Privacy notice

Last updated: October 16, 2026 · Version 1.6

Español · English · Português · Français · Deutsch · Italiano

This is a translation of the original in Spanish. If the two versions differ, the Spanish one prevails, except where the law of your country says otherwise.

Under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation on March 20, 2025 (the "LFPDPPP"), and its Regulations.

1. Who is responsible for your data

Gloria Inés Higuera Ley, a sole proprietor (persona física con actividad empresarial) operating under the trade name Figalo ("TresDos", "Figalo" or "we"), with Mexican tax ID (RFC) HILG890729AE4 and address in Cajeme, Sonora, Mexico, is the controller of your personal data.

• Email: hola@tresdos.app
• Site: tresdos.app
• Address for notices: Cajeme, Sonora, Mexico
• Support hours: Monday to Friday, 9:00 to 15:00 (Sonora time, UTC-7)

2. The service and our two roles

TresDos is a platform to plan, organize and measure a content production made as a team (podcast, video podcast, channel, course and more), available at tresdos.app, studio.tresdos.app and, when they exist, in apps for iOS and Android.

• We are the controller of the data of people who have a TresDos account.
• We are a processor of third-party data that a production records inside the platform (for example guests, brands, suppliers and media in Contacts, external collaborators or people listed in Accounts and access). For that data, the production that records it is the controller and TresDos handles it only following its instructions, under article 49 of the LFPDPPP.

3. Data we handle

3.1 Identification and contact

Name, what people call you, email and, if you sign in with Google, the name and profile photo of that account.

3.2 Your account and access

Your TresDos password (stored encrypted, we never see it), the ways you sign in, access dates, open sessions, email changes and the productions you belong to with your role. When you change your password or email, delete your account or it is paused, we close the sessions open on your other devices.

3.2.1 Lock with PIN, fingerprint or face

If you turn on the app lock on a device, your fingerprint or face is recognized by your own device: your biometrics live only there, according to its settings. TresDos does not receive or store your fingerprint, your face or any biometric data; it only stores on that device a technical identifier to ask it to confirm it's you. If you use a PIN, it is stored encrypted only on your device and never reaches our servers.

3.3 Content of your productions

Ideas, comments, episodes, outlines, tasks, polls and their votes, schedule and availability, locations and photos, inventory, budget entries and receipts, audience metrics, links to files, brand identity, the production's profile, contacts with their follow-up, and the list of the production's accounts with who has access. In Accounts and access passwords are not stored; the platform rejects them.

In anonymous polls nobody on the team, not even whoever launched the poll, can see what each person voted; only how many votes each option has and who hasn't voted yet.

3.3.1 Connected sources and notifications

If you connect your production's RSS feed, your YouTube channel or Buzzsprout in Audiences, we store the link or the public identifier and, when the service requires it (like Buzzsprout's token), that token. Tokens are stored on the server side, separate from everything else: nobody on the team, not even from the app, can see them. We use them only to read your numbers once a day or when you hit Refresh, and we delete them if you remove the connection. We also store your notification preferences and the notices we send you inside the app.

3.3.2 If you connect your YouTube channel to publish

In the Social calendar you can connect your YouTube channel so TresDos uploads your videos at the time you schedule. TresDos uses the YouTube API Services. By connecting it you accept the YouTube Terms of Service, and Google handles your data according to its Privacy Policy.

We ask for two permissions: upload videos to your channel and see the channel's basic data. We store the channel's name, identifier and image, and the access permission Google gives us (a token). The token is stored on the server side, separate from everything else: nobody on the team, not even from the app, can see it. We use it only to upload the videos you scheduled, with the title, description, hashtags and privacy you chose in each post. We don't read your other videos, comments or messages, we don't share this data with anyone else and we don't use it for advertising or to train AI models.

You can disconnect the channel whenever you want from the Social calendar: when you do, we ask Google to revoke the permission and we delete the token and the channel's data. You can also remove the permission directly on the security page of your Google account. TresDos's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3.3.3 If you connect Instagram, Facebook or Threads

In the Social calendar, the Showcase and Audiences you can connect your Instagram professional account, your Facebook page or your Threads profile, through Meta's APIs. By connecting it you accept Meta's Terms, and Meta handles your data according to its Privacy Policy.

