Privacy policy

Last updated: October 24, 2026. The Spanish aviso de privacidad is the legally binding version in Mexico; this is a faithful translation.

1. Who we are

Ars Vigil is a service operated by Víctor Ángel Ruiz Espinoza, an individual with address at Felipe Ángeles 120, Col. Infonavit Playas, C.P. 82128, Mazatlán, Sinaloa, Mexico. Privacy contact: privacidad@arsvigil.com.

2. Who this applies to

You are…	Our role
A client: a business that uses or tries Ars Vigil.	Controller of your data.
Someone messaging a client business on WhatsApp (for example a patient or a buyer).	Processor, acting on behalf of that business, which is the controller and whose own privacy notice also applies.
A prospective business we contact to offer the service.	Controller of your data.

3. Data we process

Clients: name, business name, phone, email, billing details, and the business information you give us for the assistant (services, prices, hours, policies). If you connect Google Calendar, the data described in section 7.

People messaging a client business: WhatsApp number, the name they share, the conversation (text, voice notes, images), appointment details (service, date, time), and their email if they choose to give it to receive the invitation. The assistant does not ask for health information, but people writing to clinics may mention it themselves; it is used only to handle their request and pass it to the business.

Prospective businesses: contact details the business publishes, and, if we tested it, the result of the test (for example how long a message took to be answered).

4. Why we use it

Required: to provide the service (answer messages, book, move and cancel appointments, send reminders, alert the business when a person is needed), support, billing and legal obligations.

Optional: to send clients and prospects information about Ars Vigil. You can opt out at any time by replying "no" or writing to privacidad@arsvigil.com.

We do not sell personal data or use it for third-party advertising.

5. Who it is shared with

Provider	Purpose
Microsoft Azure (USA)	Servers that run the assistant and store conversations and appointments.
OpenCode, opencode.ai (outside Mexico)	AI model that reads each message and drafts the reply.
WhatsApp / Meta	Sending and receiving messages.
Google	Appointment calendar, if the business connects it.
Twilio (USA)	SMS, when the business uses that channel.
Cloudflare (USA)	This website and email forwarding.

The client business receives the conversations and appointments of its own customers. Otherwise we only disclose data to an authority that lawfully requires it.

6. Retention

• Conversations and appointments: up to 12 months after the last interaction, or 30 days after the business's contract ends, whichever comes first.
• Google Calendar access: deleted as soon as you disconnect it or the service ends.
• Billing records: as long as tax law requires.
• Prospects: up to 12 months, or immediately if you ask us not to contact you again.

7. Google user data (Google Calendar)

If a business connects its Google account, Ars Vigil requests a single scope: https://www.googleapis.com/auth/calendar.app.created, which lets it create a secondary calendar and manage only the calendars the app itself creates.

• Data accessed: the appointment calendar Ars Vigil creates in the account, its free/busy times, and the appointment events the assistant books (customer name, service, date, time, WhatsApp number, notes and invitee email). It cannot read or change any other calendar or event in the account.
• How it is used: to offer real open times to someone asking for an appointment, and to create, move or cancel that appointment and send them the invitation.
• Sharing: open times and appointment details pass through the AI model provider (section 5) while it drafts the reply in that conversation, and for nothing else. They are not shared with anyone else.
• Storage and protection: the access token is stored on the Ars Vigil server, which is reachable only by key-based access, and always travels encrypted (TLS). The appointments themselves live in the business's own Google Calendar.
• Deletion: the business can revoke access at myaccount.google.com/permissions or ask us to delete it; we delete the token and appointment records within 30 days. The created calendar stays in the account and the owner can delete it.

Ars Vigil's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Ars Vigil does not use Google user data for advertising, does not sell it, and does not use it to develop, improve or train generalized AI models.

8. Your rights

You can request access, correction, deletion or objection, withdraw consent or limit use by writing to privacidad@arsvigil.com. We answer within 20 business days. If we process your data for a client business, we forward your request to that business and help it comply. You may also go to Mexico's data protection authority (Secretaría Anticorrupción y Buen Gobierno).

9. Security

Encrypted connections (HTTPS/TLS), servers reachable only by key, and data access limited to the person who operates the service.

10. This website

No tracking cookies or analytics. Fonts load from Google Fonts, which receives your IP address when they load.

11. Changes

Any change is posted on this page with its date. Changes that affect active clients are also announced by email or WhatsApp.