Terms of Service

1. Parties and acceptance

These Terms of Service (the “Terms”) are an agreement between Castelo Tech S.A.P.I. de C.V. (“Castelo”, “we” or “us”) and the person or organization that uses the Castelo platform (the “Customer” or “you”). They govern access to and use of the application, the castelotech.com and castelo-ai.com sites and the related services, including the portfolio x-ray (Radiografía de cartera).

Castelo is intended for insurance professionals (agents, promotorías and agencies) who use it in the course of their professional or business activity, not for personal or household purposes.

You accept these Terms:

• by creating an account or an organization in Castelo, where these Terms and the Privacy Policy are shown to you before you sign up;
• by ticking the consent box of the portfolio x-ray, or
• by using any feature of the service after these Terms have been made available to you.

If you do not agree with these Terms, do not use the service. Merely browsing the public pages of the site does not oblige you to purchase any plan.

Eligibility. To use Castelo you must be of legal age, have legal capacity to enter into binding obligations and hold the authorizations that applicable regulation requires for your activity, for example the authorization to act as an insurance agent where applicable.

Acceptance on behalf of an organization. If you accept these Terms on behalf of an agency, promotoría or other organization, you represent that you have authority to bind it; in that case, “Customer” refers to that organization. Every person the organization invites must also comply with these Terms.

These Terms are supplemented by the Privacy Policy, which explains how we handle personal data; by the Data Deletion page; and by the conditions of each plan shown on Pricing and at checkout.

2. Definitions

In these Terms, the following words have the meaning given below:

Castelo

Castelo Tech S.A.P.I. de C.V. and the software platform it operates under the “Castelo” brand.

Customer or Organization

The agent, promotoría or agency that creates an organization in Castelo and purchases or trials a plan, including the person who accepts these Terms on its behalf.

User

Each person with access to an organization: the owner and the members the owner invites, with one of the roles described in section 4.

Owner

The User with the owner role in the organization. The owner purchases and manages billing and requests the WhatsApp integration.

Customer Data

The information that the Customer or its Users upload, connect, sync or generate in Castelo: policies, receipts, clients and prospects, contacts, WhatsApp conversations, e-mails, documents, notes, tasks and quotes, as well as the output Castelo generates from that information.

Data Subjects

The individuals to whom personal data relates (titulares); for example, the Customer’s policyholders, insured persons, beneficiaries and prospects, and the people the Customer converses with.

Integrations

The third-party services the Customer chooses to connect to Castelo, such as an insurer portal, WhatsApp, its mailbox, Google sign-in or Stripe.

Insurer portal

An insurer’s online site that Castelo accesses on the Customer’s instruction and with the Customer’s credentials; today, the portals of Seguros Monterrey New York Life (“SMNYL”).

Lu

Castelo’s AI assistant (section 10).

Radiografía

The portfolio x-ray (Radiografía de cartera) (section 11).

Plans

The Plus, Pro and Empresas plans, with the features and conditions published on Pricing and at checkout.

Premium collection follow-up (“cobranza”)

In Castelo, “cobranza” means following up on premium payments for the insurance policies of the agent’s clients (pending or upcoming receipts and declined charges) to keep their coverage in force. It does not include recovering third-party debts or buying or managing past-due portfolios.

Whenever these Terms or the service use the word “cobranza”, they use it only in the sense defined above.

3. The service

Castelo is a software platform for running insurance portfolios and automating the work of agents and agencies. Depending on your plan and your organization’s settings, it includes:

• automatic portfolio sync with the Seguros Monterrey New York Life portals, and file import for other insurers’ portfolios;
• follow-up of receipts, declined charges, renewals and trámites (insurer requests and procedures);
• a CRM for clients and prospects, tasks, a calendar and a document library;
• connected e-mail (Gmail, Outlook or other IMAP/SMTP mailboxes);
• the WhatsApp integration, on the Pro and Empresas plans (section 9);
• Lu, Castelo’s AI assistant (section 10);
• the Cotizador, which produces quotes in the insurer’s portal from the prospect data you provide (section 7);
• the portfolio x-ray, free and single-use (section 11), and
• internal chat for your organization’s team.