We ask only for the permissions each feature uses: publish what you schedule, read your posts and their insights (views, reach, likes, comments, saves, shares and followers gained), your account's insights (followers and where your audience is from, in aggregate and without data about individual people) and the comments on your posts, so you can read them, reply, hide them or like them from TresDos. We store the account's name, identifier and image, those figures, and the access permission Meta gives us (a token). The token lives on the server side, separate from everything else: nobody on the team, not even from the app, can see it. We don't sell or share this data, we don't use it for advertising, and only your team sees it inside your production.

You can disconnect the account whenever you want from the Social calendar: we delete the token and stop reading. You can also remove the permission in your Instagram or Facebook account settings, under "Apps and websites".

3.3.4 If you connect TikTok

You can connect your TikTok account through TikTok's APIs (Login Kit, Content Posting API and Display API). By connecting it you accept the TikTok Terms of Service. We ask for permission to see your basic profile, read your videos and their public figures (plays, likes, comments and shares) and upload the videos you schedule. We store the account's name, identifier and image, those figures and the token, on the server side. You can disconnect it from the Social calendar or remove the permission in TikTok, under "Settings and privacy", "Security", "Apps and services".

3.3.5 If you connect X

You can connect your X account through its API. By connecting it you accept the X Terms of Service. We ask for permission to read your profile and your posts with their figures, and to publish what you schedule. We store the account's name, identifier and image, those figures and the token, on the server side. You can disconnect it from the Social calendar or remove the permission in X, under "Settings", "Security and account access", "Apps and sessions".

3.3.6 How to ask us to delete your social media data

When you disconnect an account in the Social calendar we delete its token immediately. If you also want us to delete the posts and figures TresDos stored from that account, delete them from the Showcase or write to us at hola@tresdos.app from your account's email with the subject "Delete social data": we do it within 30 days at most and confirm by email. If you delete your TresDos account, everything is deleted.

3.3.7 If you write to us from tresdos.app

If you use the contact form or the price calculator: your name, your email, the reason, your message and, if applicable, the quote you put together. We use them only to reply and follow up on what you asked us.

3.4 Technical usage

IP address, browser or device type, operating system and technical logs needed for the security and operation of the service.

3.5 Payments

If you take a paid plan: name or business name, tax ID, tax address and tax regime for invoicing, and the status of your subscription. Your card details are processed directly by our PCI-DSS certified payment provider; we do not store full card numbers.

3.6 Sensitive data

TresDos does not ask you for sensitive personal data. If you decide to write it in your notes or content, you are responsible for having the express consent of the person it belongs to.

4. What we use your data for

4.1 Necessary purposes

Without these we can't provide the service:

• Create and manage your account and your productions.
• Let you sign in with email and password, a code or Google, send you sign-in emails and confirm email changes.
• Record who owns each production and carry out requested handovers.
• Show your content to you and to the people you give access, according to the roles you set up.
• Generate the artificial intelligence suggestions you ask for.
• Process payments, issue invoices and manage your subscription.
• Give you support and tell you about changes, outages or legal matters of the service.
• Protect the security of the service, prevent fraud and comply with legal obligations.

4.2 Non-necessary purposes

• Send you TresDos news and tips for your production.
• Invite you to surveys or interviews to improve the product.
• Produce aggregated and anonymous usage statistics.

If you don't want us to use your data for these purposes, write to hola@tresdos.app with the subject "OBJECTION TO SECONDARY PURPOSES". It does not affect your service.

5. Artificial intelligence

TresDos uses artificial intelligence models running on Cloudflare Workers AI to suggest outlines, titles, topic arrangement, audience reading and set layout from a photo. Only what is needed for the suggestion you ask for at that moment is sent (for example the topic, your podcast's description or the photo of the location).

• Suggestions are not automated decisions that affect you: you decide whether to use them.
• We do not use your data or your content to train models, ours or anyone else's.
• You have the right to ask for a simple explanation of how they work and to object to their use by writing to hola@tresdos.app.

