sgatt.app Privacy Notice

Version 2.0 — Incorporates the external legal review of October 7, 2026. Planned effective date: [launch date].

This is a courtesy translation. The Spanish version (“Aviso de Privacidad Integral”) is the legally binding one and prevails in case of any discrepancy.

This Privacy Notice is issued in compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), published in the Official Gazette of the Federation on March 20, 2025, as amended (the “Law”), and its applicable regulations.

1. Data controller

The controller of your personal data is [FULL NAME AS SHOWN ON THE TAX REGISTRATION CERTIFICATE], an individual with business activity, who operates the sgatt.app platform under the trade name SGATT (“SGATT”, “we”, “us”), with address for notices at [FULL ADDRESS], Mexico City, Mexico, and email address support@sgatt.app. This same person handles requests regarding personal data and ARCO rights at that email address.

2. Personal data we process

We process the data you provide directly and the data generated by your use of the Service:

a) Account data: email address and password, stored using a hash function that does not allow the original password to be read.

b) Academic usage data: answers to questions, the confidence level and error causes you record, time per question and per section, simulation results and estimated scores, saved sessions, and flagged questions. If you voluntarily answer the follow-up form, we will also process the result and date of the official exam you report and your program of interest.

c) Feedback and testimonials: ratings and comments you submit about questions, sessions, or the simulated exam; if you authorize quotation, your first name and program of interest as you write them.

d) Purchase data: plan purchased, access start and end dates, amount, currency, and transaction identifiers assigned by Stripe. We do not receive or store your full card number or its security code; that data is captured directly by Stripe on its checkout screen.

e) Invoicing data (only if you request a CFDI): RFC, name or company name, tax postal code, tax regime, and CFDI use.

f) Technical data: IP address, browser and device type, access date and time, and technical error logs, generated automatically by our hosting and database providers.

g) Communications: the emails you send us at support@sgatt.app and our replies.

h) Data for handling requests about your rights: identity and, where applicable, representation, a description of the request, and the documents needed to support it. We will only ask for those that are relevant.

We do not deliberately collect sensitive personal data (such as ethnic origin, health status, religious beliefs, sexual orientation, or political opinions). Please do not include such data in your feedback or emails. The data in item (d) is of a financial or patrimonial nature. We process it to manage your purchase; the Law provides the consent exceptions necessary to perform the legal relationship and comply with legal obligations. Where express consent is required, we will collect it through a specific affirmative action before processing, as explained in section 12.

3. Purposes of processing

Primary purposes (necessary to provide the Service):

• Create and manage your account, authenticate you, and let you recover your password.

• Provide the Service: show you questions, save your progress, generate your session reports and estimated scores, and remember your preferences.

• Process your purchases, activate your access for the paid period, notify you when it is about to expire, and handle refunds.

• Issue the tax receipt (CFDI) when you request it and comply with our tax and accounting obligations.

• Handle your support requests, error reports, and the exercise of your rights.

• Detect and prevent unauthorized use of the Service, fraud, and violations of the Terms and Conditions.

• Maintain the security and technical operation of the platform.

Secondary purposes (not necessary to provide the Service):

• Improve the question bank and the Service’s features by analyzing accuracy rates, times, and feedback per question, with aggregated results and without identifying you. You may refuse the use of your personal data for this purpose. Once irreversibly de-identified, results that can no longer be associated with you cease to be personal data.

• Publish your feedback as a testimonial on sgatt.app, identified with your first name and program of interest. Only with your express consent, which you give through a separate, optional box, unchecked by default, on the feedback or follow-up form.

• Send you, once and after your access ends, an email asking whether you have already taken the GMAT and how it went, with a short form to learn your result and, if you wish, authorize us to quote it.

• Send you commercial communications about new SGATT products or features. Only with your express consent.

You may refuse purposes 8 and 10 on the sign-up form, through the corresponding options, and at any time by writing to support@sgatt.app. For purpose 8 we will exclude your personal data from future analyses; this does not allow the withdrawal of already de-identified results that cannot be associated with you. For purpose 10 we will not send you the email. Purposes 9 and 11 are carried out only if you expressly accept them separately, and you may withdraw your consent at any time. Refusing any secondary purpose does not affect the provision of the Service.

4. Processors and transfers

Processors and other recipients. We use infrastructure and invoicing providers. When they process data on our behalf and under our instructions they act as processors; those communications are remissions, not transfers. The legal role depends on the specific processing, not merely on the provider being in another country. Stripe also processes certain data as an independent controller to manage payments, prevent fraud, comply with legal obligations, and analyze and develop its services, in accordance with its privacy policy and its terms:

These providers may store or process data in the United States and, depending on the regions, services, and sub-processors involved, in other countries. For processing carried out on our behalf we must require obligations of confidentiality, security, processing under instructions, control of sub-processing, and return or deletion, except for legally required retention. SGATT retains its data-protection obligations even when it uses foreign providers.

Transfers. We do not sell your personal data or hand it over for third-party advertising. To manage your payment we communicate to Stripe Payments México, S. de R.L. de C.V., and to the Stripe entities involved in the transaction, including Stripe, LLC in the United States, the identification and purchase data that is necessary. In its role as independent controller, Stripe processes that data in accordance with https://stripe.com/privacy for the purposes indicated above. Transfers necessary to maintain or perform our legal relationship with you, for a contract in your interest, or to meet a legal requirement are carried out without consent in the cases provided by Article 36 of the Law. That exception does not automatically extend to all of a recipient’s own purposes: any processing or transfer that requires consent must have it and is not authorized by the mere reading of this Notice. We may also disclose data to competent authorities when they lawfully require it.

