Pecky

Pecky · Padmit

Privacy Notice

Version 1.0 · Last updated and effective: 2026-10-12

At Pecky, we respect the privacy of people who use our platform to review websites and digital products. This Privacy Notice explains which personal data we process, for what purposes, with whom it may be shared, and how to exercise the corresponding rights, under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties and other applicable provisions.

1. Controller and contact

Padmit, S.A.P.I. de C.V. (“Padmit”), located at Bosque de Jacarandas 117, Portales de la Arboleda, C.P. 37100, León, Guanajuato, Mexico, is the controller of the personal data it obtains directly to operate Pecky.app, manage accounts and subscriptions, and provide assistance.

Email for privacy matters and data subject rights: privacidad@padmit.com.

2. Personal data we process

Depending on the features you use, we may process the following categories:

Pecky does not require sensitive personal data to register or use its ordinary features. However, users may accidentally include it in screenshots or comments; we recommend avoiding this.

3. Purposes of processing

Necessary purposes: registering and authenticating accounts; managing roles, projects, and invitations; storing and displaying shared content; enabling comments, exports, and authorized integrations; processing subscriptions and payments; sending operational, security, recovery, and deletion notices; handling support and ARCO requests; preventing abuse and unauthorized access; maintaining, diagnosing, and protecting the service; and meeting legal, tax, or contractual obligations.

Secondary purposes: if we send marketing communications, promotional surveys, or personalized advertising in the future, we will request the appropriate consent and provide a simple way to refuse those purposes. This notice does not, by itself, currently authorize advertising messages or the sale of personal data.

4. Project content and third-party data

People who create projects and invite collaborators decide which websites, content, and people may participate, and determine the purposes of the screenshots and observations they submit. When Padmit processes personal data on those users’ behalf and under their instructions to host and facilitate collaborative work, it acts as a data processor, to the extent appropriate under the relationship and applicable law. Padmit is the controller of data processed for its own platform administration, security, billing, and operational purposes.

Users who capture or submit third-party personal data must have a lawful basis to do so, inform the people concerned where required, and keep their own privacy notice up to date. They must not capture passwords, financial information, sensitive data, or confidential information without sufficient authorization.

Content is shared with authorized project members according to their roles. The owner may manage, archive, or delete projects, including collaborators’ contributions, under the Terms and Conditions. Deleting a collaborator’s account does not necessarily delete their contributions to other people’s projects; these may be retained with the account’s identifying data removed, where appropriate. Removing the link to the account’s identity does not automatically remove personal data that may remain in contributed text or images.

5. Providers, processors, and transfers

To operate the service, we use technology providers that may process data on our behalf under instructions and confidentiality and security obligations, including:

These providers may process or store information outside Mexico, depending on their infrastructure and contracts. Disclosures to processors acting on Padmit’s behalf are subject to applicable legal rules and are not necessarily considered transfers to independent third parties.

We may disclose information to competent authorities where there is a legal obligation or valid request; to people authorized by the data subject or project owner within the service; or in other cases permitted by law. Where a transfer requires consent, we will obtain it beforehand. We do not sell personal data databases.

6. Chrome extension, MCP, and artificial intelligence agents

The Chrome extension lets you select elements or capture screenshots and website context. Drafts may remain temporarily in your browser before submission. Content you confirm is transmitted to Pecky and becomes subject to the project’s permissions.

Pecky allows you to authorize connections through Model Context Protocol (MCP), a mechanism for integrating external agents or tools, including artificial intelligence tools. When you authorize a connection, the agent may consult information and perform actions within the permissions granted. The data consulted may be received and processed by the external provider you choose, under that provider’s privacy policies.

Padmit does not use private project content to train its own artificial intelligence models. This is not a guarantee about how external providers voluntarily connected by users use data. We recommend reviewing their policies before authorizing a connection and revoking access that is no longer needed.

If you use dictation or speech recognition offered by your browser or operating system, that processing may depend on the corresponding provider and its own terms.

7. Cookies and similar technologies

Pecky may use cookies or equivalent mechanisms needed to maintain sessions, remember functional preferences, and protect accounts. Technical records help identify errors and prevent improper activity. If non-essential analytics or advertising tools requiring consent are introduced, we will explain their characteristics and provide the appropriate choices before using them.

