Comprehensive privacy notice
Last updated: October 15, 2026
This English version is provided for convenience; in case of discrepancy, the Spanish version prevails.
This notice explains who processes your personal data when you use www.gotapp.ai and app.gotapp.com.mx (the "Platform"), what it is used for, who it is shared with and how you can exercise your rights. It is issued under the Federal Law on the Protection of Personal Data Held by Private Parties, published in the Official Gazette of the Federation (DOF) on March 20, 2025 (the "Law").
1. Data controller
GoTapp Servicios Financieros, S.A. de C.V., Sociedad Financiera de Objeto Múltiple, Entidad No Regulada (SOFOM, E.N.R.), trading as GoTapp, tax ID (RFC) KMO250225RQ1 ("GoTapp"), is responsible for your personal data.
Address: Av. Lázaro Cárdenas 3454-6, int. B6-B7, Col. Jardines de los Arcos, C.P. 44500, Guadalajara, Jalisco, Mexico.
2. Personal data we collect
We collect the data that you, your company or its representatives provide, the data generated when you use the Platform, and the data we obtain from authorized sources while verifying your identity and your company.
| Category | Data | When it is collected |
|---|---|---|
| Identification and contact | Name, email, phone number, address, date of birth, CURP, RFC, identity document number and type. | Sign-up, company onboarding and identity verification. |
| Identity documents | Image of the front and back of your official ID (INE or passport). | Identity verification. |
| Biometric data (sensitive, see section 3) | Photograph of your face (selfie) and the result of the liveness check and of the match with your ID. | Identity verification. |
| Company data and data of its representatives, shareholders and beneficial owners | Legal name, RFC, tax status certificate, articles of incorporation and powers of attorney, shareholding structure, identification data of the related individuals. | Company onboarding and review (KYB). |
| Tax data | The SAT password (CIEC) you choose to provide, tax returns, compliance opinion and digital tax receipts (CFDI) of your company. | Only if you authorize the SAT query; the CIEC is stored encrypted. |
| Financial and transactional data | Accounts, corporate cards, transactions, SPEI transfers (sender, beneficiary, CLABE, description) and spending limits. | Use of the products. |
| Location | Device coordinates and, when unavailable, approximate location from the IP address, together with the address derived from them. | Login, onboarding submission and review decisions, when the Platform requests it. |
| Access and technical data | Email, credentials managed by our authentication provider, Google account if you choose that sign-in (identifier, email and name), the mobile device public key, access logs. | Sign-up, login and use of the mobile app. |
3. Sensitive and biometric data
Biometric data (selfie and liveness check) lets us confirm that you are the person on your ID. Although the Law does not expressly list them as sensitive, because of their nature and risk we treat them with the enhanced protection of sensitive data and with your express consent.
By starting identity verification on the Platform and continuing the process, you give your express consent to this processing. If you do not give it, we will not be able to complete your onboarding.
Biometrics in the mobile app: unlocking with your phone fingerprint or face happens on your device and GoTapp does not receive that information. Our servers only store a public key used to verify your device signature.
4. Purposes of processing
Primary purposes, necessary for the relationship with you and your company:
- Create and manage your account and your company account, and authenticate you (including use of the mobile app).
- Verify your identity and that of your company, its representatives, shareholders and beneficial owners.
- Comply with anti-money laundering and counter-terrorist financing (AML/CFT) obligations, including screening against lists of blocked persons and politically exposed persons, and record keeping.
- Operate the products you contract: accounts, corporate cards and SPEI transfers.
- Send you operational and security emails (verification, access codes, status of your application, invitations).
- Prevent fraud and protect the security of the Platform.
- Handle your queries, clarifications and requests, and comply with requirements from competent authorities.
Secondary purposes: GoTapp does not process your data for secondary purposes and does not use it for marketing or advertising. If any are added in the future, we will update this notice and you will be able to opt out through the means in section 7 without affecting your account.
6. Rights of access, rectification, cancellation and opposition (ARCO)
You have the right to access your data, rectify it if inaccurate, cancel it and oppose its processing, and to revoke the consent you gave us. Cancellation may be limited while the law requires us to keep your data (section 9).
Send your request to: soporte@gotapp.com.mx, stating:
- Your name and a way to reply to you.
- A document proving your identity or representation.
- A clear description of the data and the right you want to exercise.
We will reply within a maximum of 20 business days and, if applicable, carry out the request within the following 15 business days (article 31 of the Law). Exercising these rights is free of charge, except for reproduction and shipping costs.
7. How to limit the use of your data
You may ask us to stop using your data for purposes that are not necessary for the relationship with you by writing to soporte@gotapp.com.mx. To stop receiving non-operational communications, use the same means.
9. Retention and security
We keep customer and user identification information and their transactions for at least ten years, as required by article 95 Bis of the General Law of Credit Organizations and Auxiliary Activities. Other data is kept for as long as needed for the purposes of this notice and the applicable legal periods.
We apply administrative, technical and physical security measures: encryption of databases and documents, reinforced encryption of the SAT password, access controls with strong authentication and logging of staff access to personal information. No system is infallible; if a breach affecting your rights occurs, we will inform you.
10. Changes to this notice
We may modify this notice. We will publish the current version at www.gotapp.ai/en/legal/privacy with its last-updated date and, if the change is substantial, we will let you know by email or on the Platform.