Privacy Policy

1. Who we are and how to reach us

Castelo Tech S.A.P.I. de C.V. (“Castelo”, “we”) is the controller (responsable) of the personal data described in section 3. This document is our full privacy notice under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”).

Castelo is a software platform for insurance agents and agencies: portfolio management, receipt and premium payment follow-up, renewals and trámites (insurer requests), CRM, client communication and AI-assisted features.

This policy applies to castelotech.com (product and website), to castelo-ai.com and www.castelo-ai.com (an informational site that serves the same pages), to the transactional e-mails we send from castelocloud.com and to Castelo’s WhatsApp line.

Requests about your personal data, including ARCO requests, are handled by Castelo’s Personal Data Protection team at contacto@castelotech.com (see section 14). For general questions you can also write to Castelo’s WhatsApp line, +52 81 1009 0177; for product support, to soporte@castelotech.com. All contact details are in section 20.

2. Our two roles: controller and processor

Castelo acts in two different roles. As controller, we decide about the data of people who use Castelo or our websites: your account, your organization and its billing, the Portfolio x-ray, our forms, communications with us and the security of the service. As processor (encargado), when an agency or agent uploads, connects or syncs information about its clients (policies, receipts, contacts, WhatsApp conversations, e-mails, documents or quotes), we process that data on its behalf and according to its instructions; that agency or agent is the controller toward its clients and must give them its own privacy notice.

Data belongs to whoever provides it. Castelo does not own the information about an agency’s or agent’s clients and processes it only to provide the service to that agency or agent (section 5).

Data subject (titular)

The individual to whom the personal data relates.

Customer (agency or agent)

The person or company that uses Castelo for its insurance business and decides about the data of its own clients and prospects.

Organization

A Customer’s workspace in Castelo, with its members, portfolios, documents and integrations.

Member

Each person with access to an organization, with the role the organization assigns.

Castelo is independent software. It is not affiliated with, sponsored or endorsed by Seguros Monterrey New York Life, and it does not claim backing, sponsorship or endorsement from Meta, WhatsApp, Google or Microsoft. Any third-party service remains subject to its own terms, policies and requirements.

3. Data we handle as controller

We do not request sensitive personal data for these purposes. The only financial data we handle as controller is the billing data described above; card data is handled by Stripe directly.

4. Why we use your data

Primary purposes. These are necessary for your relationship with us (article 9, section IV, of the Law):

• creating, verifying and securing your account and your organization;
• providing the contracted service and the integrations you turn on;
• managing your plan and billing through Stripe;
• running the Portfolio x-ray when you request it and showing you the result;
• preventing abuse and fraud (geographic filtering, usage limits, reCAPTCHA checks and the x-ray password fingerprint);
• providing support and answering your communications;
• complying with legal obligations and requests from competent authorities;
• giving you security and operational notices about your account.

Secondary purposes. These are not necessary for the service and require your consent; you may refuse them:

• (a) sending you news about Castelo, only if you tick the box “Quiero recibir novedades de Castelo” (I want to receive news from Castelo);
• (b) contacting you, with the data from the start form, to help you complete a Portfolio x-ray you started.

You can refuse these purposes or withdraw your consent at any time: untick the box or write to contacto@castelotech.com with the subject “Finalidades secundarias” (secondary purposes). Refusing does not affect the service.

We do not sell or rent personal data and we do not use it for third-party advertising. We also do not combine data from different organizations or build profiles for our own advertising or commercial purposes, and we do not use the data we process on behalf of our customers for our own purposes.

5. Data we process on behalf of our customers

When an agency or agent uses Castelo, we process, as processor, information about its clients and prospects. Depending on the features the organization uses, it may include:

This information may include financial or patrimonial data (premium amounts, bank, last digits of the card or CLABE) and data that may reveal health-related information about insured persons, such as each insured person’s coverages shown by the insurer’s portal (for example, major medical) and the information in major medical trámites (insurer requests) or claims, as well as any such information your team chooses to save in documents, notes or conversations. It may also include data of minors registered as insured persons.

