FileXpress Privacy Policy

This Policy describes how MANGO STUDIOS, S.A. DE C.V. ("Mango Studios") handles information in connection with FileXpress (web, FX Hub app, API and AI assistant) and the filexpress.app website. By using our services, you acknowledge that you have read this Policy.

• Customer Data: for the information businesses enter into the Platform (customers, suppliers, transactions, employees, attendance, payroll, etc.), Mango Studios acts as a processor, following the instructions of the Customer, which is the controller and must have the necessary legal basis and consents, including those of its employees.
• Account and website data: for registration data, subscription billing, support, website usage and marketing communications, Mango Studios acts as controller.

• Account and contact: name, email, phone, company, job title, country, credentials and preferences (such as language).
• Subscription and payments: plan, payment history, submitted receipts and billing details.
• Customer operational data: commercial, tax and accounting information; customer and supplier data (including tax identification numbers); products and inventory; tax documents; and documents received at the email intake address.
• Human resources data: employee records, contracts, attendance, leave, salaries, deductions and documents, entered by the Customer.
• AI interactions: questions, answers, screen context and conversation history with the data agent and the assistant.
• Usage and technical: audit and activity logs, IP address, browser, device, operating system, app identifiers, API logs and performance and error data.
• Website and marketing: contact forms, cookies and analytics and advertising data.

• To provide, operate and maintain the Platform, including issuing and transmitting tax documents to authorities at the Customer's instruction.
• To provide support, training and communications about the service, security, changes and billing.
• To protect the Platform: authentication, fraud and abuse prevention, auditing and incident response.
• To provide AI and Business Intelligence features over the Customer's own data.
• To improve the service through aggregated statistics and anonymized data that does not identify the Customer or individuals.
• To send marketing communications, which you can opt out of at any time.
• To comply with legal obligations and respond to requests from competent authorities.

We do not sell personal data or Customer Data, nor use them for third-party advertising.

• AI Feature queries are processed by cloud model providers (Amazon Bedrock on AWS). Only the information needed to answer is sent.
• Our model providers do not use Customer Data to train their general models, under their terms of service.
• The data agent has read-only access to the active branch and respects the user's permissions.
• Mango Studios may use aggregated, anonymized data to improve its own AI features; never data that identifies the Customer or individuals.
• We retain conversation history for service continuity, security and support, as described in the retention section.

We share information only with:

• Subprocessors that help us provide the service, under confidentiality and security obligations: Amazon Web Services (infrastructure, storage and AI), ZeptoMail/Zoho (transactional email), Vercel (website hosting and analytics), Google (Google Play and ad measurement), Meta (website advertising pixel) and Microsoft Clarity (website analytics).
• Tax authorities, when the Customer issues tax documents.
• Third parties the Customer connects via the API or integrations, under its responsibility.
• Authorities, when required by law or a valid order, or to protect our rights, users or the public.
• Successors, in the event of a merger, acquisition or asset sale, with continuity of this Policy.

Information may be stored and processed on servers located outside your country, including the United States. We apply contractual and technical measures to protect it consistently with this Policy.

• TLS 1.3 encryption in transit and AES-256 at rest.
• Logical isolation of each customer's data, granular permissions per user and branch, and two-factor authentication.
• Audit logs, continuous monitoring and backups across multiple zones.
• Restricted staff access, under confidentiality obligations.

No system is completely infallible. If we detect a breach affecting Customer Data, we will notify the Customer without undue delay and cooperate with it.

We retain Customer Data while the subscription is active and for 30 days after termination to allow export; it is then deleted unless legally required otherwise. Backups are deleted in their normal cycle. Account data, billing records and security logs may be retained as long as required by law or necessary to defend claims.

• Access, correction, deletion, objection, portability and withdrawal of consent, as provided by applicable law.
• If your data was entered by a customer business (for example, as its employee or customer), direct your request to that business; we will cooperate with it to respond.
• US residents: depending on your state, you may have additional rights over your data. We do not sell or "share" personal data for cross-context behavioral advertising based on Customer Data.

To exercise your rights, write to soporte@filexpress.app. We will respond within 30 business days and may verify your identity.

The website uses first- and third-party cookies for functionality, analytics (Vercel Analytics, Microsoft Clarity) and ad measurement (Google Ads, Meta). You can block or delete them in your browser settings; some features may be affected. The Platform uses strictly necessary cookies for sessions and security.

Our services are intended for businesses, not for anyone under 18. We do not knowingly collect children's data, except data the Customer enters under its own responsibility within the employment context permitted by law.

We may update this Policy. We will post the current version on this page and give reasonable advance notice of material changes.

Privacy and data protection: soporte@filexpress.app. Controller: MANGO STUDIOS, S.A. DE C.V., San Salvador, El Salvador.