first.
If you want the detail of what each provider receives, ask privacidad@metamorfosisadsdigital.com and we will send it to you.
We also share if the law requires it, and we record it.
7. Where your information is processed
Your data is processed outside your country. We tell you clearly because it is so and because your law probably gives you the right to know.
- Cloudflare — global network; the database operates in North America.
- Hotmart — processes the payment from its own regions.
- Resend — sends the e-mail from its own.
- Meta Platforms — if you accept measurement, receives those events in its own regions, outside your country.
We chose providers that offer contractual data protection commitments. We have not yet verified their processing agreements one by one, and we would rather say so than imply a review we did not do.
If your law gives you the right to object to an international transfer, write to privacidad@metamorfosisadsdigital.com.
8. Cookies
We use only strictly necessary cookies. They are HttpOnly, Secure and SameSite=Lax:
- authentication cookies, so you can sign in;
iawc_diag, the session of your free audit: it lasts 2 hours, we store only its hash, and it only lets that audit be viewed;iawc_co, technical and necessary: it lets the browser return securely to the associated purchase context. The cookie lasts 72 hours and holds an opaque reference; on our server we store only its hash;iawc_act, technical and necessary: it lets the activation after the purchase continue securely. The cookie lasts 1 hour. It is separate from the activation link we send you by e-mail, which is valid for 30 days from the payment confirmation; of that link we store only its hash.
If you choose a language by hand, we store that choice in a preference cookie that does not identify you.
Advertising measurement, only if you accept it. We use Meta's browser pixel to measure our campaigns. We ask first, with a notice offering _Accept_ and _Reject_ at equal prominence and a link to this policy:
- Before you choose, and if you reject, nothing from Meta is loaded: no script, no image, no cookie of theirs. It is not a preference we switch off afterwards; the request is never made.
- If you accept, we store your choice in a cookie of our own,
iawc_measure(valuesgrantedordenied, 180 days). That cookie is only your consent preference: it identifies nobody and is sent to no third party. - Only then does Meta's pixel load. It may write its own cookies in your browser (
_fbp, and_fbcif you arrived from an ad) and receive the events described in section 6. - You can withdraw consent whenever you like, from the link kept in the page footer. From that moment no further event is sent; what was already sent cannot be recalled from Meta.
- Rejecting does not limit the service: the free analysis, the diagnosis and the purchase all work the same.
We use no other analytics or tracking system, and we transmit no events from our server to any advertising platform.
9. E-mails we send you
Only transactional and security e-mails: the free audit report you asked for, your access code, the domain verification confirmation, notices about the ownership of your business and billing notices.
We send no promotional e-mails and there is no marketing list. Accepting the Terms does not sign you up for anything. If you ticked the commercial box in the free audit, that decision is stored; if we ever send commercial information, it will be only to those who ticked it, with a way to unsubscribe in every e-mail, and we will update this policy first.
10. Minors
The service is for businesses and is not directed at minors. We do not knowingly collect information from minors.
11. Security
Strict isolation between customers, encryption in transit, access codes stored hashed, least-privilege access, audit logs and security audits before every significant version.
If an incident occurs that affects your data —loss, destruction, misplacement or another irregularity in processing or storage— we notify you within five business days of when it occurred or when we learned of it.
That period is the one required by the Regulation to Costa Rica's Law 8968, and we apply it to all our customers in the region: it is the shortest we know of and it makes no sense to notify you later for living in another country. We tell you what we know, what we did and what we recommend you do.
12. Changes
We publish the new version with its date. If a change materially affects your rights, we notify you by e-mail.
13. Contact
privacidad@metamorfosisadsdigital.com
Metamorfosis Ads Digital Empresa Individual de Responsabilidad Limitada — legal ID 3-105-917457 — Costa Rica
See also the Terms of Service (draft).