We process this data only to provide the service to the organization that provides it; we do not use it for our own purposes, we do not sell it and we do not share it with other organizations.

The agency or agent decides what information it uploads or connects, and must have the rights, notices and consents needed to do so. When it instructs us (for example, to read a portal, send a message or produce a quote) we act on its behalf. This data is accessed by the organization’s members according to their role and, when necessary for support, security or legal obligations, by authorized Castelo personnel.

6. Insurer portal credentials

Today only the Seguros Monterrey New York Life (SMNYL) portfolio is synced automatically; information from other insurers is uploaded as files. When you request it, Castelo uses your SMNYL advisor-portal credentials to read your portfolio information on your behalf.

For the daily sync we store your portal username and password in an area of our database that only Castelo’s servers can access; the app cannot read it. It is protected by Google Cloud’s encryption at rest, but it has no additional application-level encryption. During the first validation, the credentials also pass through the execution history of our orchestration service on Google Cloud.

The sync only reads information; it does not change policies or send messages from the portal. The Cotizador (quoting tool), when you use it, does enter in the insurer’s portal the prospect data you provide in order to produce the quote. The portal sessions the Cotizador uses are kept only on Castelo’s servers.

To sign in to the portal we send only the captcha image to an external solving service (2captcha); never your credentials or your portfolio data. For the Cotizador, only the public reCAPTCHA site key and the page address are sent.

We also keep a technical copy of the information read from the portal (sync archive) on Google Cloud, in the United States. Today that copy has no automatic deletion period and is deleted on request.

How to revoke access: change your password in the insurer’s portal. Archiving or “deleting” a portfolio in Castelo stops the sync, but today it keeps the information and the credential; to erase them, ask us (see Data Deletion).

7. Portfolio x-ray (Radiografía de cartera)

The Portfolio x-ray is a free, single-use service at castelotech.com/radiografia, available only from Mexico and the United States. On your express instruction and with your consent, Castelo signs in once to the SMNYL advisor portal with the credentials you provide in order to read only the pending receipts of traditional policies, in two three-month windows around the current month, and the related declined charges, and shows you a summary with its per-policy detail.

The x-ray does not collect your clients’ phone numbers or e-mail addresses: only policyholder names, policy numbers, amounts and dates. For that reading, Castelo acts as processor on your instruction; we handle your access data and the campaign data as controller.

7.1 Your password

The password you enter for the x-ray is transmitted encrypted, used only once during the reading and not stored in any database, file or log.

To prevent repeated or abusive access we keep, for 30 days from your last attempt, your portal username and an irreversible fingerprint of the password, which cannot be used to recover it. Authorized Castelo personnel can consult that record for security purposes.

7.2 What data we handle

• your e-mail address and the access account created for the x-ray;
• source campaign data (utm parameters, fbclid, referring site and landing page) and your browser’s device type and user agent;
• your IP address, only as an irreversible fingerprint, and the country you connect from;
• your consent, its version and your choice about receiving news;
• the receipt and charge data described above.

If you fill in the start form, we also handle your name, e-mail address, WhatsApp number and approximate number of policies, to give you the estimate and, unless you object, to help you complete your x-ray (section 4). That data is deleted after 180 days.

7.3 How long we keep the x-ray

• If you do not create a Castelo account, the x-ray results (the record, the per-policy detail and the report files) are deleted after 30 days. This rule applies in full to x-rays generated from October 22, 2026 onward; for earlier ones, the per-policy detail is deleted when you use “Delete my data” or when you ask us to.
• The access account created only for the x-ray (with no organization) is deleted when you use “Delete my data” or when you ask us to.
• If you create an account, the x-ray is linked to your portfolio: the record is kept for up to one year and its summary becomes part of your portfolio data.
• Access links are single-use and expire after 24 hours; we send the link to your result by e-mail.
• Anti-abuse records are kept for 2 to 7 days.