Debt recovery. Castelo does not buy debts or portfolios and does not offer debt-recovery services through WhatsApp. The premium follow-up features exist so that each agent can serve their own clients about their policies. Any follow-up service performed by Castelo personnel for an agency requires a separate written agreement and will also be governed by that agreement.

Sync and Cotizador. The daily sync only reads information from the insurer portal: it does not change policies or send messages through the portal. The Cotizador, by contrast, does enter in the insurer’s portal the prospect data you provide in order to produce the quote.

Evolution of the service. Features may change over time as the product evolves (section 20). Some depend on the availability of, and changes to, insurer portals and other third parties that Castelo does not control.

4. Accounts, organizations and roles

To use the application you need an account, with e-mail and password or with Google sign-in. To create an organization you must verify your e-mail address. Invitations to an organization expire after 7 days.

Each User has one of these roles: owner, admin, manager, agent or viewer. What each role can do depends on the service configuration and may change as the product evolves. Only the owner purchases and manages billing and requests the WhatsApp integration. The number of Users you can invite depends on your plan.

You are responsible for:

• keeping your credentials confidential and not sharing accounts: each person must use their own user;
• the activity that occurs in your account and in your organization;
• deciding who has access and with which role, and removing the access of anyone who should no longer have it. While member removal is not available as a self-service feature, ask for it at contacto@castelotech.com and we will handle it;
• configuring and using the service lawfully and responsibly, and
• telling us immediately at contacto@castelotech.com if you suspect unauthorized access.

5. Plans, trials, pricing and payment

• Plans. Castelo offers the Plus, Pro and Empresas plans. The features, prices and current conditions of each plan are those shown on Pricing and at checkout. Prices are in Mexican pesos (MXN) and do not include IVA (value-added tax), which is added as required by law. Plans may be paid monthly or annually. The Empresas plan is quoted individually and may also be governed by a written agreement.
• Trials. Castelo may offer trial periods through invitation codes or campaigns. People who use the portfolio x-ray can start a 14-day trial without a card. When the trial ends, paid features require a purchased plan.
• Payment. Payments are processed by Stripe, through its checkout page and its billing portal. Castelo does not receive or store your card details. Only the owner can purchase, change or cancel the plan.
• Renewal and cancellation. Subscriptions renew at the end of each period, monthly or annual, until they are cancelled. You can cancel at any time from the billing portal, with no minimum term; cancellation takes effect at the end of the period already paid, and until then you keep your plan’s features.
• Refunds. Payments are non-refundable, except where applicable law requires a refund or it is agreed in writing.
• Non-payment. If a payment is not completed, Castelo may suspend paid features after notifying you in the application.
• WhatsApp when your plan changes. If your plan stops including WhatsApp, your organization’s dedicated server is deleted 14 days later; the copy of the synced conversations is kept until you ask us to delete it (section 19).

6. Customer data and processing on the customer’s behalf

6.1 Role of each party

For the Data Subjects’ personal data contained in Customer Data, the Customer is the controller (responsable) and Castelo acts as processor (persona encargada, under the Mexican Federal Law on the Protection of Personal Data Held by Private Parties, the “Law”): Castelo processes that data on the Customer’s behalf and in accordance with the Customer’s instructions. For Users’ account data, billing data, Radiografía data and communications with us, Castelo is the controller under the Privacy Policy.

The Customer’s instructions are these Terms, the settings it chooses in Castelo (for example, which Integrations it connects and which AI features it turns on) and the requests it sends us in writing.

6.2 Castelo’s obligations as processor

Castelo undertakes to:

• process Customer Data only to provide the service to the organization that supplies it and in accordance with its instructions; not use it for its own purposes, not sell it and not share it with other organizations;
• keep it confidential and limit its staff’s access to cases where access is necessary for support, security or legal obligations;
• apply the security measures described in the Privacy Policy;
• rely only on the service providers listed in the Privacy Policy, which process the data to help us provide the service, and publish any change there;
• process the data in Mexico and in the United States, and through the providers that operate in other countries, as described in the Privacy Policy;
• help the Customer answer, within the legal deadlines, Data Subjects’ requests to exercise their rights of access, rectification, cancellation and objection (ARCO rights), and pass on to the Customer any such requests we receive directly;
• inform the Customer without undue delay of any security breach affecting Customer Data (section 15), and
• when the service ends, delete or return Customer Data when the owner asks us to, except for data we must keep under a legal obligation (section 19).

