Privacy Notice

1. Who we are

Medio Melon S.A. de C.V. is a Mexican sociedad anónima de capital variable, and it operates the “Viernes” brand and its namesake AI assistant. This notice does not describe a single processing operation with a single controller: it describes two layers of data with two different controllers, and the paragraph below says which one belongs to whom.

Medio Melon is the controller for the platform layer: the person record that is reused across businesses and that section 5 describes. For the layer each business builds on its own — the contact records, the notes and the conversations that section 6 describes — each business is the controller, and Medio Melon acts as its processor: it handles that data on that business's instructions and in order to provide it the service.

Registered address: Av. del Taller 11, Paulino Navarro, Cuauhtémoc, 06870 Ciudad de México, CDMX.

Privacy contact: privacy@viernes.io.

2. Who this notice covers

This notice covers different people, and it does not treat them alike, because their data is not handled alike:

• The account holder (the business owner or operator): the person who signs up for Viernes, creates an account, uses the console, and configures the assistant to serve their clients.
• The end client: the person who messages a business over WhatsApp that answers with the Viernes assistant. That person usually holds no account with us, never visits our site, and never accepts anything on a screen: their entire relationship with Viernes happens inside the WhatsApp conversation they hold with that business.
• The team members a business gives access to the console are also account holders.
• Other people covered, who are neither account holders nor end clients: the people pictured in the photographs a business uploads and the people invited to the events of a connected calendar, as described in section 20.

3. Products in scope

This notice applies to the Viernes marketing website (viernes.io and related subdomains) and to the Viernes assistant, including any conversational interfaces, dashboards, or integrations through which it is delivered — among them the WhatsApp support that businesses provide to their own clients using the assistant.

4. Categories of personal data we process

Each category states which data subject it belongs to and how it is stored. Not everything is stored encrypted, and we say so explicitly where it is not.

• Account and authentication data (account holder): name, email address, authentication identifiers, and similar information you provide to create or access an account.
• Technical and log data (account holder): IP address, device and browser metadata, timestamps, pages or features visited, and basic error and performance telemetry generated when you use Viernes.
• Usage and interaction data (site visitor or account holder, as long as you do not turn analytics off): the pages and screens you visit, with record identifiers replaced by a placeholder; clicks on controls; frustration signals, such as several clicks in a row on the same spot, clicks that have no effect, error messages shown, and forms that are started and not submitted; the notice that you created an account, with the business type you chose; and device and browser technical data. It is collected with Google Analytics under section 19 and does not include the text you type, your name, your email address, or your phone number.
• Ad measurement data (site visitor, only if you accept it separately): if you reached the site from a Viernes ad on Google or on Meta, the identifier of the click on that ad, which is linked to the notice that an account was created and to the business type chosen. With Meta, while you accept it, for every account that is created, whether or not you arrived from an ad, also the notice that the account was created, the business type chosen, a random event identifier and the random identifier of the Meta cookie. It is processed with Google Ads or with Meta under section 19.
• Origin of your visit (site visitor): when you arrive at viernes.io we save in your browser, for up to 30 days, what kind of link you came from (for example, a Viernes ad on Google or Meta, a social network or an email) and the first of our landing pages you visited. If you create an account within that period, we associate it with your business to learn which channels bring us businesses. It is not an ad identifier, it is not sent to Google or Meta, and it is not used to show you ads.
• Voluntary inputs to Viernes (account holder): messages, documents, prompts, and any other content you choose to share with the Viernes assistant in order to receive a response or perform a task.
• WhatsApp phone number (end client): stored in plaintext, unencrypted and not hashed, because it is the lookup key used to find your record. It is not the only piece of your data without that encryption: conversation content and any files you send do not carry it either, as detailed below and in section 17. We say so here rather than letting you infer that everything is encrypted.
• Data you state in the conversation (end client): the name you prefer to be called, whether you prefer the informal or formal register (tú or usted), your language, and, where applicable, one email address. That is four fields and no more; they are stored encrypted in the platform layer described in section 5.
• WhatsApp profile name (end client): the public name Meta delivers alongside your messages. Stored encrypted under the business that received the message.
• Data the business records about you (end client): display name, phone numbers, email addresses, and preference notes that the business captures in its own console. Stored encrypted under that business and under that business only.
• Conversation content (end client): the messages exchanged with the business and any data you include in them. Retained under that business, and not covered by the additional per-record encryption we apply to the categories above.
• Files you send in the conversation (end client): photographs, voice notes, videos, stickers, and documents. They are kept in storage separate from the rest of the data, partitioned per business, with the storage service's own encryption and without the additional per-record encryption. The file name, type, and size are stored alongside them. They are not deleted automatically today: they are retained indefinitely.
• Appointments and bookings (end client): date, time, service, and the identifier of the contact they belong to.
• Data from the features described in section 20 (team members, end clients, and third parties): the WhatsApp number of each team member who provides one, stored in plaintext, unencrypted; the detail of the events of a connected calendar, stored encrypted; and the images a business uploads, published at public web addresses.