7.4 “Delete my data”

The report includes the “Borrar mis datos” (Delete my data) button. It deletes the x-ray, its detail, the result links, the stored files and the x-ray’s link to the anti-abuse record (the username and the fingerprint are kept until their 30 days are up). If the account was created only for the x-ray, belongs to no organization and has no other x-rays, it also deletes the account, its identity and its usage-limit record. It is not available while a reading is in progress. You can also exercise your ARCO rights and withdraw your consent as described in section 14.

7.5 Providers and independence

The providers involved in the x-ray are Google Cloud (infrastructure, authentication and reCAPTCHA), Mailgun (e-mail delivery) and 2captcha (solving the portal’s captcha; it receives only the challenge image, never your credentials or your data). Castelo is independent software; it is not affiliated with or endorsed by Seguros Monterrey New York Life.

8. WhatsApp

8.1 How it works today

The WhatsApp integration is optional and available on the Pro and Empresas plans. It works as a linked device: someone in your organization scans a QR code from the WhatsApp app on their phone, just as when opening WhatsApp Web, and a server dedicated to your organization, operated by Castelo on Google Cloud, keeps that session so the number’s messages can be viewed, organized and sent from within Castelo. Each organization can link up to three numbers. This integration does not use the official WhatsApp Business Platform (Cloud API), and your WhatsApp account remains subject to WhatsApp’s terms and policies.

The integration works with your WhatsApp or WhatsApp Business account. Your organization’s server is on Google Cloud in the United States (Dallas or Iowa) or in Mexico (Querétaro), and the session profile is stored on that server’s disk. When it is not in use, the server stops after 30 minutes and the organization’s members can wake it from Castelo.

8.2 What data we sync

From the individual chats of the linked number (not groups, broadcast lists or status updates) we store: the contact’s name and number, profile name, dates, read status and a preview of the last message. We also store the contact list of the linked phone (saved name, profile name and number), which may include personal contacts who are not clients. The profile photo is fetched only for chats linked to a client with a policy. The full text of messages, sent and received, is stored only for chats with contacts linked to a policy or assigned by your team, and only while AI analysis is on in your organization (it is on by default). Media files are not stored in our database unless someone on your team saves them to the document library; the rest of the history is shown live from your organization’s server. If someone on your team transcribes a voice note, the audio is processed with Google Cloud Speech-to-Text and the transcript is saved with the conversation.

This information includes names, numbers and messages of people who do not use Castelo. Castelo processes it as processor, on behalf of your organization (section 2).

8.3 Who can see it

Members of your organization and, when necessary for support or security, authorized Castelo personnel.

8.4 Sending messages

Your team can send individual messages from Castelo and schedule batch sends, which go out spaced 45 to 105 seconds apart. Messages are sent from the WhatsApp account of the linked number. Lu can run in three modes: off, suggest (it proposes drafts that a person reviews and sends) or automatic. Automatic mode is your organization’s decision and runs with these safeguards, applied on our servers:

• it does not reply when the case has been escalated to a person or when there is no draft;
• it respects the pauses your team sets;
• it replies only during business hours (by default, 09:00 to 20:00, Mexico City time);
• it pauses when the contact writes the opt-out keyword;
• it backs off for 2 hours when someone on your team steps into the conversation;
• it sends at most 3 automatic replies per conversation per day (default value);
• an escalation pauses all automation for that conversation for 48 hours (configurable from 1 hour to 14 days).

Follow-up and reminder messages that use fixed templates go through the same checks. We also apply technical limits per number: 40 messages per minute, 2,000 every 24 hours and 64 KB per message. Escalated cases are handled by a person on your team; your organization must keep someone available to attend to them.