Castelo is liable for complying with these obligations and with those the law imposes directly on it as processor. It is not liable to Data Subjects for the obligations the Law assigns to the Customer as controller.

6.3 The Customer’s obligations as controller

The Customer represents and warrants that it has all the rights, permissions, notices and consents needed to provide Customer Data and to use the service in connection with its clients, insured persons, prospects and communications. In particular, the Customer must:

• have a legal basis to process each Data Subject’s data and provide its own privacy notice to them;
• obtain Data Subjects’ express consent to process their financial or patrimonial data (for example, premium amounts, bank and the last digits of a card or CLABE account), as required by Article 7 of the Law;
• obtain Data Subjects’ express written consent, through their handwritten signature, electronic signature or any authentication mechanism established for that purpose, to process sensitive personal data, such as health information in medical-expense trámites or claims, as required by Article 8 of the Law;
• handle with particular care the data of minors included as insured persons or dependants, and obtain the authorizations the law requires;
• answer its Data Subjects’ requests to exercise their ARCO rights, withdraw consent or limit the use of their data, within the deadlines of the Law;
• keep data accurate and up to date, and delete data relating to the breach of contractual obligations once seventy-two months have passed since the breach, as required by Article 10 of the Law; Castelo will delete it when the Customer instructs us to;
• comply with the confidentiality obligations imposed on it by insurance regulation and by its relationship with insurers;
• obtain the consent of the people it messages and honor their opt-out requests (section 9), and
• comply with all other laws that apply to its business, its communications, record-keeping and insurance intermediation.

If a Data Subject contacts Castelo about data that a Customer processes, we will tell them to contact that Customer and pass the request on to the Customer so it can respond.

7. Insurer portal access

When you connect a portfolio, you authorize Castelo to sign in to the insurer portal on your behalf and with your credentials in order to sync your portfolio information. You represent that the credentials are yours or that you are authorized to use them, that access takes place on your behalf and on your instruction, and that you remain responsible for complying with the portal’s terms of use and your obligations to the insurer.

Today automatic sync is available only for the Seguros Monterrey New York Life portals; other insurers’ portfolios are brought in by file import.

• What the sync does. It only reads information (policies, receipts, declined charges, contributions, policy details, trámites and renewals); it does not change policies or send messages through the portal.
• Credentials. For the daily sync we store your portal username and password in an area of our database that only Castelo’s servers can access; the application cannot read it. It is protected by Google Cloud’s encryption at rest, but has no additional application-level encryption. During the first validation, the credentials also pass through the execution history of our workflow orchestrator on Google Cloud. Details are in the Privacy Policy.
• Captchas. To sign in to the portal, Castelo sends an external captcha-solving service (2captcha) only the captcha image or, for the Cotizador, the reCAPTCHA public site key and the page address; never your credentials or your portfolio data. You are responsible for checking that this automated access is compatible with the portal’s terms and with your relationship with the insurer.
• Cotizador. When you use it, Castelo enters in the insurer’s quoting portal (SoluciOnline) the prospect data you provide (for example first name, last names, sex, date of birth, smoker status, marital status and, for some products, monthly income or spouse or minor data) in order to produce the quote, and saves the quote and its PDF in your organization’s documents. You must have the prospect’s consent to use their data for that purpose. The quote is for information only: terms, premiums and acceptance of the risk are determined by the insurer.
• Revoking access. You can revoke it at any time by changing your password in the insurer portal. Archiving or “deleting” a portfolio in Castelo stops the sync, but today it keeps the information and the credential; to erase them, ask us as explained on the Data Deletion page.
• Pauses. Castelo may pause or suspend access to a portal if the portal changes, fails or restricts access, or if we detect a security risk; in the meantime, the synced information may become out of date.

Castelo is independent software and is not affiliated with, sponsored or endorsed by Seguros Monterrey New York Life or any other insurer. Mentions of SMNYL and its portals only describe the portals the agent instructs us to access.

8. Third-party integrations

Castelo lets you connect third-party services. By enabling an Integration, you authorize Castelo to access the connected data and to process it only to the extent needed to provide the feature you requested.

