Privacy Policy

---

Last Updated: June 25, 2026

Welcome to Mextalki. Protecting your privacy and personal information is important to us. This Privacy Policy explains how Diego Iván Méndez, doing business as Mextalki, collects, uses, stores, shares, and protects your personal information when you use:

• the Mextalki website (www.mextalki.com);
• the Mextalki mobile applications (iOS and Android); and
• any related products and services provided by Mextalki, including subscriptions, language courses, podcasts, one-on-one lessons, Conversation Club sessions, and other educational services (collectively, the "Services").

By creating an account, accessing, or using our Services, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are

Data Controller. For the purposes of applicable data protection laws, Diego Iván Méndez, doing business as Mextalki, is the data controller responsible for determining how and why your personal information is processed.

Mextalki is operated by Diego Iván Méndez, a business registered in Mexico.

Business Address:
Copenhague 6
Juárez, Cuauhtémoc
06600 Ciudad de México
CDMX, México

Privacy Contact Email:
admin@mextalki.com

If you have any questions regarding this Privacy Policy or wish to exercise your privacy rights, you may contact us using the email address above.

2. Scope of this Privacy Policy

This Privacy Policy applies to all users of the Services, regardless of whether they access Mextalki through our website or mobile applications.

It governs the collection, use, storage, disclosure, and protection of personal information collected through:

• our website;
• our mobile applications;
• customer support communications;
• lesson bookings;
• subscription management;
• educational content;
• podcasts and learning tools; and
• any other interactions with Mextalki.

This Privacy Policy does not apply to third-party websites, services, or applications that are operated independently of Mextalki, even if they are linked from our Services. Those services are governed by their own privacy policies.

3. Information We Collect

The information we collect depends on how you use our Services.

Information You Provide. When you create an account, purchase a product, schedule a lesson, or communicate with us, we may collect:

• full name;
• email address;
• username;
• profile picture;
• password (encrypted);
• messages sent to our support team;
• lesson bookings; and
• payment-related information necessary to complete purchases (payment processing itself is handled by our payment providers).

Learning Information. To provide and improve your learning experience, we collect:

• course progress;
• completed lessons;
• podcast progress;
• quiz scores;
• saved vocabulary;
• learning preferences;
• Conversation Club participation history; and
• one-on-one lesson history.

Subscription Information. We collect information relating to your subscription and purchases, including:

• current subscription plan;
• subscription status;
• renewal status;
• purchase history;
• transaction identifiers; and
• billing platform used (Apple, Stripe, or PayPal, as applicable).

Information Collected Automatically. When you use the Services, we may automatically collect certain technical information, including:

• IP address;
• browser type;
• device type;
• operating system;
• language settings;
• date and time of access;
• pages or screens visited;
• session information;
• cookie identifiers; and
• diagnostic information necessary to maintain the security and operation of our Services.

4. How We Use Your Information

We use your personal information only for legitimate business purposes and to provide, improve, secure, and operate the Services.

Specifically, we use your information to:

• create and manage your Mextalki account;
• authenticate your identity and allow you to securely sign in;
• provide access to courses, podcasts, lessons, and other educational content;
• track your learning progress and personalize your educational experience;
• schedule and manage one-on-one lessons and Conversation Club sessions;
• process purchases, subscriptions, and payments;
• communicate with you regarding your account, purchases, bookings, and customer support requests;
• send newsletters, onboarding emails, product updates, promotional offers, and other marketing communications where permitted by applicable law;
• analyze how our Services are used in order to improve performance and user experience;
• detect, investigate, and prevent fraud, unauthorized access, abuse, and security incidents;
• comply with applicable legal obligations; and
• enforce our Terms and Conditions and protect our legal rights.

We do not sell your personal information to third parties.

5. Legal Basis for Processing Personal Information (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with similar privacy laws, we process your personal information only when we have a valid legal basis to do so.

Depending on the circumstances, our legal basis includes:

Performance of a Contract. When processing is necessary to provide the Services you requested, including creating your account, providing subscriptions, delivering courses and lessons, processing payments, managing bookings, and providing customer support.

Legitimate Interests. Where processing is necessary for our legitimate interests, provided those interests do not override your privacy rights. These interests include improving our Services, preventing fraud, maintaining platform security, understanding user behavior through Google Analytics, developing new features, and responding to customer inquiries.

