Privacy Policy

1. Who We Are (Data Controller)

LIZZA TECH, S.A.P.I. de C.V. ("Lizza", "we", "us", or "our") is the data controller responsible for the personal information described in this Privacy Notice.

Legal name: LIZZA TECH, S.A.P.I. de C.V.

Tax ID (RFC): FME200403CF3

Registered address: Av. Ricardo Margáin Zozaya 444, Torre Sur Piso 8, Col. Valle del Campestre, 66265 San Pedro Garza García, Nuevo León, Mexico

Privacy contact: privacy@lizza.ai

This Privacy Notice describes how we collect, use, share, and protect personal information when you use our platform, website, applications, and related services (collectively, the "Service"). It is issued in compliance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and its regulations, and applies alongside any additional rights you may have under the law of your own jurisdiction.

For brand workspaces billed from outside Mexico, Lizza Technologies, Inc., a Delaware corporation, is also responsible for the billing and account data of that workspace.

By using the Service, you acknowledge the practices described in this notice. By accepting this notice on the platform, you also give your express consent to the processing of your financial and patrimonial data described in Section 2, where the law requires that consent.

2. Information We Collect

What we hold depends on who you are and which features you use.

Creators and affiliates: name, email, phone, date of birth, gender, shipping address, social handles, profile and media kit content, collaborations, messages with Lizza and brands (including WhatsApp), strikes, and connected-account data such as posts, reach and your audience's age, gender and country breakdown.

Brand users: name, email, phone, date of birth where provided, role, workspace activity and connected-account data.

Financial and patrimonial data: bank account and CLABE, RFC and tax regime, invoices (CFDI), payout and payment history, and card metadata (brand, last four digits, expiry and issuing country). Stripe holds full card details; we do not.

People who have not signed up: see Section 18.

Customers of a brand's store: see Section 7.

Sensitive data: we do not ask for health, religious, political or similar data. Voice samples and images of a person that a user uploads to optional AI tools can identify that person, and the user must have that person's express written consent. Our classifiers may infer an approximate age or gender from a public profile; we treat these as estimates.

Automatic data: usage logs, device and browser data, cookies, and session recordings (Section 11).

Other sources: social platforms you connect, public social media and websites, commercial data providers, brands and other users, and meeting notes from sales calls with brands.

3. How We Use Your Information

Purposes necessary for the Service and our legal relationship with you: (a) operate accounts, campaigns, collaborations, shipments, messaging and support; (b) process payments, payouts, tax documents and withholdings; (c) measure content and results, including what determines pay; (d) keep the platform secure, prevent fraud and enforce our Terms; (e) comply with legal obligations.

Additional purposes, which are not necessary for the Service and which you may refuse by writing to privacy@lizza.ai or as described in Section 12: (f) marketing Lizza to you; (g) finding creators and brands who are not yet users and inviting them to Lizza or to a campaign (Section 18); (h) scoring and ranking profiles for recommendations and discovery; (i) analytics and improving the Service, including training our own rules and classifiers.

If we want to use your information for a new purpose, we will update this notice and ask for your consent where the law requires it.

4. Information Sharing and Disclosure

We share information with: (a) other users as needed for the Service: brands see a creator's profile, audience data, work and shipping details, and creators see a brand's campaign and contact details. A brand that receives your data decides independently how it uses it, within what was agreed; (b) a brand's own marketing account (such as Klaviyo), only for affiliates who opted in with that brand; (c) the service providers in Section 5; (d) professional advisors; (e) companies of the Lizza group; (f) authorities when required by law or to protect our rights; and (g) in connection with a merger, acquisition, or sale of assets. Transfers needing your consent under the law are listed here so you can refuse them under Section 12. We do not sell your personal information.

