Casa al Día privacy policy

Version 0.1.0 (draft). Last updated October 14, 2026.

This policy is the English version of our aviso de privacidad integral, issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties, published in the Diario Oficial de la Federación on March 20, 2025 (the "Law"). If the two versions differ, the Spanish version governs.

1. Who is responsible for your data

Third Space Ventures LLC ("TSV", "we", "us"), a Wyoming limited liability company that operates the Casa al Día app at casa-al-dia.com, of 447 Broadway FL 2 STE 3065, New York, NY 10013, USA, is the controller (responsable) of the personal data described in this policy.

Our privacy team acts as our personal data department for any question or request. Write to hola@casa-al-dia.com.

2. Who this policy covers

This policy covers:

• people who create a Casa al Día account, buy a plan or use the app ("you"), including co-owners and advisors (property managers and contadores) invited to a household;
• people who visit casa-al-dia.com, use our free calculators or write to us.

Household workers. We are not the controller of the household workers' data that users enter in Casa al Día: we process it as a processor (persona encargada) on behalf of each employer, who is the controller. Section 10 explains what that means and how workers can exercise their rights.

3. What personal data we process

3.1 Identity and contact data: name, email, mobile number (only if you turn on WhatsApp reminders), language and time zone.

3.2 Household and property data: household name, state and municipality, tax residency (resident in Mexico or abroad), RFC (if you give it) and, for each rental property: its name or nickname, state and municipality, the platforms it's listed on, whether you gave those platforms your RFC, local registry folio numbers and its insurance expiry date.

3.3 Employer data for the employment contract: when you produce a household worker's contract, your full name as it appears on your ID, nationality, type and number of official ID, CURP and RFC (if you have them), address, email and the address of the workplace.

3.4 Financial and patrimonial data: the vacation-rental income you record or upload (platform payouts, ISR and IVA withheld, tax receipts, bank deposits and direct bookings), where you receive those payouts (an account in Mexico or abroad), the amounts on IMSS and SAT payment slips, and your plan and payments to us. Card numbers are collected and stored directly by Stripe; we never see them.

3.5 Data for "Done for you": when you buy the IMSS registration service, the authorization you sign and the data and documents the registration requires from you as the employer: your official ID, your address, and your CURP and RFC, if you have them.

3.6 Documents: the documents you upload to your vault: tax receipts, platform payout reports, local registry documents, IMSS and SAT receipts, and anything else you choose to keep.

3.7 Technical and usage data: IP address, browser and device type, pages visited in the app, date and time of access, and security logs showing who viewed or changed a protected field, and when.

3.8 Communications: the messages you send us by email or WhatsApp, and the email you give a free calculator to receive your result.

3.9 Data about other people you give us: the name and email of the people you invite to your household. The invitation they receive links to this policy.

3.10 Sensitive data. We do not ask for sensitive personal data (data that can reveal racial or ethnic origin, health, genetic information, religious, philosophical or moral beliefs, political opinions or sexual preference), and we ask you not to type it into notes fields or put it in the documents you upload.

4. What we use your data for

4.1 Necessary purposes. We process the data in sections 3.1 to 3.9 to:

• a) create and manage your account and let you sign in with a code we email you;
• b) provide the service: calculate estimates, produce documents (including the employment contract), show your deadline calendar and send reminders by email and, if you turn it on, WhatsApp;
• c) charge for plans and services through Stripe, issue receipts and handle cancellations and refunds;
• d) provide "Done for you" (our team registers a household worker with IMSS) and "Concierge" (our team generates the IMSS payment slips), including submitting to IMSS, in your name and with your signed authorization, the data the procedure needs;
• e) answer support requests and requests to exercise your rights;
• f) keep the app secure, prevent fraud and unauthorized access, log who views protected data and diagnose errors;
• g) meet our legal obligations and respond to requests from competent authorities;
• h) email a free calculator's result to anyone who asks for it.

For users, these purposes are necessary for our relationship with you, so under article 9, section IV, of the Law they don't require your consent. For people who only visit the site or use the calculators, processing of their technical data and, where given, their email rests on their tacit consent once this policy is available to them.

4.2 Express consent for financial and patrimonial data. The Law requires express consent to process financial or patrimonial data, except in the cases in its articles 9 and 36. Although we consider that the data in section 3.4 is processed to fulfil our relationship with you, we ask for your express consent when you create your account, with a checkbox that is not pre-ticked.

