Privacy notice
Controller
Soluciones en Domótica e Informática Administrativa (RFC SEDE091117K91), trading as Domotics, Av. Santa Fe 505, Cruz Manca, Mexico City, Mexico, is the controller of the personal data collected through Arrmma. Privacy requests are handled by the Arrmma Privacy Area — support@arrmma.com.
What is implemented
Application hosting: Vercel. Accounts and database: Neon (managed PostgreSQL; USA). Files: Vercel Blob (downloadable packages and demos in private storage, delivered through short-lived signed links after checking your access; catalogue images and videos in public storage). Transactional and account email: Resend (sender notificaciones.arrmma.com). Email campaigns to subscribers who consented: EmailOctopus (with an unsubscribe link in every message). Support mailbox support@arrmma.com: Hostinger. Payments: Stripe (live charges; card details are processed by Stripe and never reach Arrmma). First-party cookies: "lang" and "arrmma_lang" (language), authentication session cookies and, with analytics on, "arrmma_pv" (a random 30-minute browsing-session id) and "arrmma_vid" (a random 13-month visitor id); none of them contains your name or email. First-party visit measurement with your acceptance (never when your browser sends Do Not Track or Global Privacy Control): for each page view it stores the path without parameters, language, referring site, campaign, device type, the random session and visitor ids, the approximate country indicated by the hosting provider from the connection and, if you are signed in, your account. It does not store the IP address or use fingerprinting. Under the same rule we measure which design cards are seen (at least half visible for one second), clicks, opening the offer and the buy, Pro and sign-up buttons, and keep for 30 days in the "arrmma_attr" cookie (signed, no personal data) the first and last design you interacted with and the arrival campaign, to know which design led to a sign-up or a purchase; that context is linked to your account when you sign up, sign in or pay and, while you are signed in, each new arrival campaign is added to your account history. This analytics is optional. Outside Europe it is on from your first visit unless your browser sends GPC/DNT, and you can turn it off at any time with Reject optional in "Privacy and cookies" (always in the site footer and in "My account"). In Europe, or if we cannot determine your country, it stays off until you accept it; without it those cookies are not created, the origin of a sign-up or purchase is recorded as "unknown" and signing up, paying or downloading work the same. Details in the cookie policy. We do not use fingerprinting or link devices by other means: only if you sign in with analytics on are the visits from each device associated with your account. Account activity log on our servers (e.g. prompt copied, download authorised, confirmed payments) to provide the service, for security and statistics; prompt text and card data are never stored. Outside Europe and without GPC/DNT, Arrmma measures page loads from the first visit with a random session and visitor (no IP or fingerprint): public path without parameters, language, referring site, campaign, device type and approximate country. These views store no IP address, fingerprint or country. This count cannot identify unique people or attribute their purchases; rejection stops it. Outside Europe and without GPC/DNT, Google Analytics 4 measures pages and catalogue interactions with its analytics cookies from the first visit; advertising storage remains denied. No account identifiers are sent; confirmed purchases are sent with their transaction number, amount and currency, without personal data. You can stop this measurement with Reject optional in Privacy and cookies in the footer; a saved rejection is respected. In Europe or if the country is unknown, Google waits for acceptance. With analytics on (outside Europe from the first visit; in Europe, if you accept it), Google Analytics 4 (by Google) is also loaded through Google Tag Manager: it receives the visited page without sensitive parameters, the referrer, the device and browser type and the events described in the cookie policy (for example viewing a design, signing up or purchasing, with amount, currency and a transaction identifier that does not identify you). We do not send it your email, name, phone, account identifier or prompt text, and Google Signals, personalised advertising and user-provided data are turned off. In Arrmma's property Google keeps event data for 2 months and user data for 14 months, and may process it on servers outside Mexico. No advertising tools.
Data and purposes
To provide the service we store: your email and the credentials managed by the authentication provider; your favorites; your single purchases and your subscription status synced from Stripe (identifiers, status, plan, currency and dates); and a record of each payment authorization and each acceptance of the terms at payment, with the applicable terms version, the date and the payment session reference. Arrmma does not store card numbers in its database. The providers that process data on Arrmma’s behalf are those listed under “What is implemented”.
Optional sign-up data
When creating your account you may optionally provide your name, phone (stored in international E.164 format), country and the profile that describes you best. None is required and leaving them empty never blocks sign-up, purchases or account recovery. Purpose: understanding who Arrmma serves to prioritise resources and, only if you separately agree, sending you updates. They are not sold or shared with third parties for commercial purposes. You can request correction or deletion at any time.