• E-mail. Gmail, Outlook or other IMAP/SMTP mailboxes are connected with an app password for the mailbox, not through Google or Microsoft APIs. Castelo stores that password in an area only its servers can access, without additional application-level encryption. Castelo periodically reads the inbox and stores the headers, the full text of messages and attachment metadata, but not the attachments. Any active member of your organization can connect or disconnect the mailbox and send e-mail from it, through your own account’s mail server. Castelo does not send e-mails to your clients on its own. Disconnecting the mailbox deletes the app password; e-mails already synced are kept until you ask us to delete them.
• Google sign-in. If you use it, we receive only your basic profile from Google.
• Stripe, for payments (section 5).
• WhatsApp (section 9).
• Insurer portals, including the Cotizador (section 7).
• AI and voice. Lu uses Anthropic’s Claude models, and voice-note transcription uses Google Cloud Speech-to-Text (section 10).

Your use of third-party services remains subject to the terms, policies and technical limitations of those third parties. Castelo is not responsible for third-party outages, changes to their policies, access restrictions, suspensions or account blocks, or for other decisions of those platforms that are outside its control.

Independence. Castelo is not affiliated with, sponsored or endorsed by Seguros Monterrey New York Life, Meta Platforms, Inc., WhatsApp LLC, Google LLC, Microsoft Corporation or Anthropic, PBC. Their names and trademarks belong to their owners and are mentioned only to describe the Integrations.

9. Use of WhatsApp

9.1 How it works

The WhatsApp integration is optional and available on the Pro and Empresas plans. It works as a linked device: someone in your organization scans a QR code from the WhatsApp app on their phone, just as when opening WhatsApp Web, and a server dedicated to your organization, operated by Castelo on Google Cloud, keeps that session so the number’s messages can be viewed, organized and sent from within Castelo. Each organization can link up to three numbers. This integration does not use the official WhatsApp Business Platform (Cloud API), and your WhatsApp account remains subject to WhatsApp’s terms and policies.

You can link your WhatsApp or WhatsApp Business account. Link only numbers that belong to you or that you are authorized to use for your professional activity. When you link a number, Castelo copies the phone’s contact list, which may include personal contacts who are not clients, and syncs individual chats as described in the Privacy Policy. Castelo is not a WhatsApp or Meta provider or partner.

9.2 Risks of the integration

9.3 Your obligations

When you use WhatsApp through Castelo you must comply with the WhatsApp Terms of Service, the WhatsApp Business Terms when you use that app, and the WhatsApp Business Messaging Policy. In particular, you must:

• message only people who gave you their number and agreed to receive your messages on WhatsApp; you decide how to obtain that opt-in and you are responsible for it complying with applicable law;
• honor every request by a person not to receive your messages, whether made on or off WhatsApp (including for messages your team sends and for scheduled sends), including by removing that person from your contacts list;
• keep prompt, clear and direct ways for a contact to reach a person on your team whenever you use automation (Lu’s suggestions or automatic replies), and attend to the cases that are escalated;
• identify yourself clearly and not pretend to be the insurer, another business or another person, or mislead people about the nature of your activity;
• not request or send over WhatsApp full card numbers, bank account or CLABE numbers, official ID numbers or other sensitive identifiers, or health information;
• not forward or share with one client information from another client’s conversation, and
• write at reasonable hours and not harass, pressure or intimidate anyone.

9.4 Prohibited uses

You may not use Castelo’s messaging features, including WhatsApp, for:

• debt collection of any kind, including recovering overdue premiums on cancelled or lapsed policies and recovering past-due portfolios, your own or anyone else’s;
• payday loans, paycheck advances, peer-to-peer lending and bail bonds;
• any organization, good, service or activity that the WhatsApp Business Messaging Policy prohibits or restricts (for example firearms, alcohol and tobacco, drugs, real-money gambling and gaming, adult products and services, dating services, multi-level marketing, or real, virtual or fake currency), even if you hold licenses or authorizations for it;
• spam, unsolicited bulk messages, chain messages or messages to people who did not opt in;
• impersonating another person or business;
• scraping or harvesting data from WhatsApp or its users in an unauthorized way, including using the synced contact list to message people who are not your clients and did not opt in;
• accessing conversations or numbers without their holder’s authorization, or
• any unlawful, fraudulent or deceptive activity.