5. The platform layer: the data reused across businesses

This section describes the part of Viernes that matters most if you are an end client: a piece of your data can reach a business you never gave it to.

Above each individual business, Viernes keeps a single record per person, which we call the platform layer. That record is identified by an internal number we generate, not by your phone number. It stores encrypted — and only if you state them in a conversation — four fields: the name you prefer to be called, whether you prefer tú or usted, your language, and one email address. Your WhatsApp phone number is stored separately, in plaintext, purely as the key used to find that record.

The first time you send a message to a business that uses Viernes, a link between your record and that business is created automatically. You are not asked for permission to create it, you are not notified, and the link does not expire.

From that link onwards, the name you prefer to be called and your tú/usted preference are shared with that business even if you stated them in a conversation with a different business, without asking you again and without telling you. This is a deliberate product design decision, not a side effect, which is why we state it plainly: if you do not want a field reused this way, do not state it in the conversation.

Your language is stored in that record but is not delivered to any business today. Your email address is the only one of the four fields that requires your consent, as described in section 7.

A business only receives these fields if you have messaged it at least once. No business can browse the platform's directory of people, look up someone who has not messaged it, or learn which other businesses you are linked to.

6. The business layer: the data that never leaves that business

Everything a business collects or notes about you on its own belongs to that business and reaches no other: the display name, phone numbers, email addresses, and preference notes it captures in its console, plus the profile name WhatsApp delivers with your messages.

That information is stored encrypted under that business. Viernes does not copy it into the platform layer, does not hand it to another business, and no other business can decrypt it.

The conversation history and any appointments booked in it likewise belong to the business you spoke with.

7. Consent to share your email address

The consent Viernes asks you for covers your email address only, and it is requested and recorded separately for each business. Permission given to one business does not carry over to another.

When your platform record holds an email address and the business you are talking to has no decision from you about it yet, the assistant asks whether it may share it with that business. Until such a decision exists, the business does not receive your address: the assistant handles only a masked version, of the form m…@gmail.com, so that it can ask the question. If you say no, not even the masked form is shown again. If no decision is on record, we treat your address as not shared.

If you give your email address directly to a business, that act itself authorizes that business to hold it, and it is recorded as such. If a business has your email address because you agreed to share it or dictated it in the conversation, the appointments the assistant books with that business can record it as an invitee and, where the team's calendar is connected, Google or Microsoft can email you an invitation.

The name you prefer to be called and your tú/usted preference are not covered by this consent. Those two fields are shared with every business you message without asking you, as explained in section 5. Saying “Viernes asks for your consent” without this clarification would be misleading, because the consent covers exactly one of the four fields.

8. How to withdraw consent, and what withdrawal reaches

Today Viernes has no panel, button, link, or online form through which you can withdraw permission to share your email address by yourself. There is no end-client screen at all. We say this plainly rather than offering you a mechanism that does not exist.

The path that does work is telling the business so in the same WhatsApp conversation — for example, “stop sharing my email with this business”. The assistant records that refusal for that business and stops handing your address over from then on.

The withdrawal applies business by business: it has to be stated in the conversation with each business you no longer wish to share with. There is no single switch that withdraws it everywhere at once, and Viernes will not ask you again on its own once a decision is on record.

Withdrawal stops future use and nothing more: the business stops receiving your address from your platform record, but nothing already stored, seen, written down, or exported by that business is deleted or clawed back.

If that path does not work for you, if the assistant fails to record what you said, or if you would rather not raise it with the business, write to privacy@viernes.io and we will handle the request ourselves.

