assets you send us for production. For this data, you are the controller and Age Media acts as your processor: we process it only on your instructions (the engagement), apply the safeguards described in Sections 7 and 8, never use it for our own purposes, and return or delete it as described in Section 9. A signed Data Processing Addendum (DPA) with standard contractual clauses is available on request for clients who require it, such as agencies and EU-based controllers.
Account and billing: name, company or brand, e-mail, phone/WhatsApp, country, and billing details. Payments are processed by Stripe; we do not store full card numbers — we receive payment tokens, card brand and last four digits, and payment status. Communications: the messages and files exchanged by e-mail, WhatsApp, or your board, kept to run your account and as service records. Client materials: the files you upload for production (Section 1(b) applies to third-party data inside them). Acceptance records: the Terms and Privacy version you accepted, with timestamp and technical identifiers, kept as evidence of contract. Site
usage and cookies: device, pages visited, approximate location, and interaction events (Section 12). Marketing preferences: your opt-ins and opt-outs. Our services are for business use; we do not knowingly collect data from anyone under 18.
We use personal data to: provide the services and run your subscription (performance of contract); billing, accounting, and fraud or chargeback prevention (contract; legal obligation; legitimate interests); communicate about your requests (contract); improve our services and site (legitimate interests; consent for analytics cookies where required); marketing to prospects and clients (consent where required; legitimate interests for business contacts, always with an easy opt-out); security and abuse prevention (legitimate interests); and compliance and defense of claims (legal obligation; legitimate interests). Where we rely on legitimate interests, we balance them against your rights; where we rely on consent, you may withdraw it at any time without affecting prior processing.
We never sell your personal data. We never use your materials, deliverables, or personal data to train artificial-intelligence models, and we do not allow our contractors or tools to do so. We do not use Protected Account materials for portfolio or promotion. We do not send marketing on behalf of third parties.
We share data only with: service providers bound by contract to process it solely for us — payment processing (Stripe), productivity and storage (Google Workspace / Drive), website and forms (Webflow), messaging (WhatsApp Business — Meta; by contacting us on WhatsApp you acknowledge Meta’s own processing under its terms), analytics (Google Analytics 4 and Microsoft Clarity), and advertising measurement (Meta, where enabled, as described in Section 12); our production specialists, independent contractors bound by confidentiality, intellectual-property, and deletion obligations, including the Protected Accounts protocol; professional advisors (accounting, legal) under confidentiality; authorities, when legally required, limited to what is mandated; and a successor entity in a corporate reorganization or sale, under equivalent protections. Acurrent list of subprocessors is available on request.
We operate from the United States, with production specialists primarily in Mexico and team members across the U.S., Mexico, and Spain; your data is processed in these locations. For transfers of EU/EEA or UK data, we rely on our providers’ recognized safeguards — including the EU Standard Contractual Clauses and, where applicable, their EU-U.S. Data Privacy Framework certifications — together with the contractual protections in this Notice and, on request, our DPA. You may ask us for information about the applicable safeguards
We apply measures proportional to the sensitivity of what you trust us with: encryption in transit, access on a strict need-to-know basis, named and revocable credentials, segregated client folders, licensed software only, contractor agreements with confidentiality and deletion certificates, and 24-hour internal incident reporting. No system is infallible; we commit to notifying you without undue delay of any breach affecting your data, with the information required by applicable law.
For engagements designated as Protected Accounts, we additionally guarantee: named, temporary access limited to the minimum team; no downloads outside the authorized workflow; a contractual ban on our team referencing your identity anywhere, in any medium; no artificial-intelligence tools touching your materials without your written authorization; and certified permanent deletion within 7 days of engagement close, evidenced by a signed certificate on request. This protocol is contractual — our contractors sign it — not a marketing promise.
Client materials (raw files and project files): 60 days after each delivery, then deleted (Protected Accounts: 7 days, certified). Deliverables and account history: while your subscription is active, plus a reasonable winddown period. Billing and acceptance records: as required by tax and commercial law (typically 5–7 years).
Communications: up to 24 months after account closure, for service records and defense of claims. Marketing data: until you opt out. Analytics: per each tool’s configured retention, minimized. When a retention period ends, we delete the data or irreversibly anonymize it.
Depending on your jurisdiction, you may have the right to access, rectify, delete, receive a portable copy of, restrict, or object to the processing of your personal data, to withdraw consent, and to stop receiving marketing (every message includes an opt-out; on WhatsApp, reply “STOP”). To exercise any right, contact us
through the channels published on our site, marked “Privacy”; we will verify your identity and respond within 30 days or the shorter term your law requires. EU/EEA and UK: you also have the right to lodge a complaint with your supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es). California: we do not “sell” personal data; to the extent measurement cookies constitute “sharing,” you may opt out through the cookie banner or by contacting us, and we honor Global Privacy Control signals where required. You will never be discriminated against for exercising your rights. Mexico: requests for access, rectification, cancellation, or opposition (ARCO) are handled through the same channel. If you are an individual appearing in a client’s materials, we will refer your request to the responsible client (the controller) and assist them as processor.
We do not make decisions with legal or similarly significant effects about you based solely on automated processing.
We use: essential cookies (site, checkout, security — always on); analytics (Google Analytics 4, Microsoft
Clarity: usage patterns and heatmaps) to improve the site; and, where enabled, advertising measurement (Meta
pixel) to gauge our campaigns. Where required (EU/EEA/UK), non-essential cookies load only after your
consent through the banner, which lets you accept, reject, or configure by category and change your choice at
any time. You can also control cookies in your browser; blocking essential cookies may break checkout.
Our site and messages may link to third-party platforms (social networks, scheduling, storage). Their privacy practices are their own; this Notice does not cover them.
We may update this Notice, publishing the new version with its date and, for material changes, notifying you by e-mail or in-product at least 15 days in advance. The version you accept at checkout is recorded
For privacy requests and questions, reach us through the contact channels published on our site, marked “Privacy.” If we are required to designate a representative in the European Union, their details will be published on this page.
Age Media · Texas, USA · Last updated: July 2026