Interactive demos and trial credits
Interactive demos are served by Arrmma only to accounts with access to that design (active Pro, its single purchase or, for a free design, a confirmed account) and show a “private demo” mark with no personal data; we record each demo opening and denied attempts. Trial credits granted by an administrator are recorded with their reason, expiry and unlocked resources; they are not purchases and involve no charges.
Optional communications
You can ask for Arrmma updates from the form in the site footer or when creating your account, with a separate checkbox that is never pre-ticked. We store your email and the consent text you accepted. Every marketing email includes an unsubscribe link. Declining does not prevent you from using the service.
Community: job openings, experts and affiliates
If you apply for a role we process your name, email, country, time zone, experience, optional professional link, availability, answers to the role’s questions, any interview accessibility adjustments you request and your CV (PDF), only to assess that application; you need an account. Your CV is stored privately (Vercel Blob), only the team reviewing the role opens it through temporary links, and it is never sent to analytics or AI services. We do not ask for or infer sensitive data from your CV, and there are no automated decisions. If you apply as an expert or affiliate, or write to an expert, we process the data stated in each form’s notice; we share your request with an expert only if you expressly allow it. Periods: applications, inquiries and rejected requests, up to 24 months after they close; active profiles and participation, while they last. When a period ends, deletion is currently done by the team (it is not automatic); abandoned CV uploads are deleted automatically by the daily clean-up once 24 hours have passed. You can ask for earlier deletion of your application and CV. Full conditions and notices: arrmma.com/legal/comunidad.
Affiliate links and codes
If you follow an approved affiliate’s link (arrmma.com/r/…) while their program is active, our server records the click: affiliate code, campaign, landing page, date, whether you had accepted analytics, whether there was already an earlier referral and whether it was your first observed visit (based on which Arrmma first-party cookies your browser already had), plus the visit to the landing page. To avoid counting the same click twice it also stores an irreversible daily digest computed with a secret key from the date, the IP address and the browser; the IP is not stored and the digest changes every day. This click record is made even if you have not chosen yet or have rejected analytics. The "arrmma_ref" cookie (30 days) is only set with analytics accepted and without Global Privacy Control; if you have not chosen yet, the referral travels in the landing page address as a 15-minute signed token and only becomes a cookie if you accept; with rejection or GPC/DNT neither the cookie nor the token is created. If you are signed in when you follow the link or accept, if you sign up or pay while that referral is valid, or if you type a referral code at checkout, the referral is linked to your account to decide whether your payments earn the affiliate a commission. A referral code is not a discount and does not change your price. These records currently have no automatic deletion period; you can ask for their deletion at support@arrmma.com. Program conditions: arrmma.com/afiliados/condiciones.
Choices and rights
Contact support@arrmma.com to exercise the privacy rights that apply to you. Cancelling renewal does not automatically delete billing records that must be kept, and asking to delete your account must not leave a subscription charging.
Retention
We keep the necessary data during the relationship and for the applicable legal, tax, security or defence periods; afterwards it is deleted, irreversibly anonymized or blocked as appropriate. Periods: account data while the account is active (on deletion, data no longer needed is removed); ordinary support requests, 24 months from closure; ordinary technical security logs, up to 90 days; usage events without an account, 180 days, and linked to an account, 24 months; optional attribution, 30 days in the "arrmma_attr" cookie and, once linked to a sign-up or a purchase, 24 months from that moment; purchases, invoicing, contractual acceptance and claims, for the applicable legal periods and with restricted access. An open incident or claim may justify limited additional retention. Backups have a separate cycle, with restricted access and measures not to reactivate deleted data when restoring: a daily copy of the database in private storage (Vercel Blob), with passwords encrypted, kept for 14 days, plus the database provider’s (Neon) restore history. In Google Analytics 4 event data is kept for 2 months and user data for 14 months. Universal instant deletion is not promised.
Cookies and similar technologies
Necessary and optional cookies (analytics and, if added, advertising), their duration and how to accept, reject or withdraw them without an account are described in the cookie policy (arrmma.com/legal/cookies). Outside Europe, analytics cookies are on from the first visit until you reject them; in Europe, or when your country is unknown, they stay off until you accept them. Advertising is never turned on without your acceptance.
Changes
Material changes will be communicated before they apply. You may contact the competent data protection authority in your jurisdiction. If you live in a jurisdiction that grants you additional privacy rights, you may exercise them through the same channel and we will handle them in accordance with that law. This notice is issued under the Mexican Federal Law on the Protection of Personal Data Held by Private Parties.