9. Deletion: what it reaches and what it does not

Deletion of an end client's data happens per business, not globally.

When a business deletes your contact record, what that business held about you is erased: the display name, phone numbers, email addresses, preference notes, WhatsApp profile name, and the consent decision recorded with that business. Only a minimal marker that the record was deleted is kept — the phone number and the date — so that it is not recreated by mistake. If you message that business again, the record is created afresh.

That deletion does not touch your platform-layer record and does not affect any other business: every other business you have already messaged keeps its own record and keeps receiving, from the platform layer, the name you prefer to be called and your tú/usted preference.

That deletion also does not reach the conversation history or appointments already booked: both are retained under the corresponding business. We point this out because it is the part most often assumed to be deleted when it is not.

To request deletion of your platform-layer record — the one shared across businesses — write to privacy@viernes.io. The product includes no automated control for this today; such requests are handled manually.

That deletion stops the reuse going forward: your name and register preference stop being handed to businesses. It does not erase the copies already written into the conversation history of each business you messaged: when the assistant greets you by that name, that message is stored in that business's history, which belongs to it and is retained under section 16. The product offers no function today that deletes those copies.

10. Legal bases (GDPR Art. 6)

Where the EU General Data Protection Regulation applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) to provide the Viernes site and assistant requested, including handling the conversation with the business.
• Legitimate interests (Art. 6(1)(f)) to secure our services, prevent abuse, debug issues, improve product quality, and measure which channels bring us businesses that create an account (section 4), balanced against your rights.
• Consent (Art. 6(1)(a)) where we ask you to opt in to a specific processing activity, such as sharing your email address with a business, or the ad measurement described in section 19.
• Tacit consent (Mexican LFPDPPP, art. 8) for the usage analytics described in section 19: this notice is available to you from your first visit, analytics turns on from that moment, and you can object at any time, in one step, from “Configurar cookies” or “Preferencias de cookies”. It is the only basis we use for usage analytics.
• Legal obligation (Art. 6(1)(c)) where processing is required to comply with applicable law.

11. Purposes of processing

• Operate, maintain, and secure the Viernes site and assistant.
• Authenticate users and manage accounts.
• Handle the conversation between a business and its client, book appointments, and follow up on them.
• Address each person by the name and in the register they themselves stated, as described in section 5.
• Respond to requests sent to Viernes and improve assistant quality.
• Diagnose technical issues and prevent fraud, abuse, or unauthorized access.
• With your tacit consent, measure how the site and the console are used and detect where the experience is confusing or frustrating, in order to improve it.
• With your consent, given separately, measure whether visits that come from our ads on Google or on Meta end in an account being created, in order to know which ads work.
• Measure which channels (ads, social networks, emails) bring us businesses that create an account, based on the origin of the visit described in section 4.
• Comply with legal, regulatory, and contractual obligations.
• Send appointment notices and reminders to end clients, and alerts and the agenda summary to the business's team, as described in section 20.

12. Who we share personal data with

Your data is shared only with those needed to deliver the service:

• The business you message, on the terms of sections 5, 6, and 7.
• Meta Platforms (WhatsApp Business Cloud API): every inbound and outbound message transits WhatsApp's infrastructure. Phone numbers, profile names, and message content originate there and are delivered there.
• Amazon Web Services (AWS): compute, storage, encryption, and logging infrastructure. Our account operates in the us-east-1 region, in the United States. AWS Bedrock, running Anthropic's Claude models, processes the content a business uploads to its knowledge base, through a cross-region United States inference profile.
• Google Cloud (Vertex AI), running Gemini, Google's models: generates the assistant's replies, both to end clients and to the business's team. It receives the conversation text, the resolved name and register, and the business's preference notes, and, when the team asks about its agenda, the results of that query. The system does not add your full email address to what it sends to the model, only the masked version; if you type your email address in the conversation, the model receives it as part of the text.
• Google LLC (Google Analytics, Google Tag Manager and Google Ads), as long as you do not turn analytics off: it receives the usage and interaction data described in section 4 and a random identifier stored in a cookie in your browser. If you also accept ad measurement, Google Ads receives the identifier of the click on the ad you arrived from and the notice that an account was created. Google signals and ad personalization are turned off, and it receives neither conversation content nor your contact details.
• Meta Platforms (Meta pixel), only if you accept ad measurement: it receives, for every account that is created, the notice that it was created with the business type chosen, a random event identifier and a random identifier stored in a cookie in your browser, and it receives the identifier of the click on the Meta ad only if you arrived from one. As with any page or script that loads, it also receives the technical data your browser sends, such as the IP address, the browser type and the address of the page on which the account was created. We do not use advanced matching: it receives neither your name, your email address nor your phone number, nor the content of conversations. We do not personalize ads or do remarketing with this data.
• Google and Microsoft, when a team member connects their calendar: Viernes reads that calendar's events, and the appointments the assistant books can be written into it with the client's WhatsApp number and, if the client agreed to share their email with that business, with that email as an invitee; the calendar provider can then email an invitation to that address.
• Competent authorities, where applicable law requires it.

