Privacy Notice

Tecnologías Amber de México S. de R.L de C.V. (hereinafter "TAM") firmly believes in privacy and the protection of personal data; therefore, in compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and its regulations, it makes this Privacy Notice (Aviso de Privacidad) available to you for the purpose of informing the visitors of our websites, customers, residents, private security companies and their operational personnel, job candidates, employees, former employees and suppliers (hereinafter "users") about the handling of the information they share with us, its collection, purpose, processing, the measures we adopt to protect their privacy, as well as the rights of Access, Rectification, Cancellation and Opposition (hereinafter "ARCO").

When we refer to TAM, we, our or ours, we mean Tecnologías Amber de México S. de R.L de C.V. This Privacy Notice applies to all of our services, including, by way of illustration but not limitation (de manera enunciativa mas no limitativa), the products and platforms marketed under the brands AmberAccess, Ambermex Seguridad, AURA, Comunidades Amber, Amber Viajero (travel coverage in Mexico) and any other product or functionality that TAM develops or makes available in the future, as well as the websites, interfaces, software and mobile apps associated with said services.

Purpose for which personal data are collected

Any personal information collected will be used solely for the purpose indicated in this Privacy Notice.

The obtaining, use, disclosure or storage, as well as the access, handling, exploitation, transfer or disposal (hereinafter the "Processing" (Tratamiento)) that we carry out of the personal data of users has the following as its main purposes:

1. Identification, contact and reference.
2. Fulfilling the obligations undertaken with our customers, residents, private security companies and suppliers, such as: account verification, identity verification, account registration, telephone support services, connection with other users, processing of payments and purchase orders, delivery of products, provision of access control and security services, generation of tax receipts (comprobantes fiscales), notifications related to our products and, in general, the provision of our services.
3. Improving our services and fixing failures. We analyze and use data to research and develop new features, additional services or to solve problems.
4. Investigation of suspicious activities and, where applicable, violations of the terms and conditions.
5. Fulfilling the obligations undertaken with our employees, such as: account registration in our database, payment of payroll or payment of fees, internal personnel control, emergency response, and other similar matters.
6. Marketing, sending of promotions, advertising materials, satisfaction surveys, newsletters, communications, invitations to events and to respond to requests for information.
7. Provision of security services, including the coordination of emergency response, the recording of the voice group of the emergency to document the event, the verification of security guard rounds and the management of real-time alerts.
8. Operation of the community administration module (AmberAdmin), including the management of fees, payments, budgets, account statements, reconciliation and financial reports, as well as the processing of tax data (RFC (Federal Taxpayer Registry, Registro Federal de Contribuyentes) and information for the issuance of receipts) and payment data of residents and suppliers when the community enables said module. In these cases, TAM processes these data on behalf of the community and in accordance with its instructions.
9. Enabling communication between users through the individual, group and community chats of the application, including the delivery of notifications of new messages.
10. Nearby businesses and classified ads («Cerca de ti» ("Near you")). Showing the user the businesses and the classified ads published within a radius around the point that the user chooses —their current location or the address they have registered—, allowing them to request a conversation with a business and, when the business accepts it, opening the chat between both. The user decides in each case what information they share with the business, in accordance with the section "Information that is shared".
11. Verifying the age of majority for the classified ads of «Cerca de ti». Using the date of birth that the user themself declares to confirm that they have reached 18 years of age before they publish, edit or renew a classified ad, or before they write first to whoever published one. The same date is used for the vecino vigilante ("neighborhood watcher") function, which is also for persons of legal age. TAM keeps the date, not an identity document.
12. Travel coverage (Amber Viajero). Attending to the emergency alerts of the persons included in a purchase of travel coverage in Mexico during its term; storing, at the request of the traveler themself, a copy of their travel documents so that they can consult it or share it if they lose them; recording the itinerary that the traveler enters (lodgings, flights and road transfers) so that the monitoring center knows where they are staying if they ask for help; and asking them at key moments of their trip whether everything is going well, in accordance with the sections "Collection of personal data" and "Location data".
13. Complying with applicable legislation.