8.5 Opt-outs and recipients’ agreement

If a contact writes the opt-out keyword your organization sets (by default, “BAJA”), Lu stops replying to them automatically. Today this does not, by itself, block messages sent by your team or scheduled sends: your organization must honor any request not to receive messages, made on or off WhatsApp.

To put it plainly: today the opt-out keyword pauses only Lu. In addition, the authorization you give when you link your number allows Castelo to operate that session on your organization’s behalf, but it is not the consent of the people you message. Obtaining each person’s agreement to receive messages and honoring their opt-outs is your organization’s responsibility.

8.6 Uses we do not make

We do not sell WhatsApp data, we do not use it for advertising, we do not use it to decide anyone’s eligibility for insurance, credit, employment or housing, and we do not use it to train AI models. We use it only so that your organization can serve its clients and follow up on their policies.

8.7 Unlinking and deletion

• Unlinking a number from Castelo’s WhatsApp section logs out the linked device, deletes the session profile on the server and deletes our copy of that number’s conversations, contacts and messages. The session record is kept, marked as deleted.
• Logging out from your phone (Linked devices) ends the session, but does not by itself delete that copy; to delete it, unlink the number in Castelo or ask us.
• To delete voice-note transcripts, drafts or AI records related to those conversations, ask us.
• If your plan stops including WhatsApp, we delete your organization’s server, its disk, its domain name and its IP address after a 14-day grace period. The copy of the chats stored in our database is not deleted by that step: it is kept until you delete it or ask us to.
• Castelo cannot delete messages from WhatsApp’s servers or from the phones of the people you chatted with.

8.8 WhatsApp Business Platform (testing)

Castelo is testing an integration with Meta’s WhatsApp Business Platform. Today it only receives technical notifications from Meta in a test environment (for example the sender’s number, message type, delivery status and an excerpt of the text). It sends no messages and is not connected to our customers’ accounts. We use that data only to test the integration and keep it for 30 days. We will update this policy before offering the integration to customers.

Meta processes that data under its own terms and policies. If you want us to delete the test notifications related to your number sooner, write to us with that number.

8.9 Our WhatsApp line

If you write to Castelo’s WhatsApp line (+52 81 1009 0177), Castelo is the controller of those messages. We use them only to reply to you and handle your request, and we delete them when you ask.

8.10 Independence and scope

Castelo is independent software; it is not affiliated with, sponsored or endorsed by WhatsApp LLC or Meta Platforms, Inc. WhatsApp is a trademark of WhatsApp LLC, and we mention it only to describe the integration.

Castelo does not buy debts or portfolios and does not offer debt-recovery services through WhatsApp; any follow-up service performed by Castelo personnel for an agency requires a separate written agreement. The messaging features exist so that each agent can serve their own clients about their policies, for example about pending or upcoming receipts, declined charges and renewals.

9. Connected e-mail

The e-mail integration is optional. You can connect a Gmail, Outlook or other IMAP/SMTP-compatible mailbox using an app password you generate with your provider; Castelo does not use Google’s or Microsoft’s API access to your mail. The password is stored in an area of our database that only Castelo’s servers can access, protected by Google Cloud’s encryption at rest, but without additional application-level encryption.

Once connected, our service checks the inbox about every 3 minutes (the first time, the 25 most recent messages; after that, up to 40 per check) and stores for each e-mail: sender, recipients, cc, subject, snippet, the full body in text and HTML, and information about the attachments, but not the attachments themselves.

E-mails you send from Castelo go out through your own provider’s SMTP server. Attachments for a send are taken from the document library (up to 10 files and 25 MB). Castelo does not send e-mails to your clients on its own: an e-mail leaves the connected mailbox only when a person on your team sends it.

The connected mailbox is shared: any active member of your organization can connect it, disconnect it and send e-mails from it.

Disconnecting the mailbox deletes the app password; e-mails already synced are kept until you ask us to delete them.

If you sign in with Google, we receive only your basic profile (name, e-mail and photo); this gives no access to your mail.