Consent for transfers. Reading or accepting this Notice does not authorize optional transfers. If we plan a transfer that is not covered by a legal exception, we will inform you beforehand of the recipient, the data, and the purpose, and we will obtain your consent before carrying it out, even if the purpose already appears in this Notice. No optional transfers are made on the basis of tacit consent through mere use of the Service.

5. Cookies and similar technologies

sgatt.app uses cookies and local storage that are necessary to keep you signed in and to remember your language preference and the state of your practice session. We do not incorporate advertising, cross-site tracking, or third-party analytics tools. You can delete or block these technologies in your browser settings, which may prevent sign-in or erase preferences. Stripe’s checkout screen may use its own technologies to process and protect the transaction, in accordance with its privacy and cookie information. If we incorporate additional technologies, we will inform you of the data they collect, their purposes, and how to disable them, and we will obtain any required consents before activating them.

6. Data retention

• Account and academic usage data: for as long as your account exists. When you close your account we will delete or anonymize it within a maximum of 30 calendar days, except for data we must keep under a legal obligation.

• Purchase and invoicing data: for the applicable legal periods. As a general rule, tax documentation is kept for five years from the filing or due date of the related tax returns, with the exceptions of Article 30 of the Federal Tax Code (Código Fiscal de la Federación). Records evidencing contracts and commercial obligations are kept for at least ten years under Article 49 of the Commercial Code (Código de Comercio). We keep only what is necessary for those obligations and the defense of rights, with restricted access; these periods do not require us to keep your entire study history and do not authorize advertising.

• Feedback and testimonials: for as long as they are necessary for the stated purposes and your account exists, or until you withdraw consent to publish the testimonial, whichever comes first. We will remove the publication without delay and within 15 business days at the latest. De-identified feedback that can no longer identify you may be kept to improve the question bank. Data subject to a legal retention obligation will be blocked and then deleted when appropriate.

• Technical data and logs: up to 90 days.

• Backups: up to 30 additional days after deletion.

7. ARCO rights and withdrawal of consent

You have the right to access your personal data, rectify it when it is inaccurate, cancel it where appropriate, and object to its processing in the cases provided by law (ARCO rights). You may also withdraw your consent without retroactive effect and limit the use or disclosure of your data. These rights do not override legal retention obligations and do not prevent processing covered by a legal exception to consent.

To exercise these rights, send an email to support@sgatt.app with the subject “ARCO rights” and include:

• your name, the email address of your account if you have one, and the address or channel through which you want to receive our reply;

• a clear description of the right you wish to exercise and of the data it refers to;

• for rectifications, the correction you request and the documents supporting it;

• anything that helps us locate your data.

You must prove your identity and, if you act through a representative, their identity and authority. We will provide secure verification through account authentication and, where necessary, relevant documents; we will not require excessive data. To send identification documents we will indicate a secure channel and the essential fields, allowing you to redact the rest. Supporting documents will be used exclusively to handle and substantiate the request and will be kept only for the legally necessary periods.

We will communicate our decision within a maximum of 20 business days from receipt of your request; if it is granted, we will give it effect within the following 15 business days. If essential elements are missing, we may request them once within the first 5 business days; you will have 10 business days to provide them, and the response period will begin the day after you do so. If you do not respond, the request will be deemed not filed, without preventing a new one. The 20- and 15-day periods may be extended once for an equal period when circumstances justify it, which we will notify you together with the reason. Access will be provided by electronic copy through the agreed channel. Exercising these rights is free of charge, except for legally applicable shipping or reproduction costs; we do not charge for sending an electronic copy.

If you consider your right to data protection to have been violated, or you disagree with our response, you may turn to the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Government) through the applicable procedure and within its legal deadlines. Institutional information and current channels: https://www.gob.mx/buengobierno.

8. Options to limit the use or disclosure of your data

In addition to the rights above, you can:

• leave the quotation-authorization box unchecked when you submit feedback, so that your feedback stays private;

• refuse, at sign-up, the question-bank improvement analyses with your personal data and the follow-up email after expiry, or write to support@sgatt.app at any time to change those options;

• unsubscribe from commercial communications through the link at the bottom of each message.

9. Security

We apply reasonable administrative, technical, and physical measures to protect your data: encryption in transit (HTTPS), passwords stored with hash functions, per-user access controls in the database, restricted service keys, cryptographic verification of payment notifications, and administrative access limited to the controller. No system is infallible; if a security breach occurs that significantly affects your rights, we will inform you without delay by email.

10. Minors

The Service is intended for people who are at least 18 years old. We do not deliberately collect data from minors and we do not admit accounts of minors through parental authorization. If we detect one, we will restrict access and handle its closure and the deletion or blocking of the data in accordance with the law, without deleting records we are legally required to keep and without affecting any refund rights that may apply.

11. Changes to this Notice

We may update this Notice to reflect legal or Service changes. The current version, with its date, will be published at sgatt.app/privacidad. We will inform you by email before applying substantial changes to the processing of data we already hold, and we will make the updated Notice available before collecting data for new processing. Where consent is required, we will obtain it before the new processing; a change to the Notice alone does not replace it.

12. Consent

Reading this Notice evidences that it was made available to you, without generally authorizing all processing. For the primary purposes we rely, where applicable, on the legal exceptions to consent relating to legal obligations and to our legal relationship. If a processing of financial or patrimonial data requires express consent, before continuing to payment you will indicate your decision through the specific authorization option, with a record of its date, version, and purpose. For secondary purposes 8 and 10 you may state your refusal at sign-up and afterwards; purposes 9 and 11 require separate, optional affirmative options, unchecked by default.

Last updated: [date].