Collection of personal data

Users voluntarily provide their personal data when they contact us through our websites, contract a service, by sending documents, requesting tax receipts, when they access our interfaces, software and the mobile application or applications associated with our services.

In accordance with the foregoing, the personal data that we collect directly, depending on each case, may be any or all of the following:

a) Profile name, full name, telephone number, date of birth, address, email, occupation or profession, marital status, education, professional experience, employment history, bank account number to receive deposits, information relating to payment methods, RFC, information necessary for the issuance of tax receipts, data related to consumption activities in relation to our products and services, and other similar data.

b) The personal data that are provided, including sensitive information such as health status and employment history, as well as financial information such as the RFC and bank account number to receive deposits, are confidential, and are not disseminated, distributed or marketed.

Now, the personal data that we collect automatically, depending on each case, may be any or all of the following:

a) Information about the mobile device when the user uses a service, including hardware model, operating system information, information about the browser, the IP address and mobile network information, the telephone number and the device identifiers.

b) Information that is collected automatically related to performance, diagnostics and service. This information may be data about how the user interacts with the system or service, reports, performance logs, about the user's connection, the mobile network, the location of the device and the location of the user.

c) Information that the user's browser sends when our service is used, which may include the type and version of the browser, the pages visited by the user, the time and date of the visit, the time spent on said pages and other types of statistics.

d) Information that other persons provide about the user when they use our services or external providers that help us operate, provide our services or in specific circumstances, such as Google Analytics, to collect, monitor and analyze information for the purpose of increasing the functionality of the service, or such as when the user decides to use third-party services that are connected to our system. It is important to mention that when the user uses third-party services, their own privacy policy or notice will govern the use of said services.

e) Audio captured by the microphone of the device during an emergency activated from the application, under the terms of the section "Audio recording in emergencies" of this Notice.

Alias and profile photo. The user may choose an alias and upload a profile photo; both are visible to the users with whom they converse. The alias is stored together with the account and may be changed or removed at any time from the application.

Device contacts. To start a conversation or invite someone, the application may request access to the contacts of the device. That access is used solely so that the user can choose a contact; the name of the contact is kept only on the user's device and only the telephone number of the chosen contact is sent to TAM, for the purpose of verifying whether it corresponds to a registered user and, if so, opening the conversation. TAM does not copy or store the user's address book.

Messages. The content of the messages (text and images), the date and time of sending and the members of each conversation are kept for 90 days and are then deleted automatically. Messages reported by a user are kept while the report is being handled. Messages are used exclusively to deliver them to their recipients, display the conversation and send the new message notification; TAM does not read them or analyze them for other purposes.

Publication of a business or a classified ad. When the user publishes a business or a classified ad in «Cerca de ti», they provide the name under which they want to appear, the category, the description, the photographs, the business hours and the location they choose to show —the approximate area or the exact address—. That information is published within the application and, in the case of businesses, on the public page of the business, and is visible to any person who uses the application near that location. The user may edit, pause or remove it at any time from the application.

Date of birth for classified ads. The first time the user publishes a classified ad of «Cerca de ti» or writes first to whoever published one, the application asks them for their date of birth, if TAM does not already have it. The user provides it only once and declares that it is true; it remains stored in their account and is not shared with businesses or with other users. It is kept while the account is active. To correct it, the user may exercise their right of rectification in accordance with the section "ARCO rights".

Rating of a conversation with a business. When a business of «Cerca de ti» ends a conversation, the user may rate it from 1 to 5 stars, once per request and within the following seven days. TAM keeps the rating associated with the user's account and with that request, for the sole purpose of calculating the average and the total of ratings of the business, displaying the aggregate seal described in the section "Information that is shared" and reviewing reports of improper ratings. The rating is kept while the business is published in «Cerca de ti» and up to twelve months after its listing is removed, and is then deleted. The user may exercise their ARCO rights over their ratings in accordance with the section "ARCO rights".

Purchase of a travel coverage. Whoever purchases a travel coverage provides their name, email, telephone number and billing address, as well as the name and the telephone number of each person who travels with the coverage. The card payment is processed directly by the payment processor (Stripe); TAM does not receive or store the complete card data. Whoever registers other travelers declares that they have their consent to do so.