10. Artificial intelligence: Lu

Lu, Castelo’s AI assistant, uses Anthropic’s Claude models, which we access directly through Anthropic’s API. Voice-note transcription uses Google Cloud Speech-to-Text.

Message analysis is on by default when an organization is created; the organization owner or an admin can switch it off at any time in the AI settings. Suggestions and automatic replies are off by default. When someone turns on suggestions or automatic replies in the AI settings, we record who accepted and when; members with WhatsApp access can also choose Lu’s mode for each conversation.

Lu is triggered only by new messages from contacts linked to a policy or assigned by your team; as context it sends the current month’s conversation history, and it never processes earlier conversations retroactively. Your team can turn listening off for each conversation. When Lu detects a payment promise, it creates a task for your team, and every day it prepares a digest (the last 30 are kept).

Lu does not send anything on its own: it produces analyses and drafts. Only in automatic mode, which your organization must turn on, do messages go out without prior review, and always through the safeguards described in section 8. Lu treats clients’ text as information, not as instructions.

Lu does not decide the purchase, coverage, underwriting, price or eligibility of any insurance or credit, or whether a claim is valid. Its analyses and drafts may contain errors and your team must review them.

Every model call is recorded in your organization’s AI usage log, which the organization owner and admins can view. There are monthly usage limits per organization and daily platform limits; when they are reached, Lu may be temporarily unavailable.

Under Anthropic’s commercial terms in effect on the date of this policy (October 22, 2026), Anthropic does not use content it receives through its API to train its models. Castelo does not train or fine-tune AI models with your data or your clients’ data. Anthropic operates outside Mexico and keeps the information it receives under its own terms and retention policies.

If you believe an automated processing significantly affects you without human intervention, you can object as described in section 14.

11. Service providers that process data for us

These providers process data on Castelo’s behalf so that we can provide the service. We share with them only the data their function requires:

WhatsApp and the insurers are not our processors: they are services you choose to use or that you ask us to access, and they process data under their own terms. When you use the Cotizador, we send the prospect data to the insurer on your instruction.

Your browser also connects to Google Fonts to load typefaces and, at checkout, to Stripe (section 17).

12. Transfers and where data is located

Our main database is on Google Cloud in Querétaro, Mexico. Processing (servers, sync, AI), file storage and the team chat run on Google Cloud in the United States; WhatsApp servers may be in the United States or in Mexico. Some providers (Anthropic, Mailgun, Stripe, 2captcha and Algolia) operate outside Mexico.

What we share with our providers is a communication to processors (remisión) and does not require your consent. We transfer data without your consent only in the cases of article 36 of the Law (for example, requests from a competent authority or to defend a right in legal proceedings). We do not make transfers that require your consent; if we wanted to do so in the future, we would ask you first.

When we act as processor, we share the data of an agency’s or agent’s clients only on its instruction (for example, with the insurer for a quote) and with the providers in section 11. Any transfers the agency or agent decides to make are its responsibility.

13. How long we keep data

We keep data only while it is needed for the purposes in this policy. This table summarizes the periods; “Automatic” means deletion happens without you having to ask.

Portfolio x-ray. Without a Castelo account, results are deleted after 30 days (for x-rays generated before October 22, 2026, the per-policy detail is deleted with “Borrar mis datos” (Delete my data) or on request); with an account, the record is kept for up to one year. Details are in section 7.

After cancellation. After cancellation, we keep your account and organization data until the organization owner asks us to delete it; after deleting it, we will keep it only in blocked form for as long as our legal obligations require.

Blocking and exceptions. When personal data is cancelled, it goes through a blocking period, during which it is kept only to meet the liabilities arising from the processing, and is then erased (article 24 of the Law). We are not required to cancel data in the cases of article 25 of the Law; for example, when it is needed to perform a contract or must be kept by law, such as billing records.

