Privacy notice

1. Data controller and scope

Lansana S.A. de C.V. (“Lansana”), with its address at Montecito 38, 5th floor, office 39, Nápoles neighborhood, Benito Juárez borough, postal code 03810, Mexico City, Mexico, is the controller responsible for processing data submitted through this site. This notice covers commercial requests, initial assessments, the virtual assistant when available, and the protection of these services.

2. Data we process

Our forms may collect your name, company, email, phone number, service of interest, project description and location, and supported campaign tags included in a link to the contact page. The chat processes the messages you choose to send and the history of that conversation. The connection’s IP address and other technical data needed to provide and protect the site are also processed.

3. Purposes

We use the information to respond to commercial requests, assess needs, prepare proposals, follow up on requests and handle privacy requests. The chat is optional and requires authorization to send information to OpenAI. Technical data and usage records help prevent abuse, limit queries and control service consumption. We do not sell personal data.

4. Forms and CRM

Commercial and privacy requests submitted through the forms are recorded in Lansana’s private CRM, with access limited to authorized personnel. Talking to the assistant does not save the chat in the CRM or create a contact request. To request assistance from the team, you must complete and submit the relevant form.

5. Virtual assistant and OpenAI

Using the chat is optional. Before sending a message, you must authorize processing by OpenAI. Each query includes your message and the previous messages in the open conversation to maintain context. Do not share passwords, keys, sensitive data or confidential information belonging to your company or third parties.

The integration does not request that responses be stored as a persistent history in OpenAI. This does not mean zero retention: OpenAI may retain messages and responses in security logs for up to 30 days by default, subject to the exceptions in its policies. Read its data and retention controls. Automated responses may contain errors and must be verified before making decisions.

6. Query protection and control

Chat quota controls use an identifier derived from the IP address using a server key. The separate database stores this identifier, dates, consumption reservations and query status; it does not store chat text or the IP address in plain text. This identifier can link queries from the same connection and does not provide anonymity.

Quota records older than 35 days are deleted as new queries are processed. If there is no activity, cleanup runs when the next query is received. Closing or clearing the conversation does not reset quotas or delete these records.

7. Service providers

Cloudflare hosts and protects the site, processing the technical data needed for those services. OpenAI processes the content sent to the assistant to generate responses. Providing these services may involve processing outside your country. You can read Cloudflare’s privacy policy and OpenAI’s data controls linked above.

8. Retention and security

We retain form and commercial relationship data for as long as needed to handle that relationship and comply with applicable obligations. We apply access controls, protected sessions and reasonable measures to prevent unauthorized use.

The visible chat history remains in memory during the conversation and is cleared when it is closed or when you select “Clear conversation”. This does not withdraw messages already sent to the provider or delete usage or security records maintained by the service and its providers.

9. Rights and contact

You may exercise your rights of access, rectification, cancellation and objection (ARCO), withdraw consent or request limits on the use or disclosure of your data through the privacy contact form. Lansana’s commercial manager will handle the request.

Provide your name, an email for a response, your request and information that helps locate the record. For rectification, describe the requested change. Identity or authority to act will be verified before data is provided or modified; do not send identification documents or passwords through the chat.

For ARCO requests, a determination will be communicated within twenty business days of receipt and, if appropriate, implemented within the following fifteen business days. The law allows these periods to be extended once for an equal period when justified. Withdrawing consent has no retroactive effect and does not remove legal retention obligations.

Language preference and drafts

When you choose a language, we store that preference in a functional cookie for one year. When you change language, a form draft may be stored temporarily in this same tab, valid for five minutes, and is deleted when restored. The draft does not include consent, chat messages or CRM data. Changing language does not submit the form or accept the notice on your behalf.

10. Updates

We may update this notice when our processes or applicable requirements change. The published version will be available on this page with its update date.