Travel documents. The traveler may store in the application a copy of their travel documents —passport, visa or immigration form, driver's license, insurance policy, reservations or others— as a photograph or PDF. The traveler themself stores them, voluntarily, to consult them or share them if they lose them. Each document is visible only to whoever stored it: the application opens it with the phone's lock (face, fingerprint or passcode) and TAM does not show it to the monitoring center, to other members of the purchase or to any other user. TAM does not read or analyze its content. The files are stored encrypted at rest, in a repository exclusive to this function, and each time the traveler stores, opens or deletes a document a record is kept with the date, time and IP address, which the traveler themself can consult. The documents are kept while the traveler's account exists, also after their coverage ends; the traveler may delete them at any time from the application and they are deleted, together with their access log, when they delete their account.

Travel itinerary. The persons included in a travel coverage may enter their itinerary: name and address of each lodging with its arrival and departure dates, flight number, date, origin, destination and times of their flights, and means, line, date, origin, destination and times of their road transfers. The itinerary belongs to the purchase: all the persons included in it see it and can edit it. It is kept while the account of whoever entered it exists; any of them may delete it from the application, and what was entered by a person is deleted when that person deletes their account.

Emergency contacts of the traveler. The traveler may register emergency contacts with their name and telephone number. Whoever registers them declares that they have their consent. These contacts receive the notices described in the sections "Location data" and "Information that is shared".

Location data

Our mobile applications may collect precise and approximate location data from the user's device, with their prior consent, for the following purposes:

• Emergency response: When a user activates an emergency alert or panic button, the location of the device is shared with the designated emergency contacts and, where applicable, with the assigned security personnel, to facilitate a timely response.
• Viaja acompañado ("Travel accompanied"): When the user voluntarily starts a trip through this function, the location of their device is collected continuously, even while the application runs in the background, and is shared with the persons registered as residents of their same address, for the purpose of allowing them to accompany their journey. The collection ends when the user confirms their arrival, cancels the trip or the system closes it automatically due to lack of confirmation or because the maximum planned duration has been reached. The user may end the trip at any time from the application.
• Security operational personnel: When a person uses the application in their capacity as a guard or security operational personnel, the location of their device is collected continuously, even while the application runs in the background, during the time in which their operational session is active. This purpose allows the supervision of surveillance rounds, the coordination of the operation in the field and the verification of presence at the assigned points and times.
• Verification of the travel itinerary: At key moments of the itinerary that the traveler entered —the night of their arrival at each lodging, a few hours after the arrival of each flight or transfer, when several days of travel pass without any other moment, and at the end of their coverage— the application asks them whether everything is going well. Upon confirming, the application takes a single reading of the location of the device, with the «mientras se usa la aplicación» ("while using the app") location permission, and compares it with the city of that day's lodging and, after a flight or transfer, also with the destination airport or city entered by the traveler, within an approximate radius of 50 kilometers. It is a single reading per question: there is no continuous tracking nor tracking in the background. If the traveler does not grant the permission, their confirmation counts all the same. If they do not answer, a reminder is sent to them and, after 24 hours without a response, their emergency contacts are notified and, in the 90-day plan, also the monitoring center, which may call them.
• Access management: In certain access control services, location may be used to verify the user's proximity to the access point.
• Nearby businesses and classified ads: When the user opens the «Cerca de ti» section of the application, the location of the device is used to calculate which businesses and classified ads are within the radius that the user chooses. This collection occurs only while the user has that section of the application open, does not continue when the application runs in the background, and no location history is kept for this purpose: each query is resolved at that moment and the queried point is discarded. The user may use this section without providing their location; in that case the search is performed around the address they have registered or the neighborhood (colonia) that they indicate.

Except for the location of security operational personnel and that of the trips that the user themself starts through the «Viaja acompañado» function, both described in the preceding points, the collection of location is carried out only while the user actively uses the functions that require it. The user may revoke the location permission at any time from the settings of their device, which may limit the functionality of certain features of the service; in the case of security operational personnel, revoking said permission may prevent the performance of their duties through the Platform. In the case of the «Cerca de ti» section, revoking the permission keeps the section available: the search is performed around the user's registered address or the neighborhood that they indicate.