13. International transfers

Medio Melon operates from Mexico and relies on providers whose infrastructure is located in several countries. The assistant's replies are processed on Google Cloud through an endpoint that does not fix a region, so it is Google that decides where they are processed; that can be outside Mexico and the United States, and we offer no guarantee about where it takes place. Analytics, as long as you do not turn it off, and ad measurement, if you accept it, are processed on Google and Meta infrastructure, including in the United States.

We do not sell personal data, and we do not use your data or your conversations to train artificial-intelligence models.

Where personal data is transferred outside its country of origin, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, supplementary technical and organizational measures, and equivalent mechanisms recognized under Mexican and US law. Additional information about transfer safeguards is available on request at privacy@viernes.io.

14. Your rights

The rights described below belong equally to the holder of a Viernes account and to the end client who converses with a business, even if that person has never visited our site. Depending on where you are located, you may have the following rights regarding your personal data:

• LFPDPPP (Mexico): ARCO rights — access, rectification, cancellation, and opposition — as well as the right to revoke consent and to limit the use or disclosure of your personal data. In Viernes, cancellation operates with the reach described in section 9, and revocation of consent with the reach described in section 8.
• GDPR (EU/EEA/UK): access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with your local supervisory authority.
• CCPA/CPRA (California): right to know, delete, correct, and limit the use of sensitive personal information, plus the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as defined by the CCPA/CPRA; if this changes, this notice will be updated and an opt-out mechanism will be provided.

15. How to exercise your rights

You can exercise any of the rights described above by writing to privacy@viernes.io. Please describe your request and the jurisdiction whose rights you are invoking so that we can route the request appropriately. We may need to verify your identity before responding and will reply within the timeframes required by applicable law.

If you are an end client and your request concerns data a business holds on its own, we may need to coordinate it with that business; write to us regardless and we will tell you the route. Because there is no self-service screen for end clients, this mailbox is the formal channel for any request, in addition to whatever you say directly to the business in the conversation.

16. Retention

We retain personal data only for as long as needed to provide our products, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods are defined by data category and purpose.

Today we apply no automatic expiry-based deletion to contact records, platform-layer records, appointments, conversation histories, or files sent in the conversation: they are retained until they are deleted under section 9 or until a request sent to privacy@viernes.io is fulfilled, always with the reach that section 9 describes: some copies, such as those left in the conversation history, are deleted by no function of the product. Files sent in the conversation are retained indefinitely. We prefer to say so rather than publish a period the system does not yet honor; when specific per-category periods are defined, we will publish them in this notice.

Technical logs for the assistant and conversation handling, for the site sign-in session, and for calendar synchronization are retained for a bounded period, ranging from one month to one year depending on the environment. Other technical logs — among them those for account sign-up and for the user-profile service — have no defined expiry today; when we define one, we will publish it here.

Each time the Viernes privacy notice is sent to you by WhatsApp, a record is written of which version was sent and when. Displaying this page creates none. That record is retained for at least 5 years. That period is a floor and not a deletion date: today no process deletes that record automatically, and keeping it for longer breaches nothing we say here.

17. Security

We implement administrative, technical, and physical safeguards designed to protect personal data against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These include encryption in transit, access controls, and ongoing monitoring of our infrastructure.