9.5 Premium reminders versus debt collection

You may use Castelo so that you, as the agent, remind your own clients that a receipt for an in-force policy is coming due or pending payment, that an automatic charge was declined or that a renewal is approaching, so that their coverage continues. This is customer service and servicing of in-force policies.

You may not use Castelo’s WhatsApp features to demand or recover amounts owed: not overdue premiums on cancelled or lapsed policies, not debts of any other kind, and not past-due portfolios. That is debt collection, and it is prohibited. This distinction is Castelo’s interpretation of the WhatsApp Business Messaging Policy; WhatsApp has not published specific criteria for insurance and could interpret its policy differently.

9.6 Sending and technical limits

Your team can send individual messages and schedule sends, which Castelo spaces 45 to 105 seconds apart. Each number has technical limits of 40 messages per minute, 2,000 messages per 24 hours and 64 KB per message. These limits protect the service; they do not mean that any given volume is acceptable to WhatsApp or to the people who receive your messages.

9.7 WhatsApp Business Platform

Castelo is testing an integration with Meta’s WhatsApp Business Platform; today it is not available to customers. If we offer it in the future, Meta’s and WhatsApp’s terms for that platform will also apply and, among other things, you will have to start conversations only with approved message templates and reply without a template only within the 24-hour customer service window, which opens and resets with each user message. We will update these Terms before offering it.

9.8 Castelo’s rights

Castelo may limit, pause or suspend WhatsApp features (for example automatic replies, scheduled sends or a linked number) when their use creates a legal, security or platform risk, including the risk that WhatsApp restricts numbers or accounts, or when that use breaches this section.

9.9 Unlinking

You can unlink a number from Castelo’s WhatsApp section: the device session is logged out, the session profile on the server is erased, and Castelo’s copy of that number’s conversations, contacts and messages is deleted. Unlinking from your phone (Linked devices) ends the session but does not by itself delete that copy. Castelo cannot delete messages from WhatsApp or from the phones of the people you conversed with.

10. AI features

10.1 What Lu does

Lu, Castelo’s AI assistant, analyzes new messages from your policyholder clients, proposes draft replies, creates tasks when it detects a payment promise, prepares a daily digest, helps write CRM notes and quote requests, and answers questions about your portfolio within the application. Lu uses Anthropic’s Claude models, which we access directly through Anthropic’s API. Voice-note transcription uses Google Cloud Speech-to-Text.

10.2 Modes and settings

Message analysis is on by default when an organization is created; the owner or an admin can turn it off at any time in the AI settings, and analysis can also be stopped for a specific conversation. Lu only analyzes new messages from contacts linked to a policy or assigned by your team and never processes earlier conversations retroactively; as context for each new message it uses the current month’s conversation history.

To reply, Lu has three modes: off; suggestions, where Lu proposes and a person decides whether to send; and automatic, where Lu sends replies within the guardrails described below. Suggestions and automatic replies are off by default. Turning them on is the Customer’s decision and responsibility; when they are turned on in the AI settings, Castelo records who accepted and when, and Users with WhatsApp access can also choose the mode for each conversation. Outside automatic mode, Lu does not send messages on its own, and it treats your clients’ text as information, not as instructions.

10.3 Automatic-mode guardrails

In automatic mode, Castelo applies these guardrails on its servers:

• it does not reply when the case was escalated to a person or there is no draft;
• it respects the pauses your team sets;
• it only replies during the configured business hours (by default, 9:00 a.m. to 8:00 p.m., Mexico City time);
• it stops replying in the conversation when the contact writes the opt-out keyword;
• it holds back for 2 hours when someone on your team has stepped into the conversation;
• it sends at most 3 automatic replies per conversation per day (default value), and
• when a case is escalated, it pauses automation for 48 hours (configurable from 1 hour to 14 days).

The fixed-text follow-ups and reminders that Lu sends go through the same checks. These guardrails are product features that reduce risk; they are not a guarantee that every reply will be correct, timely or appropriate, and they do not replace your supervision or your obligations under section 9.