Consent. Where required by law, we rely on your consent before sending certain marketing communications, using optional cookies, or processing information where consent is legally required. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Legal Obligations. We may process personal information where necessary to comply with legal obligations, including tax, accounting, regulatory, and law enforcement requirements.

6. Third-Party Service Providers

To provide our Services, we work with trusted third-party service providers. We share only the information necessary for them to perform their services on our behalf.

We require these providers to maintain appropriate safeguards and to protect personal information in accordance with applicable privacy laws.

Our current service providers include:

Firebase Authentication (Google): used to create and authenticate user accounts. Information processed may include email address, user identifier, and authentication credentials.

Google Sign-In: allows users to securely sign in using their Google account. Information processed may include Google account identifier, name, email address, and profile picture.

Apple Sign-In: allows users to securely sign in using their Apple ID. Information processed may include Apple user identifier, email address (including Apple's private relay email where applicable), and name if provided by Apple.

RevenueCat: used to manage subscriptions across supported platforms. Information processed may include subscription status, purchase identifiers, anonymous device identifiers, and subscription expiration and renewal information. RevenueCat does not process your payment card information.

Apple In-App Purchase: for subscriptions purchased through the iOS application, payment processing is performed entirely by Apple. Mextalki does not receive or store your payment card details for Apple In-App Purchases.

Stripe: processes payments for purchases made through our website and for eligible one-time purchases, such as lessons and Conversation Club credits. Information processed may include payment information, billing information, and transaction details. Stripe is not used to process subscriptions purchased through the iOS application.

PayPal: processes payments for purchases made through our website and for eligible one-time purchases, such as lessons and Conversation Club credits. PayPal is not used to process subscriptions purchased through the iOS application.

Calendly: used to schedule one-on-one lessons and other appointments. Information processed may include name, email address, and selected appointment times.

YouTube: some educational videos within the Services are embedded using YouTube. When viewing embedded YouTube content, Google may collect technical information such as your IP address and device information in accordance with Google's Privacy Policy.

Google Analytics: we use Google Analytics to better understand how users interact with our website and Services. Google Analytics may collect pages visited, session duration, device information, browser information, general geographic region, referring pages, and usage statistics. This helps us improve performance, usability, and reliability.

We do not authorize these service providers to use your personal information for their own marketing purposes.

7. Information Sharing

We do not sell, rent, or trade your personal information.

We may share personal information only in the following circumstances:

• with the service providers described in this Privacy Policy;
• when necessary to complete a transaction you requested;
• to comply with legal obligations or lawful government requests;
• to protect the rights, property, safety, or security of Mextalki, our users, or others; and
• in connection with a merger, acquisition, restructuring, or sale of assets, where permitted by applicable law.

We will never share your personal information with advertisers for personalized advertising purposes.

8. Cookies and Similar Technologies

Mextalki uses cookies and similar technologies to operate, secure, and improve our Services.

Cookies are small text files stored on your device that help us recognize your browser, remember your preferences, and improve your experience.

We use cookies for the following purposes:

Essential Cookies. These cookies are necessary for the operation of our Services and cannot be disabled. They are used to authenticate users after signing in, maintain secure login sessions, protect user accounts against unauthorized access, remember essential security settings, and enable core functionality of the website.

Preference Cookies. These cookies help remember your preferences, including language settings, login preferences, display preferences, and other settings that improve your user experience.

Analytics Cookies. We use analytics cookies through Google Analytics to understand how visitors use our Services, identify technical issues, and improve the user experience. These cookies do not identify you personally but help us analyze aggregated usage patterns.

You may configure your browser to refuse certain cookies or notify you when cookies are being placed. Please note that disabling essential cookies may affect the functionality of the Services.

9. Google Analytics (Website Only)

We use Google Analytics exclusively on our website to analyze aggregate visitor metrics. Google Analytics tracking is not embedded inside our mobile application.

Google Analytics helps us analyze trends such as which pages are visited most frequently, how users navigate through the Services, which features are most popular, technical performance, and overall usage statistics.

Google Analytics collects information using cookies and similar technologies. This information may include your IP address, browser type, device information, operating system, approximate geographic location, and interactions with our Services.

