Privacy notice

Controller

Jorge Alberto Niño Cabal, operating the Cabecera Web brand (“Cabecera Web”), with its address for notices at Hacienda de Guadalupe 653. Col Haciendas de México., C.P. 29038, Tuxtla Gutiérrez, Chiapas, México, is responsible for processing the personal data you provide.

For anything related to this notice or your personal data, write to jorge@devbox.com.mx.

Who this notice covers

This notice covers doctors, dentists, clinics, practices and their administrative staff who request a quote or hire our website design, publishing and maintenance services. Cabecera Web serves businesses; it does not provide medical care or serve patients.

Personal data we process

• Quote requests: name, work email and/or phone, country, practice or clinic name, specialty, preferred language, package of interest, current website and the goal you describe.
• Client onboarding: contact-person details; public information about the professionals who will appear on the site (name, title, specialty, education, languages, license numbers and public verification links); the practice's services, locations, hours and phone numbers; logos, photos and documents you choose to share; and the names of content approvers.
• Consent records: the date and version of this notice you accepted, and your choice about marketing messages.
• Minimal technical data for security: a keyed hash of your IP address used to limit abusive submissions, automatically deleted within two days, and the hosting provider's access logs.

Sensitive data and patient data

We do not request sensitive personal data. In particular, we do not request, and should never receive, patient information: medical records, symptoms, diagnoses, treatments, insurance IDs, medical images or appointment data. We also never ask for passwords or access keys to other systems.

If we receive such information by mistake, we will not use it, will delete it as soon as we identify it, and will let you know.

Photos of professionals you share are used only for the contracted website and only after your approval.

Purposes

Purposes necessary for the relationship you request:

• Answering your request, preparing quotes and confirming scope in writing.
• Designing, building, reviewing with you, launching and maintaining the contracted website.
• Checking the credentials you give us against official public sources before publishing them.
• Recording approvals, manually confirmed payments and project status changes.
• Protecting the security of the service and preventing abuse.
• Meeting applicable legal, tax and accounting obligations.

Additional (optional) purposes

Declining these purposes does not affect your quote or service. You can withdraw at any time by writing to jorge@devbox.com.mx.

• Sending occasional Cabecera Web news, only if you ticked the corresponding box.
• Showing your website as an example of our work, only if you separately authorize it during onboarding.

Service providers and transfers

To run the service we use providers that process data on our behalf and under our instructions:

• Database, authentication and file storage: PostgreSQL en un servidor de Amazon Web Services (EC2) y almacenamiento privado de archivos en Amazon S3 / PostgreSQL on an Amazon Web Services (EC2) server and private file storage on Amazon S3.
• Website hosting: Amazon Web Services (EC2), región us-east-1, Estados Unidos / Amazon Web Services (EC2), us-east-1 region, United States.
• AI-assisted drafting: none currently contracted. We only send onboarding information to this provider when the client expressly authorizes it, and all generated content is reviewed and approved by people before publication.
• WhatsApp and phone services, when you choose to contact us that way, under those services' own terms.

Transfers without your consent

We do not sell or rent personal data. We would only disclose data to competent authorities when the law requires it, or in other cases where applicable law allows it without consent.

Retention

• Quote requests that do not become a project: up to 12 months after the last contact.
• Client records (including approved content versions): for the duration of the relationship and up to 5 years after, for tax obligations and to handle queries.
• Unpublished photos and brand files: deleted within 90 days after the relationship ends, unless you ask us to keep them.
• Onboarding access links expire after 14 days; sessions after 7 days.

Your rights and withdrawing consent

You may request access to, correction or deletion of your data, object to its processing, or withdraw your consent by writing to jorge@devbox.com.mx with: your name and a way to reply; a document proving your identity or, where applicable, representation; a clear description of the data and the right you want to exercise; and anything that helps us locate your data.

We will respond within the timelines required by applicable law and tell you whether the request is granted, then carry it out within the legal timelines. Withdrawal is not retroactive and may prevent us from continuing the service when the data is necessary for it.

Limiting use or disclosure

To stop marketing messages or limit other optional uses, write to jorge@devbox.com.mx. We will record your choice.

Cookies and tracking technologies

This website does not use advertising cookies, tracking pixels, third-party analytics or session recording. Fonts are served from our own site.

We only use strictly necessary cookies: a session cookie for the private onboarding form and authentication cookies for authorized staff. They are not used for advertising.

Security

We apply reasonable administrative, technical and physical safeguards: access limited to authorized staff, private file storage, expiring access links, file validation and approval records. No system is completely infallible; if a breach significantly affects your rights, we will inform you as required by law.

Changes to this notice

We will post any changes on this page with the update date. If a change requires your consent, we will ask for it.