4.3 Optional purposes (marketing). Unless you object, we also use your name and email for marketing and commercial outreach:

• a) to send you Casa al Día news, guides and notices about new rules that are not part of the service you bought;
• b) to ask for your feedback on the service.

You can say no before we use your data for these purposes, by ticking the box on the sign-up form, and at any time afterwards, through the unsubscribe link in every such email or by writing to hola@casa-al-dia.com. Saying no doesn't affect the service. Deadline reminders, billing notices and security alerts are not marketing; they are part of the service.

4.4 Automated decisions. We don't sell personal data, use it for third-party advertising, or make decisions about people solely by automated processing. The app's estimates are calculations you review and decide whether to use.

5. How we get your data

We get your data directly from you when you enter or upload it or write to us; automatically when you use the app (section 6); from Stripe, which tells us the status of payments; and from people who invite others to a household.

6. Cookies and other technologies

Casa al Día uses only the cookies needed to keep you signed in, protect your account and remember your language. We don't use advertising cookies or third-party tracking cookies. If you block them in your browser, you won't be able to sign in. In addition, when you use the site, our hosting provider automatically records the technical data in section 3.7 (IP address, browser, pages visited, date and time) to run and protect the service. Stripe's checkout page, on Stripe's own domain, uses its own cookies to process payments and prevent fraud.

7. Who we share data with

7.1 Providers who process data for us (processors). We use the following providers, who process data only to provide their services to us under their data processing agreements, which include confidentiality and security obligations:

7.2 Transfers that don't require consent. We disclose data without your consent only in these cases under article 36 of the Law:

• a) to Stripe, Inc., which also processes payment data as a controller in its own right, to prevent fraud and meet its legal obligations under its own privacy policy, because this is necessary for the payment-processing contract made in your interest (section IV);
• b) to IMSS, when you buy "Done for you" or "Concierge" and authorize it, because it is necessary for our relationship with you (section VII);
• c) to competent authorities that require it under the law, or when necessary to establish, exercise or defend a right in court (sections I, V and VI).

7.3 Transfers that require consent. We'll share your contact details with an independent contador or labor lawyer only if you ask for a referral in the app. When you do, the app asks for your consent to that transfer, and you can say no.

7.4 Household members. Co-owners and advisors you invite to your household can see that household's data, according to the access you give them.

8. International transfers and remisiones

TSV is a US company, and the app and its providers store and process data in the United States (and, for Meta, other countries too). Our email service is provided by Fastmail Pty Ltd, an Australian company subject to Australian law, which stores it on servers in the United States and, under its data processing agreement, may process it in other countries where reasonably necessary for its service. Data protection laws there may differ from Mexico's. We contract with providers who commit, in their data processing agreements, to keep data confidential and secure.

9. How we protect data

We apply administrative, technical and physical security measures, including:

• encrypted connections and database encryption by our providers;
• additional encryption, inside the app, of CURP, NSS and RFC (AES-256-GCM), which are shown masked; every time anyone decrypts one, we log who did it, when and which field they viewed;
• separation of each household's data, so one account can't see another's;
• access by our team only when the service requires it, through internal tools that log every view;
• diagnostics tools set up to discard IP addresses and minimize personal data.

We never ask for SAT passwords, your CIEC or e.firma files.

If a security breach significantly affects the patrimonial or moral rights of people whose data we control, we'll tell them immediately by email so they can take steps to protect their rights. Breaches affecting household workers' data are reported as described in section 10.

10. Household workers' data

10.1 When an employer enters a household worker's data in Casa al Día, the employer is the controller of that data. That data is: name, CURP, NSS, RFC (if any), date of birth, sex, nationality, civil status, address, mobile number, email, official ID and proof of address (for "Done for you"), role and duties, schedule, wages and payment method, pay stubs, vacation, aguinaldo, IMSS status and payment slips, the contract and its signed copy, and their beneficiaries' data. We process it only on the employer's behalf, to produce the contract and pay stubs, calculate benefits and, if the employer buys "Done for you" or "Concierge", handle the IMSS paperwork in the employer's name. We don't use that data for our own purposes.

10.2 Household workers have no account and never sign in to Casa al Día. They receive their contract and pay stubs by WhatsApp or, failing that, by email or on paper.