Location data is shared only with:

• The residential community or security company contracting the service, as applicable.
• In the case of security operational personnel, the persons designated by the private security company or the contracting community with supervision, monitoring or administration functions —among others, supervisors, monitoring center operators, administrators, the holder of the contracting account and the board of directors (mesa directiva) of the community—, who may consult said location both in real time and historically.
• In the case of the «Viaja acompañado» function, the persons registered as residents of the same address as the user who starts the trip, who may consult their route while the trip is active and see the record of that trip in their history.
• The emergency contacts designated by the user, in the event of activation of an alert.
• In the case of the verification of the travel itinerary, the persons included in the same coverage purchase, who see in the verification log whether the question was answered and whether the answer came from another city. The location reading is not sent to the emergency contacts or to the monitoring center; if the traveler does not answer, these receive only the notice that the traveler has not confirmed their trip, with the name of the lodging that they registered.
• The competent authorities, when required by law or by court order.

The location that the user provides to consult nearby businesses and classified ads is processed on the servers of TAM for the sole purpose of calculating which listings are within the chosen radius. That location is not shared with businesses or with other users, nor is it used for any other purpose. When the user requests a conversation with a business, the business receives the approximate distance and the community or neighborhood of the user, in accordance with the section "Information that is shared".

In the case of the «Viaja acompañado» function, the detailed points of the route are kept for a maximum of 48 hours, after which they are deleted and only a summary of the trip is kept —simplified route, start time, end time and the way in which it concluded— as part of the history that the user themself can consult in the application. If during a trip the user activates an emergency alert or panic button, the associated route is kept together with the record of that emergency, in accordance with the periods applicable to said records.

In the case of the verification of the travel itinerary, the location reading, the calculated distance and the response of the traveler are kept together with the record of the coverage, as a log that the traveler themself can consult in the application. The traveler may request its cancellation in accordance with the section "ARCO rights".

The collection of the location of security operational personnel is an operational functionality determined by the private security company or the contracting community, in its capacity as employer of or party responsible for said personnel. It is incumbent upon the latter to inform its personnel about this processing and to obtain the consent that is applicable in accordance with labor and personal data protection legislation. TAM acts as technology provider and processor (encargado del tratamiento), on behalf of and according to the instructions of the contracting party.

Audio recording in emergencies

Our mobile applications include a voice group associated with each emergency. When a user activates an emergency alert or panic button from the application, the device that activated it automatically joins that voice group with the microphone open and the communication begins to be recorded, even when no other person has joined yet. The purpose is twofold: to allow immediate communication with whoever responds to the emergency and to keep an audio record of the event that may serve as evidence.

This automatic recording operates only when the emergency is activated from the application on the device itself. Emergencies activated by other means —messaging, telephone call or physical button— do not activate the user's microphone, and the persons who respond to an emergency join the voice group by their own decision.

While the recording is in progress, the user sees on screen a permanent notice that the voice group is being recorded, both within the screen of the emergency and in an indicator that remains visible even if they close that screen.

Scope, duration and control of the user:

• The recording captures the audio of the surroundings of the device, so it may include the voices of the persons present during the emergency.
• Each recording has a maximum duration of two hours and ends earlier if the user hangs up or if the emergency is ended.
• The user may end the recording at any time by hanging up from the on-screen indicator, without needing to end the emergency.
• The user may revoke the microphone permission at any time from the settings of their device, which will prevent this function from operating.

The recordings are stored encrypted at rest on infrastructure controlled by TAM and are kept for a period of 210 days, after which they are deleted automatically. The record of the communication —date, time, duration and participants— forms part of the log of the service and is kept in accordance with the retention periods applicable to it.

Emergency recordings are shared only with:

• The residential community or security company contracting the service, as applicable, and the persons designated by it with supervision, monitoring or administration functions, who may consult and play them from the panel of the service.
• The competent authorities, when required by law or by court order, as well as when the user themself requests their delivery for the complaint (denuncia) or investigation of the event.