10.4 Limitations

• Lu’s analyses, drafts, digests and replies may contain errors, omissions or out-of-date information. Review its output before using it and before making any consequential decision about a client. You are responsible for the communications, decisions and actions you take based on it.
• Lu does not decide the purchase, coverage, underwriting, price or eligibility of any insurance or credit, and does not adjudicate claims. Do not use its output as the sole basis for those decisions.
• Lu is a support feature for servicing your policies and clients. It is not a general-purpose AI assistant and must not be offered as one to your WhatsApp contacts.
• AI use is subject to monthly per-organization limits and overall platform limits; when they are reached, AI features may be temporarily unavailable.
• Every model call is recorded in your organization’s AI usage log, which owners and admins can view.
• Under Anthropic’s commercial terms in effect on the date of these Terms, Anthropic does not use content it receives through its API to train its models. Castelo does not train or fine-tune AI models with your data or your clients’ data.

Before turning Lu on for your clients’ conversations, make sure your privacy notice informs them of this use.

11. Portfolio x-ray

The portfolio x-ray (Radiografía de cartera) is a free, single-use service available at castelotech.com/radiografia only from Mexico and the United States, through which, on the express instruction and with the consent of the insurance agent, Castelo enters the Seguros Monterrey New York Life advisor portal ONCE with the credentials the agent provides, to read only their pending receipts for traditional policies (in two three-month windows around the current month) and the associated declined charges, and present a summary and a per-policy detail.

By using the x-ray you declare that the credentials are yours or that you are authorized to use them, that the access is performed on your behalf and under your instruction, and that you are responsible for complying with the insurer portal’s terms of use. For your clients’ data read from the portal, Castelo acts as a processor on the agent’s instruction; for your own data as the person using the x-ray (e-mail, campaign data and anti-abuse records), Castelo is the controller under the Privacy Policy.

• The password is used exclusively during that read and is not stored in any database, file or log.
• To prevent repeated or abusive access, we keep your portal username and an irreversible fingerprint of the password, which cannot be turned back into the password, for 30 days from your last attempt.
• If you do not create a Castelo account, the x-ray results (the read record, the per-policy detail and the report files) are deleted after 30 days. For reports generated before this version of the Terms was published, the per-policy detail is deleted when you use “Borrar mis datos” (Delete my data) or ask us to delete it.
• An access account created only for the x-ray, with no organization, is deleted when you use “Borrar mis datos” (Delete my data) or ask us to delete it.
• If you create an account, the x-ray is linked to your portfolio: the record is kept for up to one year and its summary becomes part of your portfolio data.
• The result is informational: it is computed from what the portal shows at read time and may differ from your records or from a later sync.
• Access links are single-use and expire after 24 hours.
• You can delete the x-ray at any time with the “Borrar mis datos” (Delete my data) button on the report, except while a read is in progress. The button deletes the read, its detail, the report links and files and, if the account was created only for the x-ray and has no organization and no other reads, that account as well.
• Anyone who uses the x-ray can start a 14-day Castelo trial without a card.

To use the x-ray you must accept these Terms and the Privacy Policy in the form’s consent box; the box to receive news from Castelo is optional.

Castelo is independent software and is not affiliated with, sponsored or endorsed by Seguros Monterrey New York Life. Mentions of SMNYL only describe the portal the agent instructs us to access. Castelo may pause or suspend the x-ray at any time, without notice, for technical, security or portal-availability reasons.

12. Acceptable use and restrictions

You may not:

• use the service unlawfully or for fraudulent purposes;
• interfere with or disrupt the service, or overload its infrastructure;
• attempt unauthorized access to Castelo, to other organizations or to third-party systems;
• misrepresent your identity or your affiliation with any third party, including an insurer;
• use the service in breach of applicable third-party platform rules or of the rights of your clients or other Data Subjects;
• reverse engineer, decompile or misuse the platform, except to the extent applicable law allows;
• extract data from Castelo with automated (scraping) or unauthorized tools, outside the features the service itself provides;
• share accounts or credentials, or resell the service or give third parties access to it without Castelo’s written authorization;
• upload or connect data you have no rights to, or without the required notices and consents;
• circumvent usage, plan, sending or AI limits, or security measures;
• run security, vulnerability or load tests without written permission; if you find a vulnerability, report it to contacto@castelotech.com with the subject “Seguridad” (Security);
• use Lu or other features to generate unlawful, misleading, discriminatory or harassing content;
• use data obtained from WhatsApp to decide a person’s eligibility for insurance, credit, employment or housing, or to conduct surveillance of people;
• discriminate against people based on their personal characteristics, or
• engage in any of the prohibited uses in section 9.

