Privacy Policy

Last updated: 16 May 2026

Who we are

Mexzungu Group Limited ("MGL") is an Outlaw Studio operated by Pepe Carrillo. Our website is mexzungu.com.

What data we collect

This website does not use cookies, analytics trackers, or third-party scripts that collect personal data. We do not collect, store, or process visitor data beyond standard server logs maintained by our hosting provider (Cloudflare Pages).

Newsletter subscription

If you subscribe to our newsletter, we collect your email address for the sole purpose of sending you periodic updates. The legal basis for this processing is your consent (GDPR Art. 6(1)(a)). You may unsubscribe at any time by clicking the unsubscribe link in any email or by contacting us.

Booking and contact forms

When you use the booking form on our website, we collect your name, email address, and message through our API service (api.mexzungu.com). This data is used solely to process your inquiry and respond to you. The legal basis for this processing is legitimate interest (GDPR Art. 6(1)(f)): namely, responding to your request.

Internal tools

MGL uses internal automation tools ("Janis") that access Google Workspace APIs (Gmail, Drive, Calendar, Contacts) solely for the business operations of MGL and its founder. These tools:

• Access only accounts owned and controlled by Pepe Carrillo
• Do not share, sell, or transfer any data to third parties
• Store OAuth tokens locally on secured, encrypted infrastructure in the European Union

User-facing applications and Google data access

MGL operates applications hosted on mexzungu.com and related subdomains (including panda.mexzungu.com) that allow individual users to authorise access to their Google account data via OAuth 2.0. When you authorise such an application, MGL may access and use your Google data as follows:

• Google Calendar: read and write access to your primary calendar, used solely to display your schedule within the application and to create events at your explicit request. No calendar data is shared with third parties.
• Your Google data is stored on secured, encrypted infrastructure within the European Union and retained only for as long as necessary to provide the service.
• Your Google data is never used for advertising, profiling, or sold or shared with any third party.
• You may revoke access at any time via your Google Account security settings at myaccount.google.com/permissions.

MGL's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Messaging and conversation data

When you communicate with MGL via WhatsApp or Telegram, Janis may process your messages to provide responses on behalf of MGL. This processing involves:

• Storing conversation history in a local database to maintain context across messages
• Routing messages through Anthropic's Claude AI service for response generation
• Retaining conversation data for up to 90 days, after which it is purged
• Using conversation context only within the same session or for continuity across channels

Conversation data is not used for training AI models, is not shared with third parties beyond the AI service provider (Anthropic), and is stored on infrastructure within the European Union. The legal basis for this processing is legitimate interest (GDPR Art. 6(1)(f)): namely, providing efficient client communications.

International data transfers

Anthropic, PBC (United States) acts as a data processor for AI services used by MGL. Data transfers to Anthropic are governed by Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of data protection for personal data transferred outside the European Economic Area.

Artificial intelligence

Mexzungu Group uses AI systems (Anthropic Claude) as a core part of its business operations. This includes email triage, document preparation, scheduling, financial tracking, content creation, and client communication support. Personal data that you share with us through any channel may be processed through these AI systems as part of delivering our services.

Our AI provider (Anthropic, PBC) does not use API data for model training per their commercial data policy. All AI processing is supervised by qualified professionals, and substantive communications are reviewed by Pepe Carrillo before delivery.

For full details on how we use AI, see our AI Transparency Policy.

Data retention

Conversation data: 90 days. OAuth tokens: retained while accounts are active. Server logs (Cloudflare): per Cloudflare's retention policy. We do not retain personal data longer than necessary for the purposes described above.

Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, or port your personal data, and to object to its processing. To exercise any of these rights, contact us at the address below.

Contact

For any questions about this policy: pepe@mexzungu.com