You can configure your browser to restrict cookies; disabling strictly necessary cookies may prevent some features from working.

8. Retention, cancellation, and deletion

We retain data for as long as needed to provide the service, handle requests, meet legal obligations, and resolve potential disputes. The duration depends on the category of information and the purpose of processing.

When an owner cancels Pro, they retain the service until the end of the paid period. Their projects then become read-only for 30 calendar days, during which they may reactivate their subscription or export available information. Email notices are scheduled 7 days and 1 day before deletion. At the end of that period, projects and their content are deleted from active systems, except for data subject to applicable legal retention or blocking requirements.

In the event of non-payment, a maximum period of 21 calendar days is provided to bring payments up to date; if payment is not made, the subscription is canceled and the 30-day recovery period begins. Backups may retain data during their technical rotation cycle and are protected from ordinary use; tax, security, or dispute records are retained for the legally applicable periods.

Free accounts inactive for 24 months may be deactivated following email notice at least 30 days in advance, subject to the current operational policy and third-party rights. Account deletion may anonymize contributions to other people’s projects rather than delete them.

ZIP files generated when exporting projects expire after 24 hours; their deletion is processed through the service’s periodic cleanup.

9. Information security

We apply reasonable administrative, technical, and organizational measures to reduce the risks of unauthorized access, loss, alteration, or disclosure, including access and authentication controls, separation of permissions, and mechanisms to protect connections and storage. No internet-connected system is completely free of risk. Where a security breach must be reported under the law, we will notify affected people through appropriate means.

10. ARCO rights and procedure

Data subjects may request access, rectification, cancellation, or opposition to the processing of their personal data, as well as information about the conditions of processing.

To exercise these rights, email privacidad@padmit.com with: (a) your name and a way to receive a response; (b) a clear description of the right you wish to exercise and the data involved; (c) information that allows us to locate your account or the processing concerned; and (d) documents proving your identity or authority to represent the data subject, where necessary. We may request additional information strictly necessary to verify entitlement and prevent improper disclosure.

We will communicate our decision on the request within a maximum of 20 business days from receipt, under the applicable rules. If the request is approved, it will be fulfilled within the 15 business days following that communication. These periods may be extended where the law permits, with timely notice. Exercising these rights is free of charge, except for legally permitted reproduction or delivery costs.

Where a request concerns information controlled by a project owner, we may refer it to or coordinate its handling with that owner, without prejudice to our own obligations.

11. Withdrawal of consent and restrictions on use

You may request withdrawal of consent where legally appropriate, and restrict the use or disclosure of your data, by emailing privacidad@padmit.com and identifying the processing you wish to restrict. Withdrawal is not retroactive and may not apply to information needed to meet current legal or contractual obligations.

You can manage certain preferences and revoke extension or agent connections through the options available in your account. Emails essential to security, operations, and data deletion are not promotional communications.

12. Minors and sensitive data

Pecky is intended for people 18 years of age or older. We do not seek to deliberately collect personal data from minors. If we identify an account created by a minor without the corresponding legal authorization, we may restrict it and take appropriate protective or deletion measures.

We do not request sensitive personal data for the service’s ordinary features. If such data must be processed for a specific purpose, the measures and consents required by law will apply.

13. Changes to the Privacy Notice

We may update this notice to reflect legal or technical changes or changes in processing practices. We will publish the current version at pecky.app/privacy/, indicating its update date. If a change requires additional consent or materially affects the purposes of processing, we will communicate it through appropriate means and request consent where required.

14. Privacy contact

For questions, ARCO requests, withdrawal of consent, or reports concerning personal data:

Padmit, S.A.P.I. de C.V.
Bosque de Jacarandas 117, Portales de la Arboleda, C.P. 37100, León, Guanajuato, Mexico.
Email: privacidad@padmit.com.

We store your chosen billing region (International or Mexico) with your account. Stripe collects and stores your billing address; Pecky stores subscription identifiers and minimum pricing and discount information, not a duplicate postal address.

Confirm action

Edit peck