The processing of the audio of the user who activates the emergency is carried out with their consent, granted upon accepting this Privacy Notice, upon granting the microphone permission to the application and upon using the function. In the case of third parties whose voice may be recorded during an emergency, the processing is based on the case provided for in article 10, section IV (fracción IV), of the Federal Law on the Protection of Personal Data Held by Private Parties, relating to emergency situations that could potentially harm an individual in their person or in their property.

The availability of the recordings to the contracting community or security company is a functionality of the service contracted by it. It is incumbent upon the contracting party to determine which persons of its organization have access to them and to use them exclusively for the handling, documentation and follow-up of the incident. TAM acts as technology provider and processor, on behalf of and according to the instructions of the contracting party.

The user may request access to a recording in which their voice has been recorded, or its cancellation, through the procedure described in the ARCO Rights section of this Notice, unless the retention is necessary for compliance with a legal obligation or for the handling of a proceeding before a competent authority.

Information that is shared

The user shares information while using the services and communicating with other users. TAM does not exchange, sell or distribute personal information of users except when it is required by law, a competent authority or through a court order.

When we share information with the external providers with which we work, we require them to use the user's information in accordance with the applicable legislation on the protection of personal data. However, when the user provides information directly to a third party so that it provides them a service, it is important to bear in mind that its own terms and privacy policies will govern.

In turn, we allow the user and third parties to exchange information, such as notifications and updates.

When using the chats, the user shares their alias, their profile photo (if they uploaded it) and the content of their messages with the persons of the conversation or of the group. TAM does not show the user's telephone number to other users, and their address is shared only when the user themself decides to send it from the conversation. When the user invites an unregistered person, the invitation includes their full name so that the invitee recognizes them; the user may send it from their own messaging application or ask TAM to send it by message to the number they indicate. In that case TAM keeps the telephone number of the invitee, the date and the result of the sending only in order not to repeat invitations, apply a limit per number and respect the request of the invitee not to receive more messages; that data is not used for any other purpose and is deleted when the person registers or after ninety days. When checking whether a telephone number belongs to a registered user, the application only reports whether or not an associated account exists, without revealing any other data.

Businesses of «Cerca de ti». When the user requests a conversation with a business published in «Cerca de ti», TAM communicates to that business the first name of the user, the community or neighborhood in which they are located and the approximate distance at which they are, for the purpose of the business deciding whether it accepts the conversation. If it accepts it, the business additionally sees the profile photo of the user, when the user has uploaded it, and the content of the messages that the user sends to it. The user's address is shared only when the user themself sends it from the conversation, and their telephone number is not shared in any case. Before the first conversation with each business, the application informs the user what data are going to be shared and obtains their consent. The businesses that contract a subscription with TAM are bound by contract to use that information solely to attend to the user's request and to process it in accordance with the Federal Law on the Protection of Personal Data Held by Private Parties.

Ratings. The rating that the user gives to a conversation is private. The business sees only the average and the total of the ratings it received, without knowing the individual rating or who gave it; TAM sees each rating associated with its request in order to operate the service and handle reports. The public is shown only, on the listing of the business, the aggregate seal «Bien calificado por N vecinos» ("Well rated by N neighbors"), and only when the business gathers at least five ratings with an average of 4.0 or more. No individual rating is published or shared with other users.

The trade name, the category, the hours, the contact telephone number and the location —approximate area or exact address, as the business itself chooses— of the businesses published in «Cerca de ti» are public information within the application and on the public page of each business.

Travel coverages. When a person included in a travel coverage activates an emergency alert, the monitoring center sees their name, their telephone number, the term of their coverage, their location in accordance with the section "Location data" and their itinerary: the lodging of that day or the next, their next flight and their road transfer of that day or the next. The monitoring center never sees the travel documents. The emergency contacts of the traveler receive the notices of their alerts and, where applicable, the notice that they have not confirmed their trip and the notice that they have already confirmed it. The monitoring center may be operated by a provider that acts as processor (encargado) of TAM and processes the information solely to attend to the alerts.

The user, by providing information, accepts the transfer or remittance (transferencia o remisión) of personal data for the purposes described in this Privacy Notice.