10.3 WhatsApp messages are sent only after the employer confirms in the app that the worker agreed to receive them, and the app records the date of that confirmation. The first message asks the worker whether they agree. To stop them, the worker can tap "No, gracias", reply ALTO or BAJA, or ask the employer.

10.4 The worker's CURP, NSS and RFC are stored encrypted and shown masked, and every view is logged.

10.5 To exercise their rights of access, rectification, cancellation or objection over that data, a worker contacts their employer. If they write to hola@casa-al-dia.com, we pass the request on to the employer and help the employer answer it.

11. How long we keep data

• Account, household and property data, and documents: while your account is open, including the read-only period in section 19.3 of the Terms. After the account closes, you have 30 calendar days to download your documents and data; we then delete them within the following 60 calendar days, and backups are erased in their normal 7-calendar-day cycle.
• Payment and billing records: 5 years, or longer if the tax and accounting laws that apply to TSV require it.
• Security logs (who viewed what, and when): up to 2 years after the account closes.
• Support emails and rights requests: up to 2 years after we handle them.
• Our hosting provider's technical logs: the short period the provider sets, at most 30 calendar days.
• Blocked data: when data must be kept only to deal with possible liabilities, we block it (stop using it) for the applicable limitation period and then delete it.

12. Your ARCO rights and how to use them

12.1 You, or your representative, can ask at any time for:

• Access: to know what data we hold about you and how we process it.
• Rectification: to correct data that is inaccurate, incomplete or out of date.
• Cancellation: to have your data deleted, after any applicable blocking period.
• Objection: to have us stop processing it for a legitimate reason, or when automated processing has unwanted legal effects on you.

You can view, correct and download much of your data directly in the app.

12.2 Send your request to hola@casa-al-dia.com, including:

• a) your name and an email or other way to receive our answer;
• b) a document proving your identity and, if a representative acts for you, also their identity and the document proving their authority (a public instrument, or a power of attorney letter signed before two witnesses);
• c) a clear description of the data concerned (not needed for access);
• d) the right you're exercising or what you're asking for; and
• e) anything else that helps us find the data.

For rectification, also tell us the corrections and include documents that support them.

12.3 We answer within 20 business days of receiving your request and, if it is granted, carry it out within 15 business days of our answer. Each deadline can be extended once by the same period if the circumstances justify it. We provide your data as an electronic file.

12.4 Exercising these rights is free. We may only charge reproduction or shipping costs, and not even those if you provide the means to reproduce the data.

12.5 We may refuse a request in whole or in part in the cases in articles 25 and 33 of the Law, for example if identity isn't proven or if a legal provision requires us to keep the data. We'll always explain why and tell you that you can go to the Secretaría Anticorrupción y Buen Gobierno (section 16).

13. How to withdraw consent

You can withdraw any consent you've given at any time, without retroactive effect, through the same channel and with the same requirements as in section 12. We'll answer within the same deadlines. If you withdraw your consent to processing your financial and patrimonial data (section 4.2), we'll stop processing it, which means you can't use the rentals features or be charged for plans, so you may need to close your account. Withdrawal doesn't apply where a legal provision requires us to keep or process the data.

You can turn off your own WhatsApp reminders at any time in the app's settings or by replying STOP or ALTO.

14. How to limit use or disclosure of your data

You can:

• refuse marketing when you sign up, and unsubscribe from marketing emails with the link in each one;
• turn off WhatsApp reminders in the app's settings;
• remove access for people you invited to your household;
• ask hola@casa-al-dia.com to put your email or mobile number on the Casa al Día Exclusion List, so you get no optional communications. We'll send you a certificate of registration, free of charge.

15. Changes to this policy

We'll publish any change to this policy at casa-al-dia.com/privacy (and the Spanish version at casa-al-dia.com/aviso-de-privacidad), with its update date. If the change is significant (for example, new purposes or new transfers that need consent), we'll also tell you by email and in the app before it takes effect and, where the law requires, ask for your consent again.

16. Authority

If you believe your right to personal data protection has been violated, you can go to Mexico's Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), which enforces the Law. If you're not satisfied with our answer to an ARCO request, you can file a data protection request with the Ministry within 15 business days of receiving our answer; if you get no answer, you can file it once the deadline for answering has passed.

17. Acceptance

By creating an account, you confirm you have read this policy. Your express consent for financial and patrimonial data (section 4.2) is collected with a separate checkbox, and your refusal of marketing (section 4.3) with another.