6. Your rights

You can access your data, rectify it, cancel it or object to its processing (known in Mexico as ARCO rights), as well as withdraw your consent and object to automated decisions. If you live in the European Union or the United Kingdom, you also have the rights to erasure, restriction and data portability, and to lodge a complaint with your local data protection authority. A lot of this you can do yourself from the app: correct your details and your email in My account, leave a production and delete your account in My account, Delete account. For everything else, send an email to hola@tresdos.app with:

• Your name and an email to reply to.
• An official ID or, if you act on someone's behalf, the document that proves it.
• A clear description of the data and the right you want to exercise.
• If you ask for a correction, what needs to change and, where applicable, the document that supports it.

We acknowledge receipt within 3 business days, reply within 20 business days at most and, if it applies, carry it out within the following 15 business days. These periods may be extended once for an equal period when justified. Exercising your rights is free.

7. Who we share data with

We do not sell or rent your data. For TresDos to work, we share it with these providers, which handle it on our behalf with confidentiality and security obligations:

Some of these providers are outside Mexico, mainly in the United States or the European Union. We make sure they have protection standards equal to or higher than those of the LFPDPPP. These communications are necessary to provide the service and do not require your additional consent under article 36 of the LFPDPPP. We will tell you about any other transfer and, where applicable, ask for your consent.

When you connect services such as Google Drive, YouTube, Buzzsprout or your production's RSS feed, TresDos only reads what is needed to show it to you, and on YouTube it only uploads what you scheduled; those services handle your data according to their own notices.

8. How long we keep your data

• As long as your account is active.
• When you delete your account or a production from the app: it is deleted immediately, including the files you uploaded to that production. Our provider's backups are purged in their normal cycle.
• When you cancel a plan without deleting your account: your information is kept as long as the account exists.
• Tax records of payments: at least 5 years, as required by Mexico's Federal Tax Code.
• Technical and security logs: up to 2 years.

9. How we protect your data

• Encryption in transit (HTTPS) on all connections and encryption at rest of the database.
• Passwords stored with one-way hashing algorithms and strong password rules.
• Written confirmation for anything that can't be undone, such as deleting an account or a production.
• Optional app lock with PIN, fingerprint or face on each device.
• Permissions by production and by role checked in the database itself: nobody sees a production they don't belong to.
• Private files that only open with temporary links.
• Automatic backups by our database provider.

No system is invulnerable. If an incident happens that significantly affects your rights, we will let you know without delay, as the LFPDPPP requires.

10. Consent

By creating your account and not objecting after reading this notice, you consent to the processing of your data on the terms described here, under article 7 of the LFPDPPP.

11. Cookies and storage in your browser

TresDos only uses necessary technical storage: keeping you signed in, the lock settings for that device and preferences such as the last production you opened or night or day mode. We don't use advertising cookies.

On the public page tresdos.app we use Google Analytics to know how many people visit it, where they come from and which sections interest them. It only turns on if you accept it in the cookie notice; if not, it doesn't load. Google receives browsing data such as pages viewed, device type and approximate country, never your name or email. You can change your choice whenever you want from the Cookies link at the bottom of the page. Inside the platform (studio.tresdos.app) and on each production's site we don't use Google Analytics.

12. Minors

TresDos is for adults. If a minor takes part in your production and you record their data, you need the consent of their parent or legal guardian.

13. Changes to this notice

We will publish any change at tresdos.app/en/privacy with its date. If the change is significant, we will let you know by email at least 15 calendar days in advance.

14. Authority

Since March 21, 2025, the authority for personal data held by private parties in Mexico is the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance). If you believe your right to data protection was violated, you can go to it, or to the data protection authority of your country. We ask that you first write to us at hola@tresdos.app so we can try to resolve it.

15. Contact

• Email: hola@tresdos.app
• Address: Cajeme, Sonora, Mexico
• Hours: Monday to Friday, 9:00 to 15:00 (Sonora time, UTC-7)

October 16, 2026 · Version 1.6