Privacy Policy

Last updated: March 6, 2026

Kasumi is a company incorporated under the laws of Mexico. The legally binding version of this Privacy Policy is the Spanish version (Aviso de Privacidad). This English translation is provided for informational purposes only. In the event of any discrepancy between versions, the Spanish version shall prevail.

In compliance with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) and its regulations, Kasumi ("Kasumi", "we", or "the Data Controller") provides this Privacy Policy to inform data subjects about the treatment of their personal data.

1. Identity and Domicile of the Data Controller

Kasumi, domiciled in Querétaro, Mexico, is responsible for the treatment of personal data provided to us, which will be protected in accordance with the LFPDPPP and other applicable regulations.

2. Personal Data We Collect

2.1 Identification Data

  • Full name
  • Company name or legal entity name
  • Email address
  • Phone number
  • Country and city
  • Business type or industry

2.2 Billing Data

  • Legal/fiscal name
  • Fiscal address
  • Tax ID (RFC in Mexico)
  • Tax regime

2.3 Financial Data

  • Payment method (securely processed by our payment provider)
  • Payment and billing history

2.4 Technical Data

  • IP address
  • Browser type and operating system
  • General location data (country/region)
  • Platform usage data (pages visited, features used, session duration)

2.5 WhatsApp Business Data

  • Connected WhatsApp Business number(s)
  • Conversations and messages processed through the Platform
  • Client's contact data managed on the Platform

Note: Kasumi does not directly collect sensitive personal data (racial or ethnic origin, health status, religious beliefs, political opinions, sexual preference). However, Content processed by the Client through the Platform may contain sensitive data from their own customers — the Client is responsible for the treatment of such data.

3. Purposes of Data Processing

3.1 Primary Purposes

  • Create and manage user accounts
  • Verify the identity of the data subject
  • Provide, maintain, and improve Platform services
  • Process WhatsApp conversations and messages on behalf of the Client
  • Generate analytics, reports, and business metrics
  • Process payments and billing
  • Send technical notices, updates, and support messages
  • Handle support requests and customer service
  • Comply with legal and fiscal obligations

3.2 Secondary Purposes

The following purposes are not required for service delivery but improve the user experience. Data subjects may opt out as described in the ARCO Rights section:

  • Send marketing communications, promotions, and service updates
  • Conduct satisfaction surveys
  • Compile usage statistics and analysis for service improvement
  • Personalize the user experience on the Platform

4. Minors and Legally Incapacitated Persons

The Platform is intended exclusively for individuals 18 years or older with legal capacity to contract. Kasumi does not intentionally collect personal data from minors. If we become aware that data from a minor has been collected without parental or guardian consent, we will delete such information.

5. Tracking Technologies

Kasumi uses cookies, web beacons, and similar technologies to collect technical and usage data:

  • Essential cookies: Required for Platform operation (authentication, session preferences)
  • Analytics cookies: Help us understand how users interact with the Platform to improve functionality

Users may configure their browser to reject or delete cookies. However, this may affect certain Platform functionalities.

6. Transfer of Personal Data

Kasumi may transfer personal data to the following third parties without requiring the data subject's consent, as provided under the LFPDPPP:

  • Meta Platforms, Inc.: For WhatsApp Business API integration (necessary for service delivery)
  • Cloud infrastructure providers: For data storage and processing necessary for service operation
  • Payment processors: For subscription billing and transaction processing
  • Competent authorities: When required by legal mandate, court order, or competent authority request

Kasumi does not sell, trade, or rent users' personal data to third parties for purposes beyond those described in this Policy.

7. Third-Party Personal Data Stored in the CRM

The Client uses the Platform to manage personal data of their own customers and contacts (WhatsApp messages, contact information, conversation history, etc.). Regarding this data:

  • The Client is the Data Controller for such data under the LFPDPPP and must have the appropriate consent from their end customers.
  • Kasumi acts as Data Processor, processing this data exclusively for service delivery and according to the Client's instructions.
  • Kasumi does not use data stored in the Client's CRM for its own purposes, marketing, profiling, or aggregate analysis.
  • Kasumi does not access the content of the Client's conversations except when strictly necessary for technical support and with the Client's authorization.

8. Data Access During Support

During technical support assistance, Kasumi support staff may access Client account data in a limited and temporary manner, exclusively to resolve the reported issue. This access is carried out under strict confidentiality and security controls.

9. ARCO Rights

Under the LFPDPPP, data subjects have the right to:

  • Access: Know what personal data we hold and the conditions of its treatment
  • Rectification: Request correction of inaccurate or incomplete personal data
  • Cancellation: Request deletion of personal data when it is not being treated in accordance with the LFPDPPP
  • Opposition: Object to the processing of personal data for specific purposes, including secondary purposes

To exercise any of these rights, send a request to support@kasumi.cx with:

  • Full name of the data subject
  • Email address associated with the account
  • Clear description of the right being exercised
  • Copy of valid official identification

Kasumi will respond within a maximum of 20 business days from the date of receipt. If the request is approved, it will be fulfilled within 15 business days following the response.

Consent Revocation

At any time, the data subject may revoke the consent granted for the processing of their personal data, so that Kasumi ceases to use such data. To do so, a request must be sent to support@kasumi.cx. Consent revocation may result in the inability to continue providing the contracted services. Obligations arising from processing prior to the revocation shall remain in effect in accordance with applicable law.

10. Security Measures

Kasumi implements administrative, technical, and physical security measures to protect personal data, including:

  • Data encryption in transit (TLS/SSL) and at rest
  • Role-based access controls
  • Continuous security monitoring
  • Periodic security audits
  • Staff training on data protection

11. Scope and Application

This Privacy Policy applies to all personal data collected by Kasumi through its website (kasumi.cx), the Platform (app.kasumi.cx), registration forms, email communications, and any other available contact channel.

12. Modifications to this Privacy Policy

Kasumi reserves the right to modify this Privacy Policy at any time. Modifications will be published on our website and, in case of substantial changes, the data subject will be notified via email. Data subjects are advised to review this Policy periodically.

13. Personal Data Department

For any questions, inquiries, or requests related to the treatment of your personal data: