Data Deletion

How to ask Castelo Tech S.A.P.I. de C.V. to delete your personal data, and what you can delete yourself

Last updated: October 22, 2026

Summary

To ask for your data to be deleted, write to contacto@castelotech.com with the subject “Personal Data Deletion Request — Castelo”. A person on Castelo’s Personal Data Protection team handles every request. You do not need to sign in.
Some things you can delete yourself: your Portfolio x-ray (Radiografía de cartera) with “Borrar mis datos” (Delete my data), the copy of a WhatsApp number by unlinking it in Castelo, and the password of a connected mailbox by disconnecting it. Today there is no button to delete an account or a whole organization: you request it by e-mail.
We will give you our answer within 20 business days at most and, if the request is granted, carry out the deletion within the following 15 business days.
We will never ask for your passwords. To handle your request we need to verify your identity, as Article 28 of the Law requires; we will tell you which documents are needed.
If you are a client of an agency or agent that uses Castelo, that agency decides about your data; if you write to us, we coordinate your request with it.
Castelo does not use Facebook Login. We cannot delete copies that exist outside Castelo, such as messages on WhatsApp or on people’s phones.

1. Summary

This page explains, step by step, how to ask Castelo Tech S.A.P.I. de C.V. (“Castelo”) to delete your personal data under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, “the Law”), what you can delete yourself within Castelo, and what happens to your data afterwards. It is a public page: you do not need an account or to sign in to make a request.

Check whether you can delete it yourself: What you can delete yourself.
If not, write to us at contacto@castelotech.com with the subject “Personal Data Deletion Request — Castelo” and say what you want deleted: How to ask us to delete data.
We verify your identity as the Law provides. We will never ask for passwords.
We answer within 20 business days at most and, if the request is granted, delete the data within the following 15 business days: Timelines.

Request deletion

Write to contacto@castelotech.com with the subject “Personal Data Deletion Request — Castelo”. If the link does not open your e-mail program, copy the address and the subject into a new message.

2. Who can request deletion

Anyone whose personal data Castelo handles can request deletion, personally or through an accredited representative:

People with a Castelo account, including team members: they can ask for their account and profile data to be deleted.
The owner of an organization: can ask for the whole organization, or part of its information, to be deleted, for example a portfolio, the WhatsApp copy of a number or the synced e-mails. Deleting an organization also deletes the data of all its members within it.
People who used the Portfolio x-ray or filled in its start form (see Portfolio x-ray).
People who wrote to Castelo, on our WhatsApp line (+52 81 1009 0177) or to contacto@castelotech.com or soporte@castelotech.com.
Clients, insured persons, prospects and contacts of an agency or agent that uses Castelo: that agency or agent decides about their data (see If you are a client of an agent who uses Castelo).

A team member can ask for their own account to be deleted. The information they recorded within the organization (for example notes, tasks, messages or documents) is part of the organization’s data, and the organization owner decides whether it is deleted.

3. What you can delete yourself

These are the options that exist in Castelo today. Anything not on this list is not available as self-service, and you need to ask us to delete it.

Portfolio x-ray. In your x-ray report, the “Borrar mis datos” (Delete my data) button deletes the x-ray, its per-policy detail, the links to the result and the report files. If the account was created only for the x-ray, belongs to no organization and has no other x-rays, it also deletes that account. It is not available while a reading is in progress.
WhatsApp. In Castelo’s WhatsApp section, “Desvincular” (Unlink) on a number logs out the session on your organization’s server, deletes that session’s profile and deletes our copy of that number’s conversations, contacts and messages (details in WhatsApp and Meta). Unlinking the device from your phone, under WhatsApp > Linked devices, ends the session but does not by itself delete that copy.
Connected e-mail. “Desconectar correo” (Disconnect e-mail) deletes the stored app password. E-mails already synced are kept until you ask us to delete them.
Insurer portal. To revoke Castelo’s access, change your password in the insurer’s portal. Archiving or “deleting” a portfolio in Castelo stops the sync but does not delete the portfolio’s information or the stored credential: to delete them, ask us.
AI analysis. The organization owner or an admin can switch off message analysis in Castelo’s AI settings, and your team can stop analyzing a specific conversation. With analysis switched off in the AI settings, Castelo stops storing the full text of new WhatsApp messages; texts already stored and Lu’s records are deleted on request.
Your browser. Castelo stores preferences, data about the campaign that brought you, and a local copy of your organization’s information in your browser. You can delete them in your browser settings by clearing this site’s data.

Today there is no button to delete an account, an organization or a team member. Those deletions are made on request, by e-mail, as explained in the next section.

4. How to ask us to delete data

4.1 What you can ask us to delete

Accounts and profiles: your Castelo account and its profile data (name, e-mail, phone, date of birth and photo) and, if you are the owner, the whole organization with its members.
Client data stored in Castelo: policies, receipts, rejected charges, renewals, insurer procedures (trámites), CRM prospects and contacts, quotes, and the technical copy of the information read from the insurer portal (sync archive).
WhatsApp data: the copy of a linked number’s conversations, contacts and messages, with their metadata (dates, read status and previews of the last message).
Files and documents: documents in the library, including those your team saved from WhatsApp, and quote PDFs.
AI records: the AI audit log, Lu’s analyses, drafts and daily digests, the tasks Lu created, and voice-note transcripts.
Integration credentials: the insurer portal username and password, the app password of the connected mailbox, and the portal session the Cotizador (quote tool) stores.
Connected e-mail: synced e-mails (sender, recipients, subject, body text and attachment details).
Operational records: sync logs, scheduled sends, sent-message records, tasks and your organization’s activity records (see Automation and Lu data).
Portfolio x-ray: the x-ray, its per-policy detail, the start form and the anti-abuse record (see Portfolio x-ray).
Communications with Castelo: messages to our WhatsApp line, e-mails to contacto@ or soporte@ and the Empresas plan contact form.
WhatsApp Business Platform test notifications associated with your phone number (see WhatsApp and Meta).

4.2 How to send your request

Send your request by e-mail

Write to contacto@castelotech.com with the subject “Personal Data Deletion Request — Castelo”. The link opens a message listing what to include. If it does not open your e-mail program, copy the address and the subject.

Preferably write from the e-mail of your Castelo account, or from the e-mail or phone number by which the organization knows you. You can write in Spanish or English. A person on Castelo’s Personal Data Protection team reads every request and replies from that same mailbox.

4.3 What to include

Your full name and how you would like to receive our answer, if not at the same e-mail you write from.
The documents proving your identity or, if you act on behalf of someone else, those proving your authority to represent them and the identity of both people (see How we verify your identity).
The e-mail of your Castelo account or, if you have no account, the phone number or e-mail by which the organization knows you (for example, the number you use to chat with your agent).
The name of the organization or agency, if you know it.
What you want deleted (for example “my account”, “the whole organization”, “the WhatsApp copy of a number”, “my x-ray”) and any detail that helps us find it.

Article 28 of the Law requires the request to contain your name and a means to receive notices; the documents proving your identity or, where applicable, the authority and identity of your representative; a clear and precise description of the data and of what you are asking for; and any other element that helps locate your data. If anything is missing, we will ask you for it.

4.4 How we verify your identity

We will never ask for passwords (for Castelo, WhatsApp, your e-mail or your insurer’s portal) or verification codes.
If you write from your account e-mail, or from the e-mail on record with the organization, we will take that into account to verify your identity; if needed, we will ask for an additional detail or document.
If you write from another address, or we cannot verify your identity with the information we hold, we will ask for documents proving it, for example a copy of an official ID. You may hide any details not needed to identify you, and we will use it only to handle your request.
If you act on behalf of someone else, we will ask for the document proving that representation and the identity of both people.

We ask only for what is proportionate to your request: we are more careful about deleting an account or a whole organization than about deleting a message you sent us. Only the owner of an organization can ask for the whole organization to be deleted.

5. What we delete and what we keep

5.1 How we handle a request

We confirm that we received your request and, where needed, verify your identity or ask you to specify which data you want deleted.
We check whether any legal obligation prevents us from deleting all or part of the data, and give you our answer.
If the request is granted, we delete the data from our active systems. When the law requires us to keep something, we first block it (bloqueo): we identify it and keep it only to determine possible liabilities, without processing it for any other purpose, until the applicable limitation period ends; then we erase it (Article 2, section III, and Article 24 of the Law).
We let you know when the deletion is done.

5.2 Automation and Lu data

Castelo’s automations and Lu, Castelo’s AI assistant, create their own records. This is how we handle them:

Record	What it contains	How it is deleted
Events that trigger automations	Detected changes (for example in receipts or insurer procedures) and messages Lu flagged for attention, which create an alert, a task or a suggestion	On request
Scheduled sends	Recipient, text and date of the WhatsApp messages your team scheduled	On request
Lu daily digests	Summary of the day with client names, policies, receipts, amounts and notes	The last 30 are kept; older ones are deleted automatically
Lu analyses and drafts	Message analyses and suggested messages before they are sent	On request
Sent-message records	What was sent, to whom, when, and its delivery status	On request
Tasks	Tasks created by your team or by Lu (for example, when it detects a promise to pay)	On request
AI audit log	Each use of the AI models in your organization	On request
Technical and error logs	Application logs in Google Cloud; they may contain IP address and e-mail	Kept for 30 days, then deleted by the provider

When you ask us to delete an account, an organization, a portfolio or a number’s WhatsApp copy, we include these records to the extent they relate to what you ask us to delete. If you want only some of them deleted (for example, those about a specific person), say so in your request.

5.3 What we keep

We will not delete, or will delete only after a blocking period, data that:

we must keep by law, for example billing and payment records required by tax laws, for the period those laws set;
is needed to perform a contract in force with you, for example while your subscription is active;
is needed to handle or defend a claim, a dispute or a request from an authority, or whose deletion would obstruct judicial or administrative proceedings related to tax obligations;
falls under any of the other cases in Article 25 of the Law.

If we refuse your request in whole or in part, we will explain why (Article 33 of the Law).

The Law requires data about the non-performance of contractual obligations to be deleted once seventy-two months have passed, counted from the calendar date on which the non-performance occurred (Article 10). When that data is part of an agency’s portfolio, the agency, as controller, is responsible for meeting that limit; Castelo deletes the data when the agency instructs it to.

Stripe, our payment processor, keeps its own payment records under its terms.

5.4 Backups and recovery windows

Castelo has no scheduled backups of its database.
Our database provider, Google Cloud, keeps earlier versions of the data for up to 1 hour; after that, deleted data can no longer be recovered from the database.
Files deleted from our file storage can be recovered for 7 days; after that they are permanently deleted.
Application technical logs are kept for 30 days. Google Cloud infrastructure audit logs are kept for 400 days.

5.5 What Castelo cannot delete

Messages and files on WhatsApp: on WhatsApp’s and Meta’s servers, on the linked phone and on the devices of the people in the conversation.
E-mails held by your e-mail provider (Gmail, Outlook or another) and in the mailboxes of their recipients.
Information in the insurers’ systems and portals, including prospect data entered in the insurer’s portal for a quote.
The records Stripe keeps of your payments, and the data we send to Anthropic so Lu can work, which are governed by their own terms and retention policies.

To delete those copies, contact each service or the person who received them.

5.6 Retention periods

This table summarizes how long we keep each type of data if you do not ask us to delete it sooner. The Privacy Policy explains each case.

Data	Period	How it is deleted
Radiografía result without a Castelo account (summary and report files)	30 days	Automatic
Per-policy detail of the Radiografía without an account (policyholder names, policy numbers, amounts and dates)	30 days	Automatic
Access account created only for the Radiografía (no organization)	Until you use “Delete my data” or ask us to delete it	On request
Radiografía linked to a Castelo account	Up to one year; its summary becomes part of your portfolio data	Automatic
Portal username and irreversible password fingerprint used in the Radiografía (abuse prevention)	30 days from the last attempt	Automatic
Radiografía start form (name, e-mail, WhatsApp and approximate number of policies)	180 days	Automatic
Single-use Radiografía access links	24 hours	Automatic
Radiografía measurement events (no personal data, with a random session id)	7 days	Automatic
Radiografía anti-abuse records	2 to 7 days	Automatic
Account, organization and portfolio data (policies, receipts, clients, CRM, documents, quotes and team chat)	While the account is active; after cancellation, until the organization owner asks us to delete it	While active
Insurer portal username and password for the daily sync	Until you ask us to delete it; archiving a portfolio stops the sync but does not delete it	On request
Technical copy of the information read from the insurer portal (sync archive)	No automatic period; until you ask us to delete it	On request
Copy of the WhatsApp conversations, contacts and messages of a linked number	Until you unlink the number in Castelo or ask us to delete it; if your plan stops including WhatsApp, the copy is kept until you ask	On disconnect
WhatsApp session and the organization’s dedicated server	The session, until you unlink the number; the server, 14 days after the plan stops including WhatsApp	On disconnect
App password of the connected mailbox	Until you disconnect the mailbox	On disconnect
E-mails synced from the connected mailbox	Until you ask us to delete them; disconnecting the mailbox does not delete them	On request
AI usage log, Lu drafts and voice-note transcripts	Until you ask us to delete them	On request
Lu daily digests	The last 30 are kept	Automatic
Test notifications from Meta’s WhatsApp Business Platform	30 days	Automatic
Messages to Castelo’s WhatsApp line, e-mails to contacto@ or soporte@ and the Empresas plan contact form	Until you ask us to delete them	On request
Application technical logs (may contain IP address and e-mail)	30 days	Provider
Infrastructure audit logs	400 days	Provider
Earlier versions of the database	Up to 1 hour after deletion	Provider
Recoverable deleted files	Up to 7 days after deletion	Provider
Payment records at Stripe	Under Stripe’s terms	Provider

6. Timelines

We distinguish three moments:

Acknowledgement. We confirm that we received your request. If we need more information, we ask for it in that same message.
Answer. We tell you our decision within 20 business days at most, counted from the date we received your request.
Deletion. If the request is granted, we carry it out within the 15 business days following the date we gave you our answer.

These periods may be extended once, for an equal period, when the circumstances of the case justify it; if that happens, we will tell you (Article 31 of the Law). Under the Law, days are business days.

After deletion, the copies held by our providers disappear within the periods given in Backups and recovery windows: up to 1 hour in the database, up to 7 days in file storage and up to 30 days in technical logs. Blocked data is erased when its legal period ends.

Handling your request is free of charge. Only the reproduction, copying or shipping costs provided for in Article 34 of the Law could be charged.

7. If you are a client of an agent who uses Castelo

If you are a client, insured person, prospect or contact of an agency or agent that uses Castelo, that agency or agent is the controller (responsable) of your data: it decides what the data is used for and whether it should be deleted. Castelo acts as processor (encargado): it processes that data on the agency’s behalf and according to its instructions.

The fastest route is to send your request directly to your agent or agency.
If you write to us, we will tell you that we are not the controller of that data, pass your request on to the relevant agency and help it handle the request within the Law’s deadlines.
When the agency tells us to delete your data, we delete it from Castelo as described on this page. If the agency decides to keep it, for example because of its own legal obligation, it is the agency that must explain this to you.
This includes data that is in Castelo because someone at the agency chatted with you on WhatsApp or by e-mail.

To pass your request on to the right agency, tell us the name of the agency or agent, if you know it, and the phone number or e-mail by which they know you.

8. WhatsApp and Meta

Castelo does not use Facebook Login or any other Meta sign-in. Castelo accounts are created with an e-mail and password or with Google. So there is no data obtained from a Facebook account to delete in Castelo.

8.2 How the WhatsApp integration works today

The WhatsApp integration is optional and available on the Pro and Empresas plans. It works as a linked device: someone in your organization scans a QR code from the WhatsApp app on their phone, just as when opening WhatsApp Web, and a server dedicated to your organization, operated by Castelo on Google Cloud, keeps that session so the number’s messages can be viewed, organized and sent from within Castelo. Each organization can link up to three numbers. This integration does not use the official WhatsApp Business Platform (Cloud API), and your WhatsApp account remains subject to WhatsApp’s terms and policies.

8.3 Unlinking a number

When someone in the organization unlinks a number in Castelo’s WhatsApp section:

the linked device’s session is logged out;
that session’s profile on the organization’s server is deleted;
the stored messages, conversations and contacts of that number are deleted from our database;
a record of the session is kept, marked as deleted; you can ask us to delete it too.

Voice-note transcripts and Lu activity related to those conversations (analyses, drafts, tasks and AI records) may remain after the number is unlinked. If you want them deleted too, ask us and we will include them.

Unlinking from the phone, under WhatsApp > Linked devices, ends the session but does not by itself delete our copy; for that, unlink the number in Castelo or ask us to delete it.

8.4 If your plan stops including WhatsApp

If the organization moves to a plan without WhatsApp, we delete its dedicated server, with its disk and stored sessions, 14 days after the change. The copy of conversations, contacts and messages in our database is not deleted with the server: it is kept until you ask us to delete it.

8.5 WhatsApp Business Platform (testing)

Castelo is testing an integration with Meta’s WhatsApp Business Platform. Today it only receives technical notifications from Meta in a test environment (for example the sender’s number, message type, delivery status and an excerpt of the text). It sends no messages and is not connected to our customers’ accounts. We use that data only to test the integration and keep it for 30 days. We will update this policy before offering the integration to customers.

If you want the notifications associated with your number deleted sooner, include your phone number in your request.

8.6 Messages to Castelo’s WhatsApp line

Castelo is the controller of the messages you send to Castelo’s WhatsApp line, +52 81 1009 0177. We use them only to assist you and delete them when you ask; WhatsApp and your phone keep their own copies.

Castelo is not affiliated with WhatsApp LLC or Meta Platforms, Inc. Castelo cannot delete messages from WhatsApp’s or Meta’s servers or from the phones of the people in the conversation; WhatsApp offers its own options for deleting messages and accounts.

9. Portfolio x-ray

The Portfolio x-ray (Radiografía de cartera) has its own retention rules:

The password you enter for the x-ray is used once, during the reading, and is not stored in any database, file or log.
To prevent repeated or abusive access, we keep your portal username and an irreversible fingerprint of the password, which cannot be turned back into the password, for 30 days from your last attempt.
If you do not create a Castelo account, the x-ray data (summary, per-policy detail and report files) is deleted automatically after 30 days. For reports generated before October 22, 2026, the per-policy detail is deleted with “Borrar mis datos” (Delete my data) or when you ask us.
An access account created only for the x-ray, with no organization, is deleted with “Borrar mis datos” (Delete my data) or when you ask us.
If you create an account, the x-ray is linked to your portfolio: the record is kept for up to one year and its summary becomes part of your portfolio data, which is deleted on request.
Start-form data (name, e-mail, WhatsApp and approximate number of policies) is kept for 180 days.
Access links are single-use and expire after 24 hours. Anti-abuse records are kept for 2 to 7 days.

To delete it yourself: open your x-ray report and use “Borrar mis datos” (Delete my data) (see What you can delete yourself). To delete the start-form data or the anti-abuse record ahead of time, write to us.

Castelo is independent software; it is not affiliated with or endorsed by Seguros Monterrey New York Life.

10. Contact and authority

Requests to delete data, and to exercise your other rights over your data, are handled by Castelo’s Personal Data Protection team at contacto@castelotech.com.

Controller: Castelo Tech S.A.P.I. de C.V.
Personal data requests (ARCO): Castelo’s Personal Data Protection team
E-mail: contacto@castelotech.com

10.1 Your ARCO rights

Besides cancellation (deletion), you have the right to access your data, to rectify it and to object to its processing, and to withdraw your consent and limit the use or disclosure of your data. You exercise them the same way, by writing to contacto@castelotech.com with the subject “ARCO rights”, with the same requirements and deadlines. The Privacy Policy explains each right.

10.2 Authority

If you disagree with our answer, or do not receive it within the legal deadline, you can file a data protection request (solicitud de protección de datos) with the Secretaría Anticorrupción y Buen Gobierno (Mexico’s Ministry of Anti-Corruption and Good Governance) within the 15 business days following the date we give you our answer or, if we did not answer, once our deadline to answer has passed (Article 40 of the Law).

Related documents: Privacy Policy and Terms of Service.

Change history

October 22, 2026: First version of this page.