5. Service Providers and Subprocessors

We rely on third-party providers to operate the Service. They process personal information on our behalf and are not authorized to use it for their own purposes. They fall into the following categories: cloud infrastructure, database, hosting and file storage; payment processing and payouts, including gift cards; invoicing and tax document validation; connections to brands' online stores and couriers; transactional email, WhatsApp and text messaging, including mailbox, calendar and messaging connectors; electronic signature; social media data collection, data enrichment and email verification; link tracking; address search; meeting notes; error monitoring and session replay; analytics; team alerts and ticketing; and artificial intelligence providers, including text, image and voice models. A current list of these providers is available on request at privacy@lizza.ai.

6. Public Profiles

Certain profile information may be publicly accessible, including creator media kits and brand profiles. Users control what they add to these pages. Information made public may be accessed, indexed, and used by third parties. Profiles we build from public sources for people who have not signed up are visible only to Lizza's team and, where a feature allows it, to brands using Lizza; see Section 18.

7. Connected Store Data

When a brand connects its online store (for example Shopify or Tienda Nube) to the Service, we access data from that store for two purposes.

Shipments: to create and track product shipments to creators, we use the recipient's name, email address, phone number and shipping address for the orders we create, together with the resulting order and fulfillment status.

Customer matching: when a brand uses customer features, we import the store's customers (name, email and contact details) and their recent orders and totals, so the brand can see which customers are creators on Lizza and understand what they bought.

For this data we act on the brand's instructions as a processor; the brand remains the controller and is responsible for it. We do not use it for Lizza's own marketing or advertising and we do not sell it. We delete or anonymize it once it is no longer needed: currently 180 days after a shipment reaches its final state and at most 365 days after we received it. We honor deletion requests submitted by the brand or forwarded by their e-commerce platform.

This is separate from a shipping address that a creator provides to us directly in order to receive a product, which we hold in our own right under this policy.

8. Data Security

We implement commercially reasonable technical and organizational measures to protect your personal information. However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your data, and you use the Service at your own risk.

9. Security Incident Notification

If a security incident affects your personal information in a way that could materially affect your rights, we will notify you without undue delay and in any case within 72 hours of becoming aware of it. That notice will describe what happened, the categories of information involved, the measures we have taken, and the steps you can take to protect yourself, and will include a contact point for questions. Where applicable law requires it, we will also notify the competent supervisory authority.

10. Data Retention

We keep personal information while your account is active and as long as needed for the purposes in this notice. Tax and accounting records, including invoices and payout records, are kept for the periods the law requires. Store data follows Section 7. Data about people who have not signed up follows Section 18. When retention is no longer necessary, we delete or anonymize the data.

Deactivating an account stops access and communications but does not erase its data, so that it can be restored and our records stay complete. To have your data deleted, use the cancellation right in Section 13.

11. Cookies and Tracking Technologies

We use cookies and similar technologies for sign-in, functionality and analytics (Google Analytics), and we store campaign attribution parameters in your browser for up to seven days. To find and fix faults, our error-monitoring provider records a sample of sessions and sessions in which an error occurs, with on-screen text masked. Emails we send may record opens and clicks. You can manage cookies through your browser settings or a browser add-on that blocks analytics, though disabling some may affect the Service.

12. Limiting the Use or Disclosure of Your Information

In addition to the rights described in the next section, you may at any time limit how we use or disclose your personal information. Specifically, you may:

(a) unsubscribe from marketing and non-essential communications, using the unsubscribe link in any such message or by writing to privacy@lizza.ai; (b) disable or restrict optional integrations, such as connected social accounts, from your account settings; (c) manage cookies and similar technologies through your browser settings; (d) ask us to stop using your information for a specific purpose that is not necessary to provide the Service, by writing to privacy@lizza.ai.

We will confirm receipt of any such request and act on it within the period stated in the next section. Limiting certain uses may reduce the functionality available to you, and we will tell you when that is the case.

13. Your Rights (ARCO Rights)

You have the right to Access, Rectify, Cancel (delete) and Object to the processing of your personal information — known collectively under Mexican law as your ARCO rights. You may also withdraw consent you previously gave, and request portability of your data where applicable law provides for it. These rights also apply if you have never signed up to Lizza.