Provider recovery windows. After a deletion, the database can be recovered for up to 1 hour and deleted files are recoverable for up to 7 days; after that, the provider erases them. Application technical logs are kept for 30 days and infrastructure audit logs for 400 days.

14. ARCO rights, withdrawing consent and limiting use

You have the right to access your personal data, to rectify it when it is inaccurate or incomplete, to cancel it and to object to its processing (ARCO rights: access, rectification, cancellation and objection). You can also withdraw the consent you have given us and limit the use or disclosure of your data.

14.1 How to file a request

Write to contacto@castelotech.com with the subject “ARCO rights” (a subject in Spanish, “Derechos ARCO”, also works). Requests are handled by Castelo’s Personal Data Protection team. Your request must include:

• your name and your address or any other means to receive notices;
• documents proving your identity or, where applicable, your representative’s authority and identity;
• a clear and precise description of the data for which you want to exercise a right, except for the right of access;
• a description of the right you want to exercise or of what you are requesting;
• any other information or document that helps locate your data.

If you request a rectification, also state the changes to be made and provide documents that support them. If you write from the e-mail address associated with your account, we will take that into account to verify your identity; if needed, we will ask for additional documents.

14.2 Deadlines and response

We will answer within 20 business days from receipt of your request and, if it is granted, carry it out within the following 15 business days after our answer; these periods may be extended once, for an equal period, when justified.

A person on our team will answer you through the same channel you used to file the request. For the right of access, we will deliver the data, as electronic copies, once your identity or your representative’s has been verified.

14.3 Cost

Exercising ARCO rights is free of charge. We could only charge the costs of reproduction, copies or shipping; if you provide the electronic medium to reproduce the data, delivery is free. If you repeat your request within less than twelve months, the costs will not exceed three times the Unidad de Medida y Actualización (UMA) in effect, unless there are substantial changes to this policy that prompt new inquiries.

14.4 When we may refuse a request

We may refuse to give effect to a right, in whole or in part, when the data subject or their representative is not properly identified; when we do not hold the data; when it would harm a third party’s rights; when a legal impediment or a decision of a competent authority restricts it; or when the rectification, cancellation or objection has already been carried out. In every case we will tell you the reason within the deadlines above.

14.5 Withdrawing consent and limiting use

You can withdraw your consent at any time by writing to contacto@castelotech.com. Withdrawal has no retroactive effect and, if it concerns data needed for your account, it may prevent us from continuing to provide the service. To limit the use or disclosure of your data you can:

• untick the news box or ask us not to use your data for the secondary purposes;
• switch off AI message analysis (organization owner or admin) or Lu’s listening for a conversation;
• unlink WhatsApp numbers or disconnect the e-mail mailbox;
• change your password in the insurer’s portal to revoke our access;
• clear the Castelo data stored in your browser;
• write to us to request any other limitation.

14.6 Automated processing

You have the right to object to automated processing of your data that produces unwanted legal effects or significantly affects your interests, rights or freedoms without human intervention (article 26, section II, of the Law). Lu does not make purchase, coverage, pricing or eligibility decisions, and its drafts are sent by a person on your team, except in the automatic mode each organization turns on.

14.7 If you are a client of an agent who uses Castelo

If you are a client of an agent who uses Castelo, send your request to that agent; if you write to us, we will forward it to them and help them handle it. In those cases Castelo acts as processor: the agency or agent decides on your request and we coordinate with it to carry it out within the legal deadlines.

14.8 Authority

If you are not satisfied with our answer, you can file a data protection request with the Secretaría Anticorrupción y Buen Gobierno (Mexico’s Ministry of Anti-Corruption and Good Governance) within 15 business days after the date we communicate it to you. If you receive no answer, you can file it once our deadline to answer has passed.

