What data we keep, what for, and how to ask us to delete it

1. Who the controller is

Monstruo Creativo S.A.C. (Peruvian tax ID, RUC, 20609563258), based in San Isidro, Lima, Peru, owns the personal data banks described in this policy and is responsible for processing them. For anything about your data, write to us.

2. Legal framework

We process personal data under Law No. 29733, Peru’s Personal Data Protection Law, and its regulations in force. If you live outside Peru, we also apply what your legislation requires to the extent it reaches us, and in any case the principles that follow: we collect only what’s needed, for a stated purpose, for as long as necessary, and we tell you what we do with it.

3. Two roles: controller and processor

Wixy is a platform other businesses use to publish their websites, so we process data in two different roles:

• As controller, for the data of anyone who visits wixy.app, writes to us or holds an account on the platform. That’s what almost all of this policy describes.
• As processor, for the data of the visitors and buyers on our clients’ websites: what they fill in on a form, what they buy in a store. There, the controller is the client who owns the site; their policies apply, and your rights should be addressed to them. We process that data following their instructions and only to provide them the service, and we help them respond to you.

4. What data we process and why

4.1 If you visit wixy.app

This site uses no cookies, no analytics, no advertising and no third-party trackers. The only thing stored in your browser is which theme you prefer (light or dark), and it never leaves there. Details are in the cookie policy.

When serving the page, our hosting and network providers (Vercel and Cloudflare, see clause 6) generate technical logs with your IP address, your browser, the time and the page requested. They serve to deliver the page and protect it from attacks, and they’re kept for the short period each provider sets.

4.2 If you write to us

We keep your name, your email, your company if you give it and your message, to reply to you and, if you ask, to prepare a proposal. The basis is your consent and, if you end up signing up, the contractual relationship. We keep them for up to twelve months after the last message, or for as long as the relationship lasts if you become a client.

4.3 If you have an account on the platform

To provide the service we process:

• Your identity and access: name, email, password (only its irreversible hash; nobody can read it, not even us), role and the clients you belong to.
• What you do on the platform: the audit trail records who made each change that matters (creating a version, publishing, rolling back, moving credits, exporting submissions, signing in to an account) with the date, and with the IP address and browser when the change comes from a request. Nobody modifies it, not even us.
• Your AI requests: the text you type, the scope, the model used, the tokens and the credits, stored alongside the version they produce.
• Billing: the details of your company needed to issue the receipt, and the payment history. The charge is processed by a payment gateway; we receive the confirmation and never your full card number.
• Communications: service notices (for example, when your credit balance reaches 80% and 100%, or when a form submission or an order comes in) and support emails.

The purposes are to provide the service you signed up for, keep it secure, bill it, tell you what’s happening in your account and support you. The basis is the performance of the contract and, for billing, legal obligations; for any other use we’ll ask for separate consent. We don’t use your data for advertising and we don’t sell it to anyone.

To support you, a member of our team can sign in to your account as your owner user for at most one hour, with a permanent notice on screen and an audit entry on the way in and on the way out.

4.4 If you visit one of our clients’ websites

Here we are a processor (clause 3). What the platform processes on the client’s behalf:

• Form submissions: the values you fill in, attachments, the page you submitted from, the referrer, campaign parameters and your browser. Your IP address is stored only if the client has configured that form to store it, and in that case they must tell you.
• Orders in a store: your name, your contact and shipping details and what you bought. The payment is processed by the gateway the client has chosen (Culqi, Mercado Pago or Stripe); neither the client nor we store card numbers.
• The cart: it’s kept in your own browser, with product identifiers and quantities, never prices, and isn’t sent to anyone until you place the order.

The client can view, export and delete submissions and orders from their panel. If you want to exercise your rights over that data, contact the client who owns the site; if you get no answer, write to us and we’ll pass your request along.

5. What we send to the artificial intelligence provider

When you request a design change or an SEO suggestion, we send the model provider what it needs to respond: the theme files that match the chosen scope, the description of the data types, a sample of your published content marked as data (so it knows what gets drawn, not to copy it), and your request. For the SEO assistant, the content of the document you’re asking about.

We don’t send passwords, credentials, billing details, your form submissions, your orders or anything from another client. Our contract with the provider is a commercial API contract: what’s sent is used to answer your request, not to train their models. The current provider is in clause 6; if we change it, we update this policy.

6. Who hosts and processes the data

These providers process data on our behalf, as processors, under contracts that require them to protect it and use it only for the service they provide us:

• Vercel Inc. (United States): hosting of this website, wixy.app.
• Cloudflare Inc. (United States): DNS, content delivery network, protection against attacks and storage of the platform’s files (images, theme files, artifacts and form attachments).
• Anthropic PBC (United States): the artificial intelligence model provider we use today, as described in clause 5.
• The payment gateways each client chooses for their store (Culqi, Mercado Pago, Stripe), and the one that processes your subscription charge.
• An email delivery provider, for service notices and form and order notifications.

The platform’s database and panel run on servers we contract. If we add a new processor, we add it to this list before we start using it.

7. International transfers

Several of the providers in clause 6 are outside Peru, mostly in the United States, so your data may leave the country. That is a cross-border data flow under Law No. 29733, and we do it under contracts that bind the recipient to a level of protection equivalent to what we owe you. By using the service with this information, you consent to that transfer to the extent the law requires it.

8. How long we keep it

• Technical logs of the website: the short period each provider sets.
• Contact messages: up to twelve months after the last message.
• Your account: while it’s active. When you close it, you have thirty days to export your data, and then we delete it.
• Publishing and payment audit trail: at least twelve months, and whatever regulations require.
• Billing: the period required by Peruvian tax regulations.
• Data on our clients’ websites: as long as each client decides; they can export and delete it from their panel.

9. Your rights

You have the right to know what data of yours we process and to request access to it, to rectify it if it’s inaccurate, to cancel it when it’s no longer needed or you withdraw your consent, and to object to a specific processing. You can also revoke a consent you’ve given us, without affecting what was done until then.

To exercise them, write to us saying which right you’re exercising, with something that lets us confirm it’s you. We reply within the periods the law sets: twenty days for access and ten days for the rest, counted from when we receive the request. It’s free.

If you’re not satisfied with our answer, you can turn to Peru’s National Authority for Personal Data Protection, part of the Ministry of Justice and Human Rights.

If your data is on one of our clients’ websites, the controller is the client (clause 3): address your request to them and, if needed, we’ll help it get there.

10. How we protect it

Each client is isolated from the others in three layers, the last one inside the database itself. Passwords are stored as an irreversible hash, gateway credentials encrypted, form attachments in a private folder with signed links that expire, and every change that matters goes into an audit trail nobody edits. The code the AI writes is compiled in a container with no network or credentials and served from a process that only reaches its client’s published content. It’s explained piece by piece in Security.

If despite all that we detect an incident affecting your data, we’ll notify you without undue delay and with what we know: what happened, which data is affected and what we’ve done.

11. Minors

The service isn’t aimed at anyone under eighteen, and we don’t knowingly collect their data. If you believe a minor has given us personal data, write to us and we’ll delete it.

12. Changes to this policy

If we change something significant (a new processor, a new purpose, a different retention period), we’ll notify you by email or in the panel before it takes effect. The date of the last update is at the top of this page.

13. Contact

For any question about this policy or about your data, write to us. We answer from Lima, in English or Spanish.