ACG Mobile Privacy Policy

This Privacy Policy expressly applies to the ACG Mobile app and ATC's related web services. The taxpayer identity below identifies the service's legally responsible party and links this policy to the app.

• App name: ACG Mobile
• Android package identifier: com.acg.mobile
• Registered taxpayer and legally responsible party: Janeth Evelin Lozano Cabrera
• Mexican tax ID (RFC): LOCJ840303C10
• Company name and service operator: ATC — Asociación Tecnológica Creativa
• Official website: https://ctacx.com

ATC — Asociación Tecnológica Creativa operates ACG Mobile. Janeth Evelin Lozano Cabrera, Mexican tax ID (RFC) LOCJ840303C10, is the company's registered taxpayer and legally responsible party. Use the following institutional channels for privacy, rights, or deletion requests:

• Address: Villa Constitución 2, Lomas del Porvenir, ZIP 22535, Tijuana, Baja California, Mexico
• Privacy and support email: soporte@ctacx.com
• General email: contacto@ctacx.com
• Phone: +52 663 114 4524
• Country of operation: Mexico

The app collects only the information needed to authenticate users, perform assigned work, communicate updates, and maintain service security.

• Account data: first and last name, email address, phone number, profile photo, organization, and access role or profile.
• Operational data: campaigns, billboards, installations, incidents, forms, observations, messages, and task status.
• Location data: latitude, longitude, accuracy, speed, heading, date and time, and whether the reading occurred in the foreground or background.
• Location-sharing preference and consent date.
• Photos voluntarily selected or captured and their EXIF metadata, which may include a date and coordinates when embedded in the image.
• Push subscription identifier, device platform, and notification preferences.
• Technical and security data: IP address, access logs, app or device version, session data, and errors.

ACG Mobile requests approximate or precise location based on the device settings. Location access while the app is in use and background tracking serve different functions:

• Foreground: display the position on the map, find nearby billboards, calculate distance and routes, provide navigation, and support installation and incident records.
• Background: if you enable “Share my location” and authorize “Allow all the time,” ACG Mobile sends your position during the work shift even when the app is minimized, closed, or not in use so an authorized supervisor can coordinate installations and respond to incidents.
• Frequency: the device may send one reading when tracking starts and new readings approximately every 45 seconds while moving or every 2 minutes while still, using an approximate 75-meter distance filter.
• Visibility: only authorized staff in the customer organization may view the latest active position on the operations map.
• ACG Mobile does not use location for advertising and does not sell this data.

Location is processed only after the operating system grants the relevant permission. Work-shift tracking also requires a voluntary action in the app profile.

• Before tracking starts, the app explains what location is shared, with whom, why, and how to stop it.
• Android shows an ongoing notification and iOS shows the system indicator while background tracking is active.
• You can turn off “Share my location” in your profile or revoke permission in the phone settings.
• Turning off the switch, signing out, or ending tracking stops transmission and deletes the last stored position.
• If you deny permission, some map, proximity, navigation, or tracking features will be unavailable; other compatible features may still be used.

ACG Mobile requests permissions when they are needed and allows you to decline them when the feature is optional.

• Camera: take photos as evidence of installations, billboards, or incidents.
• Photos and files: select images to attach to installations and incidents; recent Android versions use the system photo picker.
• Notifications: receive assigned campaigns, messages, incidents, operational updates, and the ongoing active-tracking notice.
• Legacy storage: older Android versions may use this to read or save files selected by the user.
• The app does not request access to contacts or the microphone.

We use data to operate ACG Mobile and provide the functions requested by the user or their organization.

• Create, authenticate, and protect the account and its sessions.
• Display billboards, calculate routes, provide navigation, and manage field work.
• Assign and document campaigns, installations, incidents, and tasks through forms and photographic evidence.
• Show an authorized supervisor the latest position of users who voluntarily enabled tracking.
• Send messages and notifications about assignments, incidents, and service changes.
• Provide support, diagnose failures, prevent fraud or misuse, and comply with legal obligations.

Depending on the data and applicable law, processing is based on consent, performance of the service relationship, legitimate interests in platform security and continuity, and compliance with legal obligations. Access to location, camera, photos, and notifications depends on operating-system permissions.