Google Analytics reports are used only in aggregate form to improve our Services and are not used to identify individual users.

For more information about how Google processes information, please visit Google's Privacy Policy.

10. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy or as required by applicable law.

In general:

• active account information is retained while your account remains active;
• learning progress and educational history are retained while your account remains active to provide continuity of your learning experience;
• inactive accounts may be retained indefinitely unless the user requests deletion;
• purchase records, invoices, and accounting information may be retained indefinitely or for the period required by applicable tax, accounting, or legal obligations; and
• marketing preferences are retained until you unsubscribe or request deletion.

When personal information is no longer required, we will securely delete or anonymize it where reasonably possible.

11. Account Deletion

You may permanently delete your Mextalki account at any time directly within the application by navigating to:

Profile → Delete Account

Once your deletion request is confirmed:

• your account is permanently deleted;
• your personal information is removed from our active systems without undue delay;
• your learning progress, saved vocabulary, profile information, and other associated personal data are permanently erased; and
• your account cannot be restored.

Certain transaction records or invoices may be retained where required to comply with legal, accounting, or tax obligations.

12. International Data Transfers

Because Mextalki serves users around the world, your personal information may be processed or stored in countries other than your country of residence.

By using our Services, you acknowledge that your information may be transferred internationally where necessary to operate the Services.

When personal information is transferred internationally, we take reasonable measures to ensure that it remains protected in accordance with applicable privacy laws.

13. Data Security

We implement appropriate technical, administrative, and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction. These measures are designed to reflect the sensitivity of the personal information we process and the risks associated with its processing.

Examples include encrypted authentication credentials, secure HTTPS connections, access controls, secure cloud infrastructure, payment processing through trusted providers, and ongoing monitoring of our systems for security vulnerabilities.

While we strive to protect your personal information, no method of electronic storage or transmission over the Internet is completely secure. Therefore, we cannot guarantee absolute security.

14. Your Privacy Rights

Depending on your country of residence, you may have certain rights regarding your personal information under applicable privacy laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable legislation.

These rights may include:

• Right of Access: request confirmation of whether we process your personal information and obtain a copy of the personal information we hold about you.
• Right to Rectification: request correction of inaccurate or incomplete personal information.
• Right to Erasure: request deletion of your personal information, subject to legal exceptions.
• Right to Restrict Processing: request temporary restriction of processing under certain circumstances.
• Right to Object: object to processing where permitted by law.
• Right to Data Portability: request a machine-readable copy of your personal information where applicable.
• Right to Withdraw Consent: withdraw consent where processing is based on consent.

Marketing Communications. You may unsubscribe from promotional emails at any time by clicking the unsubscribe link in our emails or by contacting us directly. We may still send service-related emails such as account notifications, purchase confirmations, security alerts, and updates necessary to provide the Services.

Exercising Your Rights. To exercise any privacy rights described above, contact us at admin@mextalki.com. We will respond to eligible requests within the timeframes required by applicable law.

15. California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and other applicable California privacy laws.

Subject to applicable law, California residents may request information regarding:

• the categories of personal information we collect;
• the purposes for which personal information is collected;
• the categories of third parties with whom personal information is shared;
• the specific pieces of personal information we maintain about them; and
• the deletion or correction of personal information where applicable.

Mextalki does not sell or share personal information for cross-context behavioral advertising.

We do not knowingly collect sensitive personal information for purposes requiring a separate right to limit its use under applicable California law.

16. Children's Privacy

Our Services are intended for adults or individuals who use them under the supervision and responsibility of a parent or legal guardian where permitted by applicable law.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, applicable laws, or business practices.

When we make material changes, we will update the Last Updated date at the beginning of this Privacy Policy.

Where required by applicable law, we will provide additional notice of significant changes.

Your continued use of the Services after any changes become effective constitutes acceptance of the updated Privacy Policy.

18. Contact Us

If you have any questions about this Privacy Policy or how we process your personal information, please contact:

Diego Iván Méndez (doing business as Mextalki)
Copenhague 6
Juárez, Cuauhtémoc
06600 Ciudad de México
CDMX, México
Email: admin@mextalki.com

This Privacy Policy forms part of the Terms and Conditions governing your use of Mextalki's Services. If there is any inconsistency between this Privacy Policy and applicable law, applicable law shall prevail.