15. Data deletion

You can delete some of your data yourself:

• Portfolio x-ray: the “Delete my data” button on the report (section 7).
• WhatsApp: unlink the number from Castelo’s WhatsApp section; this deletes our copy of its conversations, contacts and messages (section 8).
• E-mail: disconnecting the mailbox deletes the app password; synced e-mails are deleted on request.
• AI: the organization owner or an admin can switch off message analysis; from then on we stop storing the text of new messages, and those already stored are deleted on request.
• News: untick the box or write to us.
• Browser: clear the site data in your browser settings.

To delete your account, your whole organization (organization owner only), a portfolio and its credential, the e-mail or WhatsApp copy or other data, write to contacto@castelotech.com with the subject “Personal Data Deletion Request — Castelo”. Today, accounts and organizations are deleted on request. The steps, what we keep and the timelines are on the Data Deletion page.

16. Security and incidents

Our measures include:

• HTTPS across the service, with HSTS and security headers on our websites; WhatsApp servers also use HTTPS;
• encryption at rest managed by Google Cloud;
• database access rules that restrict each organization’s portfolio information to its members, according to their role;
• server-only areas for credentials and secrets, and infrastructure secrets kept in a managed secrets vault;
• private internal services that accept only authenticated calls from our systems;
• abuse checks (reCAPTCHA Enterprise / App Check) at sign-in and in the Portfolio x-ray, geographic filtering on sensitive functions, and usage and sending limits;
• an AI usage log per organization.

No system is infallible: we cannot guarantee the absolute security of information. You must also protect your passwords and devices and ask for access to be removed for people who should no longer have it.

If a security breach occurs that significantly affects your patrimonial or moral rights, we will inform you immediately so that you can defend your rights; when we act as processor, we will notify the responsible organization.

Vulnerability reports: if you find a possible vulnerability, write to contacto@castelotech.com with the subject “Seguridad” (security). Do not run tests that affect other users or their data.

17. Cookies, local storage and measurement

Castelo does not set its own cookies and does not use third-party analytics tools or advertising pixels.

We use your browser’s local storage (localStorage, sessionStorage and IndexedDB) for:

• your preferences (theme, language and layout);
• the campaign data you arrived with (utm parameters, fbclid and referring site), which we record to know where visits come from;
• a random session identifier for the Portfolio x-ray flow and data about processes in progress, such as a pending invitation;
• your message templates;
• keeping you signed in (Firebase Authentication);
• a local copy (cache) of your organization’s information used by the app.

In the Portfolio x-ray we record our own measurement events, with no personal data and a random session identifier, which are deleted after 7 days.

Google (Google Fonts and reCAPTCHA) and Stripe (at checkout) receive your IP address when they load and may use cookies or similar technologies under their own policies.

You can clear this data at any time from your browser settings; if you do, you will have to sign in again and choose your preferences.

18. Minors

Castelo is intended for adult insurance professionals. Minors’ data reaches Castelo only as part of the information an agency or agent manages (for example, dependent insured persons), under that agency’s or agent’s responsibility.

If you believe a minor has given us their data directly, write to contacto@castelotech.com so that we can delete it.

19. Changes to this policy

We will publish any change on this page with its update date and record it in the change history. When a change is significant, we may also show a notice within Castelo.

The “Last updated” date at the top of this page indicates the version in effect.

20. Contact

For any matter related to your personal data or this policy:

Controller

Castelo Tech S.A.P.I. de C.V.

Personal data requests (ARCO)

Castelo’s Personal Data Protection team

E-mail

contacto@castelotech.com

Product support: soporte@castelotech.com. Castelo’s WhatsApp line: +52 81 1009 0177.

See also the Terms of Service and the Data Deletion page. The Spanish version of this notice is the binding text: Aviso de Privacidad.

Change history

• October 22, 2026: Complete rewrite: controller and processor roles, a dedicated WhatsApp section, artificial intelligence (Lu), service providers and data locations, retention periods, ARCO rights with their legal deadlines, and a complete English version.
• September 15, 2026: Added the section on insurer portal credentials and the Portfolio x-ray (the update date was not changed at the time).
• April 12, 2026: First version.