The data you state in the platform layer and each business's contact records are stored encrypted with keys managed in AWS KMS, using a distinct data key per person and per business, so that a business can decrypt neither the platform layer nor another business's records. As stated in section 4, the phone number, conversation content, and files sent in the conversation do not carry that additional per-record encryption; files are protected by the storage service's own encryption.

18. Children

Viernes is not directed to children. We do not knowingly collect personal data from individuals under 16 (or under 18 where local law requires a higher threshold). If you believe a minor has provided us with personal data, please contact privacy@viernes.io so we can delete it.

19. Cookies & analytics

Viernes uses Google Analytics 4, loaded through Google Tag Manager, to understand how the site and the console are used and to detect frustration signals: several clicks in a row on the same spot, clicks that have no effect, error messages that appear on screen, and forms that are started and not submitted. We use that information to decide what to improve.

Separately, and only if you also accept it, we measure with Google Ads whether a visit that came from a Viernes ad on Google ends in an account being created; that is, we measure our ads' conversions. For that, Google receives the identifier of the click on the ad you arrived from and the notice that the account was created, with the business type chosen. This measurement works through Google Analytics, so it works only while analytics is on. That same option turns on measurement with Meta: while you accept it, every time an account is created the Meta pixel, which loads only if you accept ad measurement, receives the notice that the account was created, the business type chosen, a random event identifier, the random identifier of the Meta cookie and the technical data any script that loads sends, whether or not you arrived from an ad; the identifier of the click on the ad is sent only if you arrived from a Meta ad. If you arrived from a Meta ad and accept measurement later, during the same visit, that identifier is kept only in the memory of the open page (not in your browser's storage) until then, and it is not handed to Meta if you do not accept.

Analytics is on by default: it turns on from your first visit without you having to do anything, based on your tacit consent (Mexican LFPDPPP, art. 8), because this notice is available to you and you can turn analytics off easily. On your first visit a cookie notice appears with the buttons “Aceptar” (accept) and “Cerrar” (close) and the link “Configurar cookies” (cookie settings): “Cerrar” keeps the default settings, with analytics on and ad measurement off; “Aceptar” also turns on ad measurement, which is a separate option. If you turn analytics off, from that moment we stop recording new usage events, all consent signals are denied and we remove the analytics cookies; however, measurements already recorded in the seconds before, on the page you have open, may still finish being sent to Google Analytics, and that page may keep sending cookieless automatic measurements, such as scrolling. From the next page load, your browser no longer loads Google Analytics or Google Tag Manager, and no analytics or advertising cookie is stored. Until you accept ad measurement, no advertising cookies are stored, the Meta pixel is not loaded and the identifier of the click on the ad is redacted. If you had rejected analytics before, we respect that decision and analytics stays off until you turn it on.

We do not personalize ads with this data or use it to show you ads again (remarketing), we do not turn on Google signals or ad personalization, we do not turn on advanced matching or the automatic tracking of buttons and forms of the Meta pixel, we do not create custom audiences with this data, we do not record sessions or what you type, and we do not send your name, your email address, your phone number, the content of your messages, or the identifiers of your records. Page addresses are sent with those identifiers replaced by a placeholder, and Google Analytics 4 does not log or store IP addresses.

While analytics is on, Google Analytics stores the _ga and _ga_<id> cookies in your browser, which hold a random identifier and expire after 2 years. The usage data linked to that identifier is kept in Google Analytics for 14 months; aggregated reports, which identify no one, may be kept longer. If you also accept ad measurement, Google may store the _gcl_au and _gcl_aw cookies, which hold a random identifier and, if you arrived from an ad, the identifier of that click, and expire after 90 days; and Meta may store the _fbp and _fbc cookies, which hold a random identifier and, if you arrived from a Meta ad, the identifier of that click, and which expire in the same period, which Meta sets. In addition, the Meta script may store in your browser's local storage the identifier of the click on the ad, the last external page you came from and the time you did so (the keys multiFbc, lastExternalReferrer and lastExternalReferrerTime).

You can change your decision whenever you like from “Configurar cookies” in the cookie notice, and from “Preferencias de cookies” in the site footer and in the console menu. There you can turn analytics off, and you can withdraw ad measurement alone and keep analytics. If you turn an option off, we stop recording new data for that option, and sending events to the Meta pixel, from that moment (except, as described above, for measurements already recorded in the seconds before, which may still finish being sent, and for the cookieless automatic measurements of the page that is open) and remove the matching cookies from your browser: the _gcl and the _fbp and _fbc cookies, together with that Meta data in local storage, if you withdraw ad measurement, and the _ga cookies too if you turn analytics off; to have the data already sent deleted as well, write to privacy@viernes.io.