Community administration module (AmberAdmin)

When a community enables the administration module, the community determines the purposes and the means of the processing of the data of its residents and suppliers (including tax data, bank data, fees, payments and debt status). In that case, the community is the controller (responsable) of the processing and TAM acts as processor (encargado), processing said data on behalf of and according to the instructions of the community. It is incumbent upon the community to have the applicable legal basis and to inform the data subjects (titulares).

TAM does not issue tax receipts (CFDI, Comprobante Fiscal Digital por Internet, the Mexican digital tax receipt) on behalf of the community for its fees or services; the invoicing of the fees of the community is the responsibility of the community, with its own RFC and its own certification provider. TAM only invoices its own services.

To operate these functions, TAM relies on external providers that act as sub-processors (sub-encargados), such as the payment processor (for card charges) and the authorized certification provider (PAC (proveedor autorizado de certificación), for the invoicing of the services of TAM), who process the information in accordance with their own policies and the applicable legislation.

Accounting and tax data may be kept for the period required by the applicable legislation, even after the cancellation of the service, to the extent necessary to comply with legal obligations.

Information and use of cookies

TAM uses cookies and similar technologies to operate and provide services. The cookies that are sent from the user's browser are used to collect information necessary to improve our services, including to understand which of the frequently asked questions of the help service are most popular and to display relevant content, remember choices, such as language preferences, and, thus, personalize our services for the user.

Information management

In some of our services that are provided through mobile applications, the user has tools at their disposal to manage certain information available to other users. In the application the user can: block another user (who can no longer write to them and disappears from their chat list), mute the notifications of a conversation, leave a group, report a message or a conversation for its review, and change or remove their alias and their profile photo. The administrators of a community do not have access to the individual conversations or to the groups created by the users.

Legal matters and security measures

This site, and all the information that the user sends through any of our systems, is collected, stored and processed in the United States within the databases controlled by TAM. We limit access to your personal information to our employees and to service providers who need to use it to provide this application and our products or services. Among them are, as processors (encargados del tratamiento), the cloud services of Google (Google Cloud and Firebase) for the hosting of the information and the sending of notifications, Stripe for the processing of card payments and Twilio for the sending of messages; some of them process the information in the United States of America.

TAM may collect, use, retain and disclose any information about the user or their use of any of our systems without their prior permission if we believe in good faith that such action is necessary to: (A) protect and defend the rights, property or safety of TAM or its affiliates, other users, or the public; (B) enforce the terms and conditions that apply to the use of the service; (C) respond to claims that any content violates the rights of third parties; (D) respond to reports of alleged or actual illegal activity; (E) respond to an audit or investigate a complaint or security threat; or (F) comply with the applicable laws, regulations, legal processes or governmental requests.

We have implemented physical, administrative and technical safeguards to protect personal information from unauthorized access. However, as effective as our security measures are, no security system is impenetrable. We cannot guarantee the security of our systems, nor can we guarantee that the information that you provide to us will not be intercepted and decrypted while it is sent to us over the Internet.

ARCO rights

The Federal Law on the Protection of Personal Data Held by Private Parties establishes the rights that every person may exercise in relation to the processing of their personal data, which are Access, Rectification, Cancellation and Opposition.

To carry out the exercise of any of the aforementioned rights, the User may submit their request in writing addressed to the legal department through the email address legal@tecnologiasamber.com.

Updates to our Privacy Notice

This Privacy Notice is subject to changes and updates at any time. If we make changes, the date of the last update and a notice will be published on our websites.

By using this website or, where applicable, continuing the use of our services, you accept the use of your information as described in this Privacy Notice.

If you do not agree with our Privacy Notice and with its modifications, you must stop using our services. Please review our Privacy Notice periodically.

Language and applicable law

This Privacy Notice is issued in Spanish and is governed by the legislation of the United Mexican States. The Spanish version is the only one with legal validity. TAM may publish translations into other languages solely as a courtesy and to facilitate their reading; said translations are not interpretive, do not modify or expand the content of this Notice and, in case of any difference or doubt, the Spanish version prevails.

Last updated: October 16, 2026