Last updated: October 10, 2026
1. Data controller
VICIOUSBYTE S.A. DE C.V., located at Calle Lirios #17, Col. Valle de Santa Cruz, C.P. 56120, Texcoco, Estado de México, México ("ViciousByte" or "we"), is the controller of the personal data collected through viciousbyte.com and its associated services, in accordance with Mexico's current Federal Law on the Protection of Personal Data Held by Private Parties (the "Law").
For anything related to this notice you can write to contacto@viciousbyte.com.
2. Data we collect
Contact data: name, email, phone, company and the message you send us through the contact or support form.
Account data: first name, last name, email, phone and company when you create an account. Your password is stored only as a hash.
Payment and billing data: payments are processed directly by Mercado Pago; we do not store card numbers. We may keep transaction identifiers and, if you provide them, tax data (RFC, CURP or ID) to issue invoices.
Usage data: navigation metrics (pages visited, device and browser type, language, timezone and screen resolution) collected by our own analytics and, only with your consent, by Google Analytics 4. We do not collect your geographic location.
Facebook data: Page, post and comment identifiers, comment text and the author's display name when provided by Meta. We also query statistics for the Pages we manage. Interaction records may retain the comment, response, identifiers and processing outcome to prevent duplicate replies.
WhatsApp data: when you contact our business, we may receive your number, profile name, messages and files you choose to send, plus identifiers and delivery statuses provided by WhatsApp Business. Access to those communications depends on the integration you use.
We do not request sensitive personal data (health, ethnic origin, beliefs, union membership, political opinions, biometric data or sex life) through these channels. Avoid including them in comments or messages. If a service required them, we would inform you and obtain the consent required by the Law.
3. Purposes and consent
Primary purposes (necessary for the relationship you request): (a) providing the services and subscriptions you purchase; (b) processing payments and issuing invoices; (c) handling contact and support requests; (d) sending operational communications about your account or purchases; (e) preventing fraud and protecting platform security; and (f) complying with legal and tax obligations. We obtain the applicable consent or apply statutory exceptions, depending on the data and purpose.
Secondary purposes (not necessary; they require your consent, which you may grant or refuse without affecting the service): (g) usage analytics through Google Analytics 4 and our own metrics for site improvement; and (h) promotional communications. The cookie banner lets you accept or reject analytics (see section 4). You may refuse or withdraw promotional communications by writing to our contact email.
If we intended to process your data for purposes other than those described here, we will inform you and obtain your consent again where the Law requires it. We do not sell or rent your personal data to third parties.
On Facebook we use these data to manage our Pages, publish content, query metrics and respond to comments. On WhatsApp we use them to handle communications you send us and follow up on the requested service. Promotional communications require the applicable consent, and you can ask us to stop them through our contact channels.
4. Cookies
Essential cookies (always active): authentication session (access_token, refresh_token and csrf_token, issued by our API for the viciousbyte.com domain), language preference (NEXT_LOCALE) and the record of your consent decision (vb_cookie_consent). They are required for the site to work.
Analytics cookies and storage (only with your consent): Google Analytics 4 (_ga and related) and anonymous identifiers from our own analytics. You can accept or decline them from the cookie banner; your decision is honored across the site and you can change it by clearing your browser cookies.
5. Processors and transfers
To operate our services we use Railway (hosting and infrastructure), Mercado Pago (payment processing), Google Analytics (analytics, consent-based), transactional email providers and Sentry (error monitoring). Facebook and WhatsApp integrations operate through Meta; when a communication uses Twilio, that provider participates in its transmission. Each provider receives the data needed for its function and may process data outside Mexico.
Our automated comment replies use Kungen, the AI system in the ViciousByte ecosystem. Processing may include the author's display name, comment and post context. AI can make mistakes; you can request assistance by email and object to applicable automated processing.
Beyond these cases, we do not transfer your data to third parties except under a lawful request from a competent authority.
6. Retention
We keep your data while your account is active or while needed for the purposes described, and afterwards for the periods required by applicable legal and tax obligations.
This includes social interaction and support records. You may request their deletion without necessarily closing your account. We will review which data can be deleted and which must be retained under a legal obligation. Backups may be retained temporarily under their retention cycle; handling your request must also consider their treatment.
7. Your rights (ARCO) and how to exercise them
You may at any time exercise your rights of Access, Rectification, Cancellation and Objection (ARCO), withdraw your consent, and request limitation of the use or disclosure of your data, by writing to contacto@viciousbyte.com from the email associated with your data. To process your request we may ask for proof of identity, a clear description of the data and the right you wish to exercise, and a means to deliver our response. We will respond within the timeframes set by the Law.
For Facebook or WhatsApp data, identify the channel and provide a reference that helps locate the interaction, such as a comment link or the number you used to contact us. Do not send passwords, tokens, card details or identity documents without a specific request. We will explain how to verify your identity if necessary. Data deletion instructions are linked at the end of this notice.
If you believe your data protection rights have been violated, you may turn to the Secretaría de Anticorrupción y Buen Gobierno — the authority competent in personal data protection under the 2025 Law — or to the competent federal courts.
8. Security
We apply reasonable administrative, technical and physical safeguards: encryption in transit (HTTPS/TLS), httpOnly session cookies, restricted infrastructure access and error monitoring. No system is infallible, but we continuously work to protect your information.
9. Minors
Our services are intended for people over 18. We do not knowingly collect data from minors; if we detect such records, we will delete them.
10. Changes to this notice
We may update this notice to reflect legal or operational changes. The current version will always be published on this page with its last-updated date.