Legal
Client Data: how we handle your business information
Effective: November 12, 2026
In short
- Your business information is confidential. We use it only for the work you hired us to do.
- We ask for only what's needed, ideally exports without your customers' personal information.
- Only Jose and his work team have access, under confidentiality.
- We use AI only if you authorize it, always with human review.
- We delete your data 12 months after the work ends, or sooner if you ask.
- Your numbers appear in a case study only with your written permission, and only as percentages.
F.1 What this covers
This section covers information a client gives us for the Blind Spot Session, the Blind Spot Diagnostic or any other service: sales, costs, inventory, aggregated payroll, processes, reports, system access, and so on. Before a Diagnostic, we send you a data processing and confidentiality agreement that sets out these commitments in detail. If we sign a contract, the contract prevails.
F.2 Roles
For personal information about your customers, employees or suppliers that appears in what you give us, your business is the controller and Jostrive acts as the processor ("service provider" under US state laws; "operador" or "encargado" in Latin America). We process it only on your instructions.
F.3 Confidentiality, purpose and minimization
- We use your information only for the agreed work. Never for other clients, and never to sell it.
- We ask for only what's needed. Whenever possible, we request exports without your end customers' personal information (no names, phone numbers or emails), or with that information anonymized.
- If we receive personal information we don't need, we delete it or return it to you.
F.4 Where it's stored
In Google Workspace (Drive), with encryption and two-step verification. Never on unencrypted devices or shared personal accounts. Providers are listed in §A.5.
F.5 Who has access
Jose and his work team: only those who need it for your project, under a written confidentiality commitment. If you give us access to shared tools, we close that access when the work ends.
F.6 Use of AI
We use AI tools with your data only if you authorize it in the agreement (you can choose "yes", "yes, with anonymized data only" or "no"). Always with human review and no model training (§B).
F.7 How long we keep it
- We delete your data 12 months after the work ends, unless we agree on a different period in writing.
- We keep only the deliverables (reports, manuals, dashboards), aggregated results that don't identify anyone, and the invoices tax law requires.
- Deletion on request: if you ask sooner, we delete or return your data within 30 days and confirm in writing that it's done.
F.8 Case studies
We publish a case study only with your written permission. We show percentages only: never absolute figures, personal information or sensitive business information. You can withdraw permission for future publications.
F.9 Incidents
If a security incident affects your data, we'll tell you without undue delay and no later than 72 hours after we become aware of it, with what we know at that point, and we'll help you meet your own notification obligations.