We handle your data in accordance with the LFPDPPP. We never sell your information. Here we explain clearly what we collect, why, and how we protect it.
This is an English translation provided for convenience. The Spanish version is the legally binding one and prevails in case of any discrepancy.
The party responsible for processing your personal data is:
Name: Christian López Carrillo Platform: Serenattia (serenattia.com) Privacy email: privacidad@serenattia.com City: Mexico City, Mexico
For general privacy questions: privacidad@serenattia.com To exercise ARCO rights: privacidad@serenattia.com To report security incidents: seguridad@serenattia.com
This policy was updated in April 2026 and may be modified with 15 days' prior notice by email.
In compliance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), Serenattia collects the following data:
Identity data: full name, profile photo, city and state of residence.
Contact data: email address, mobile phone number (verified by OTP).
Platform usage data: search history, bookings made, events, ratings and messages on the platform.
Client financial data: payment information processed by Stripe (PCI DSS Level 1 certified). Serenattia does not store card data directly.
Musician data (additional): INE (Mexican official ID, for identity verification), interbank CLABE or PayPal email (stored encrypted with AES-256), hourly rate, music genre, bio and audio samples.
Technical data: IP address, device type, browser, pages visited and session data (collected automatically).
We do not collect data from anyone under 18. If you are a minor, do not use this platform.
Primary purposes (required for the service): (a) Creating and managing your account. (b) Processing bookings and payments under the escrow model. (c) KYC identity verification of musicians. (d) Communication between clients and musicians. (e) Dispute mediation. (f) Compliance with legal obligations.
Secondary purposes (service improvement, you may opt out): (a) Notifications about searches in your city/genre. (b) Statistics on views and search ranking. (c) User experience improvements. (d) Fraud prevention.
To opt out of the secondary purposes, email privacidad@serenattia.com. It does not affect the core service.
Serenattia implements technical and organizational measures to protect your information:
Musicians' bank details (CLABE): encrypted with AES-256 in Supabase Vault. Only accessible by staff with an explicit payment permission assigned by the superadmin.
Clients' card data: never stored by Serenattia. Stripe processes it under PCI DSS Level 1 with TLS 1.3 encryption.
Musicians' INE: stored in Supabase Storage (a private bucket with no public access). Only verified admins can access it.
Data access: each user can only see their own data thanks to Row Level Security (RLS) in Supabase. No user can access other users' data.
Audit log: every administrative action is recorded with a timestamp, actor and IP for full traceability.
Serenattia only uses cookies that are essential for the platform to work (user session, preferences) and anonymized analytics cookies. We do not use advertising cookies or sell data to advertisers.
Essential cookies: required for authentication and security. They cannot be turned off.
Analytics cookies (anonymous): collect aggregated data about platform usage. They can be turned off in your browser settings without affecting core functionality.
We do not use third-party trackers for advertising. Your browsing data on Serenattia is not shared with ad platforms.
Serenattia only shares data with providers needed to run the platform:
Supabase (United States): database storage and authentication. It has adequate security measures in accordance with article 37 of the LFPDPPP.
Stripe (United States): payment processing. PCI DSS Level 1 certified.
Resend (United States): sending transactional emails (confirmations, notifications). It does not store personal content beyond the recipient's email.
Serenattia does NOT sell, rent or trade personal data to third parties for those third parties' own advertising purposes. Data is shared only to the extent needed to operate the service.
Under the LFPDPPP, you have the right to:
Access: know what data we hold about you and how we use it. Rectification: correct inaccurate or incomplete data. Cancellation: request deletion of your data when it is no longer needed or when you close your account. Opposition: object to the processing of your data for secondary purposes.
To exercise your ARCO rights, send an email to privacidad@serenattia.com with the subject "Derechos ARCO", including: (a) Your full name. (b) The email registered on the platform. (c) The right you wish to exercise. (d) A description of the data involved. (e) A copy of an official ID.
We will respond within 20 business days at most. Account deletion may take up to 30 days to complete the anonymization of financial data required by law.
For more information or to exercise your ARCO rights, email us at privacidad@serenattia.com. You can also read our Terms and Conditions or visit the FAQ.