The session cookie that keeps you signed in is essential and does not depend on this decision. Your choice, if you make one, is saved in your browser's local storage and is not sent to any server. In addition, when you arrive at the site we save in your browser, for up to 30 days, the origin of your visit described in section 4; it is not a Google or Meta cookie.

This analytics does not reach end clients who talk to a business over WhatsApp: the appointment-confirmation and email-unsubscribe pages they receive by link do not load it.

20. Service features and the data they use

This section describes service features that are already in use and the personal data each one processes. Not every feature is active at every business.

• Appointment notices to end clients: they are sent by email from citas@viernes.io on behalf of the business, and by WhatsApp from the business's number. When the business books or reschedules an appointment from its console, the email includes a web address of its own for the appointment. From there, whoever holds it can confirm, cancel or reschedule the appointment without signing in, until the appointment starts. Each email also includes a link to unsubscribe from the emails. If an address bounces permanently or generates a complaint, a fingerprint of that address, that is, a code derived from it and not the address itself, is kept with no expiry, and that address stops receiving emails from every business that uses Viernes.
• Alerts to the business's team: the WhatsApp number of each team member who provides one is stored in plaintext, unencrypted, and verified with a one-time code sent from the Viernes WhatsApp number. The version of the consent text the person accepted is recorded, together with when it was accepted and who accepted it. The alerts are sent from the Viernes number and do not include the client's name, number or messages. Replying BAJA stops them.
• Agenda and time off: each team member who has provided a number receives on that WhatsApp number, from the Viernes number, the summary of their agenda and the answers to what they ask about it, and the detail includes the first names of clients with appointments. When time off cancels appointments, whoever declared it receives, by WhatsApp from the Viernes number or by email, a follow-up report with the names and phone numbers of the clients who did not reply or could not be notified.
• Reminders: they exist only at businesses where they are turned on. After an appointment is booked, the assistant offers in the conversation to send you a WhatsApp reminder before the appointment. The reminder is scheduled only if you accept in the conversation, and in that same conversation you can ask for it to be withdrawn.
• Images: a business can upload its logo and photographs of the people on its team or of its resources. The copies are published at public web addresses that anyone who holds the address can open without signing in, and they are used in messages and emails to clients. The business, not Viernes, confirms that it has the authorization of the person pictured. Deleting a photograph removes it from our storage and asks for it to stop being served; it can take some time to stop showing, and it cannot recall copies already downloaded, for example by email programs.
• Connected calendars: when a team member connects a Google or Microsoft calendar, Viernes reads that calendar's events, including the title, description, location, and the names and email addresses of the invitees. Invitees may have no relationship with Viernes. The event detail that Viernes keeps for scheduling is stored encrypted. Only the member who connected the calendar sees that detail; the other team members see that time as busy.
• Appointments booked by the assistant: the appointment's record keeps the client's WhatsApp number and, if the client agreed to share their email with that business, that email as an invitee. When a team member has connected a Google or Microsoft calendar, those data can be written into that calendar's event, and the calendar provider can email the client an invitation.
• History when connecting a number: when a business connects to Viernes the WhatsApp Business number it already uses on its phone and agrees, in the WhatsApp Business app, to share its history, Viernes stores the messages of one-to-one conversations from the 24 hours before the connection, both the customers' messages and the business's replies, together with any photos and files from that period that Meta delivers. Meta may send older messages; Viernes discards them without storing them. Group chats and the phone's address book are not imported. The assistant does not reply to imported messages, and a conversation that receives them starts with the assistant paused until the business resumes it or the conversation picks up again after 24 hours or more without messages. Imported messages are kept like the rest of the conversation.

21. Changes to this notice

We may update this Privacy Notice from time to time to reflect changes in our products, legal requirements, or operational practices. When we make material changes, we will update the effective date and, where appropriate, provide additional notice through the Viernes site or assistant.

22. Contact

For any question about this Privacy Notice or about how Medio Melon processes your personal data, please contact privacy@viernes.io.