• Background location: express consent through the in-app switch and the system permission.
• Account and operations data: delivery of the service contracted by the customer organization and management of the user relationship.
• Security and technical logs: prevention, diagnosis, and defense against unauthorized access.
• Website marketing communications: consent where required.

We do not sell personal data or share it for behavioral advertising. We disclose it only when needed to operate the functions described here:

• Customer organization and authorized supervisors: account data, assigned work, operational evidence, and the latest active location when the user enables tracking.
• Google Maps Platform: maps, geocoding, distances, and route calculations.
• OneSignal: push notifications; it may process the subscription identifier, platform, and necessary account tags used to address them.
• Cloudinary: hosting for photos and documents attached to installations, profiles, or incidents.
• Infrastructure, email, and security providers contracted to host and protect the service.
• Competent authorities when required by law or a valid request.

Google, OneSignal, Cloudinary, and other infrastructure providers may process information in countries other than the user's country, including the United States. Where applicable, we require appropriate contractual and technical safeguards under relevant data-protection law.

We retain each category only as long as needed to provide the service, perform the contract, or meet legal obligations.

• Work-shift location: only one position per user is stored. Each reading replaces the previous one; no route history is created. The latest position is deleted when the feature is disabled, tracking stops, or the user signs out.
• Live map: a position is no longer displayed as active after the configured operating period, currently 30 minutes without a new reading.
• Account and profile: while the account is active and for the time needed to process deletion, settle outstanding obligations, or comply with law.
• Campaigns, installations, incidents, messages, and photos: during the customer relationship and applicable contractual, operational, or legal periods.
• Push identifier: until sign-out, account deletion, or when no longer needed for notifications.
• Website inquiries: up to 2 years after the last contact unless deletion is requested or retention is legally required.

You may request access, correction, cancellation or erasure, objection, restriction, portability where applicable, and withdrawal of consent. You may also ask about recipients and lodge a complaint with the competent data-protection authority.

• Email soporte@ctacx.com with your name, associated account, the right you wish to exercise, and the information needed to verify your identity.
• We will respond within the period provided by applicable law; in Mexico, ARCO requests are handled under the LFPDPPP.
• Withdrawing consent does not affect processing lawfully performed before withdrawal.

You can start the account closure process from Profile > “Delete my account” in ACG Mobile. This disables the account and revokes active sessions. You may also request deletion by emailing soporte@ctacx.com from the address associated with your account.

• After a valid request, we will delete or anonymize data that is no longer needed.
• Specific records may be retained when required by law, contract, security obligations, or the defense of claims.
• Data managed by the customer organization may require coordination with that organization, which may act as an independent controller.

ACG Mobile is a professional tool for authorized personnel and is not directed to children. We do not knowingly collect children's personal data. If such a record is identified, a responsible adult may request its immediate deletion at soporte@ctacx.com.

When you visit ctacx.com or contact ATC through forms, email, phone, the CTACX chat, or channels such as WhatsApp, we may process the data you provide, the conversation content, and basic technical data to reply, deliver the service, and maintain security. Each external platform also applies its own privacy policy.

ctacx.com uses essential functions for language, navigation, and security. Google Analytics loads only when a valid property is configured; if enabled, it may collect visited pages, traffic source, device details, and contact events without form contents. You may limit cookies in your browser. We do not use Meta Pixel on this site.

We apply reasonable safeguards proportionate to the risk. No system is infallible, but our controls are designed to reduce unauthorized access, alteration, or disclosure.

• HTTPS/TLS encryption for data in transit.
• Authentication, revocable sessions, and secure on-device credential storage.
• Role-based access and organization-level visibility restrictions.
• Event logs, backups, and operational security controls.
• Location reports are discarded by the server if the user has withdrawn consent.

We may update this policy when ACG Mobile, its permissions, providers, or legal obligations change. We will publish the current version at this URL and state the update date. Material changes will be communicated through the app, email, or another appropriate channel.

For questions, rights requests, consent withdrawal, or data deletion, email soporte@ctacx.com and use “ACG Mobile Privacy” in the subject line. You may also call +52 663 114 4524. The general contact address for ATC — Asociación Tecnológica Creativa is contacto@ctacx.com.