To exercise any of these rights or withdraw consent, write to privacy@lizza.ai with: (a) your name and a contact address for our reply; (b) a document proving your identity, or that of your legal representative; (c) a clear description of the personal data concerned and the right you wish to exercise; and (d) any element that helps us locate the data, such as your social handles.

We will respond to your request within 20 business days of receiving it. If the request is granted, we will give effect to it within 15 business days of communicating our response. If we need further information to process your request, we will tell you within 5 business days.

There is no charge for exercising these rights, other than justified shipping or certification costs where you request copies in a particular format. Where we cannot grant a request in full — for example where we are required by law to retain fiscal records — we will explain why.

If you are dissatisfied with our response, you may bring the matter before the competent authority in Mexico, currently the Secretaría Anticorrupción y Buen Gobierno.

14. International Data Transfers

Lizza stores and processes personal information in the United States, where our cloud infrastructure provider operates. Additional service providers may process limited personal information in Mexico, the United States, Latin America and the European Union; the categories of these providers are described in Section 5 and a current named list is available on request at privacy@lizza.ai.

These transfers are made so that we can provide the Service to you, and are covered by contracts that impose confidentiality and security obligations on each provider equivalent to those in this notice. We do not sell your personal information, and we do not transfer it to third parties for their own independent purposes.

If you do not wish your personal information to be transferred as described in this section, you may object by writing to privacy@lizza.ai. Because our infrastructure is located outside Mexico, objecting to these transfers may mean we can no longer provide the Service to you, and we will explain the consequences before acting on your objection.

15. Children's Privacy

The Service is not intended for individuals under 18 years of age, and we do not knowingly accept them as users. Our discovery tools can pick up public accounts about or run for a minor. If we learn that we hold a minor's data, or a parent or guardian tells us, we will delete it promptly.

16. Changes to This Notice

We may update this Privacy Notice from time to time. We will notify you of material changes by posting the updated notice at this address with a revised "last updated" date, and, where the change is significant, by notifying you through the Service or by email to the address associated with your account. Your continued use of the Service after a change takes effect constitutes acceptance of the updated notice. Previous versions are available on request at privacy@lizza.ai.

17. Text Messages (SMS)

If you opt in to SMS notifications (Account → Preferences), we use your mobile number only to send the account notifications you agreed to: campaign invitations, deliverable reminders, shipments and payouts. We keep a record of your consent (date, time and number) and of any opt-out. You can opt out at any time by replying STOP or by unticking the box in Account → Preferences.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. The messaging provider that delivers our texts processes your number only to send them, on our behalf.

18. People Who Have Not Signed Up

If you have a public social media profile, or you work at a brand, we may hold information about you even though you have never used Lizza.

Creators and public profiles: we collect from public social media, directly or through data providers, your handle, name, bio, public contact details, location, follower counts, posts, comments, and accounts you follow or tag. Our systems estimate things such as your category, location, age range and gender, and whether you are a creator. We use this to find creators for campaigns, to give brands information about public profiles and to invite you to Lizza or a campaign by email.

Brand contacts: we collect business contact details from your company's website, commercial data providers and direct contact, and we keep the history of our sales conversations.

We give you this notice when we first contact you where the law requires it. You can stop our emails with the unsubscribe link in any of them; we keep your address on a suppression list so that we do not email you again. To have your profile deleted or object to this processing, write to privacy@lizza.ai (Section 13). We keep this data until you ask us to delete it or it is no longer useful for these purposes.

19. Automated Processing

We use rules and AI models to classify profiles, estimate who is a real creator, score and rank creators and brands, flag unusual results, suggest replies and generate content. Some of these results affect you: a profile judged not to be a creator is not invited to campaigns, a ranking affects who a brand sees first, and an abnormal result can be held until a person reviews it. Holding or rejecting an earning, and removing an account, are decided by a person. You may ask for an explanation, ask a person to review a result, or object, by writing to privacy@lizza.ai.

20. Contact

For privacy-related inquiries, to exercise your ARCO rights, or to request our current list of service providers, contact our privacy officer at privacy@lizza.ai.