Privacy notice
Last revised 20 September 2026.
This is the full privacy notice required by Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties. It is written to be read, not filed.
Who provides this service
- Service provider
- JDM Legal Tech
- Contact
- hola@switchmyai.com
- Privacy and ARCO rights
- privacidad@switchmyai.com
- Governing law
- Mexico
SwitchMyAI is a registered trademark of JDM Legal Tech.
Who is responsible for your data
The controller of your personal data is the person or entity whose name and address appear above. That address is also the address for receiving notices about personal data.
Everything in this notice is handled through the privacy email, which is above and repeated at the end.
What data we collect
We collect the data the service needs in order to exist, and not one field more. This is all of it:
- Identity and contact: your email address and, if you sign in with Google or Apple, the name those accounts hand back. We do not ask for a phone number, an address, or a date of birth.
- Account: the identifier the system assigns you, which of the three doors you come in through, the language you chose, and the dates you signed up and last changed something.
- Payment: the customer identifier Stripe gives us and, for each charge, the amount, the currency, the tax, the fee, and the country of the card. We neither collect nor see your card number: Stripe handles that directly.
- Usage: which model you used on each turn, how many tokens went in and came out, how many credits it cost, when, and the technical incidents attached to it. That is what makes it possible to bill by measurement instead of by estimate.
- Content: the documents you write and the text of every turn you send.
What we do not collect
We do not store your IP address in our database. Our host processes it in order to serve you the page, and only the country is derived from it — used for exactly one thing: deciding whether this page opens in Spanish or in English.
There is no usage analytics. The only third party that can measure anything is Meta, through an advertising pixel that loads only if you accept it in the cookie banner; what it receives and what it does not is written in the cookie notice. We build no profiles. We buy nobody’s data and we cross-reference it with no other source.
We do not ask for sensitive data and we do not want it: not health, not racial or ethnic origin, not beliefs, not biometrics, not sex life, not criminal record. Do not put it in the documents, and least of all while the providers’ terms are unpublished.
What we use your data for
These are the primary purposes, meaning the ones without which the relationship with you could not exist:
- Creating your account and letting you in.
- Running the service: sending the text of your turn to the provider you picked, handing you the answer, storing your document and exporting it.
- Measuring what each turn consumes and taking it off your balance.
- Billing you, issuing the receipt, and meeting tax and accounting obligations.
- Answering whatever you ask through support.
- Preventing fraud and abuse, and protecting accounts.
- Telling you about the service: a payment that failed, a credit about to expire, a change to the terms.
Secondary purposes: none
Today we send no marketing, we measure no behaviour, we build no profiles, and we hand data to nobody for commercial purposes.
If we ever wanted to do any of that, we would ask you first, and you could say no without losing the service. Until then there is nothing to unsubscribe from, because there is nothing at the end of the list.
What you write, and what you ask for
The text of your documents is your data and we treat it as such. We do not read it for anything other than running the service or dealing with an incident you report to us.
Alongside each document we also keep the conversation that produced it: what you asked the model for, and the receipt for each turn. That is what lets you come back to last week’s work and understand how you got there. It is deleted with the work, in the same gesture, and it goes entirely when you close the account.
We do not use it to promote the product, we do not show it to anyone, and we do not sell it.
If a document holds someone else’s personal data, you are the one who decided to put it there, and you are the one who answers for that decision.
What we still cannot promise you
On what the providers do with the text they receive, what follows is what the front page of this site says, word for word. There is no more reassuring version that is still true:
The one kind of number on this page. Each one comes from the published rate of the provider that serves the model, through the same formula for all of them. No model is marked up more than the rest.
Who your data is transferred to
For the service to work, some data leaves our systems. These are all of the destinations, and there are no others.
The first is the provider of the model you pick on each turn, which receives the text of that turn and nothing else.
- Supabase, which hosts the database and handles sign-in, in the United States.
- Vercel, which hosts and serves this page, outside Mexico.
- Stripe, which processes payments and handles your card details directly.
- Resend, which delivers sign-in and notice emails, outside Mexico.
- Google and Apple, if you choose to sign in through them: they confirm to us that you signed in and hand back your email and your name.
- The competent authorities, where a law or a court order requires it. We will tell you when that happens, unless the order itself forbids it.
Why we do not ask consent for each transfer
Every transfer in the previous section is necessary to perform and maintain the relationship with you. The law does not require separate consent in that case, which is why we do not ask for it with a banner that would change nothing.
We do not sell personal data. We do not hand it to advertisers. We do not use it to train anything of our own.
If we ever wanted to transfer your data for something other than the above, your consent would be required and we would ask for it first.
How long we keep it
Account data, your documents and the conversations that produced them, for as long as the account exists. When you close the account — or when you ask us to through the privacy email — your profile, your documents and their conversations are deleted.
Payment records and credit ledger entries are kept for as long as Mexican tax and commercial law require. They are accounting and cannot be deleted on request; they carry the minimum data needed to identify the transaction and nothing else.
Technical usage records are kept for as long as they serve to reconcile balances and detect abuse.
Your ARCO rights, and how to exercise them
Mexican law gives you four rights over your data, known as ARCO:
- Access: to know what data of yours we hold, where it came from and what we use it for.
- Rectification: to correct anything wrong or incomplete.
- Cancellation: to ask us to delete it, where no legal obligation requires us to keep it.
- Objection: to ask us to stop processing it for a particular purpose, on a legitimate ground of yours.
The procedure, and how long we take
You exercise them by writing to the privacy email above. It is free: we would only charge reproduction or shipping costs if you asked for a paper copy.
So the request can be handled, tell us your name and a way to reply to you, which data and which right you want to exercise, and attach something proving your identity — official ID is enough; if you are acting for someone else, the document that shows it.
We answer whether the request stands within twenty business days at most, and where it does, we carry it out within the following fifteen business days.
You can also withdraw your consent through the same address. Be clear on what that means: the data we process is the minimum needed to run the service, so withdrawing consent means closing the account. A turn cannot run without sending your text to the provider, and you cannot be billed without the payment being processed. Withdrawal does not undo processing that already happened, and it does not erase the accounting the law requires us to keep.
Cookies and security
There are four cookies of ours — the session, the language, the day or night appearance, and the one that remembers your choice about the pixel — and a Meta pixel that loads only if you accept it. There is no Google analytics and no third-party cookie other than that one. The detail, cookie by cookie, is in the cookie notice.
On security: data travels encrypted and the database enforces row-level access rules, so one account cannot read another’s data. Administrative access runs through a service key belonging to this platform alone, shared with no other.
No system is impregnable. If there were a breach that significantly affected your data, we would tell you.
Changes to this notice, and what to do if you disagree
This notice may be updated. The date of the last revision is at the top, and the version in force is always the one published on this page. If a change substantively affects the purposes or the transfers, we tell you by email before it takes effect.
If something does not add up, write to us first: if we got it wrong, we fix it.
And if you are still not satisfied with how we handled your request, you can go to the Mexican federal authority for the protection of personal data, which oversees compliance with this law.
Is anything on this page unclear? Write to us and we will explain it. A document you have to decode is badly written, not badly read.