Castelo may review uses that reasonably appear to breach this section and take the measures in section 19.

13. Intellectual property

Castelo and its licensors retain all rights, title and interest in the Castelo platform, including the software, interfaces, Castelo’s own content, trademarks and related intellectual property. These Terms give you a limited, non-exclusive, non-transferable and revocable right to use the service while your plan or trial is in effect and in accordance with these Terms. No other right is transferred to you.

Customer Data remains the property of the Customer or its rightful holder, including the drafts, digests and other output Castelo generates from it. The Customer grants Castelo only the authorization needed to host, copy, process and display it in order to provide the service under these Terms.

Neither the Customer nor Castelo acquires any rights over Data Subjects’ personal data by processing it in Castelo: Data Subjects keep their rights over that data, including their ARCO rights.

If you send us comments or suggestions about Castelo, we may use them to improve the service without any obligation to compensate you; this gives us no right over Customer Data. Third-party trademarks mentioned in the service belong to their respective owners.

14. Confidentiality

Each party will keep confidential the non-public information it receives from the other in connection with the service and will use it only to perform these Terms. For Castelo, this includes Customer Data and the credentials you entrust to it; for the Customer, non-public information about how Castelo works and how it is secured.

This obligation does not apply to information that becomes public through no fault of the recipient, that the recipient already lawfully knew, that it receives from a third party with no duty of confidentiality, or that it develops independently. Either party may disclose information when a law or a competent authority requires it; in that case, where the law allows, it will notify the other party.

Authorized Castelo staff access Customer Data only when necessary for support, security or legal obligations. This confidentiality obligation survives the end of the service.

15. Security and incidents

Castelo applies reasonable security measures, described in the Privacy Policy, including: HTTPS connections, encryption at rest managed by Google Cloud, access rules by organization and role, server-only areas for credentials, secrets kept in a managed vault, abuse checks and usage limits. No system is infallible, and Castelo does not guarantee that the service will be free from breaches.

You remain responsible for protecting your credentials and your devices (including the phone you use to link WhatsApp), for your internal access practices and for lawful use of the service.

If you detect an incident or a vulnerability, report it immediately to contacto@castelotech.com with the subject “Seguridad” (Security). If a security breach affecting Customer Data occurs, Castelo will inform the Customer without undue delay, with the information available, so that it can take action and, where applicable, meet its obligation to inform the affected Data Subjects immediately under Article 19 of the Law.

16. Disclaimer of warranties

The service is provided “as is” and “as available”, to the fullest extent permitted by law. Castelo disclaims implied warranties, except to the extent applicable law does not allow them to be excluded.

In particular, Castelo does not guarantee:

• the availability, continuity or accuracy of the insurer portals or of the information they show;
• the accuracy, completeness or fitness of the output of Lu or any AI feature;
• the continuity of the WhatsApp integration, or that WhatsApp will not limit, suspend or ban a number;
• that the service will run without interruptions or errors, or that it will meet particular requirements not set out in these Terms, or
• business results, such as premium payments, renewals or sales.

Nothing in this section limits the obligations Castelo expressly assumes in these Terms or those the law does not allow to be excluded.

17. Limitation of liability

To the fullest extent permitted by law, Castelo will not be liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for loss of profits, revenue, goodwill, data or business opportunities, arising out of or related to the use of the service.

Nor will Castelo be liable for damages arising from:

• misuse of the service by the Customer or its Users;
• inaccurate or unauthorized data that Users upload or connect;
• failures of third-party services, including insurer portals;
• restrictions, suspensions or bans of numbers or accounts by WhatsApp, by insurers or by other third parties;
• the content of the messages the Customer decides to send, schedule or automate;
• connectivity problems;
• external attacks or events beyond its reasonable control, or
• a User’s reliance on AI-generated content without appropriate review.

To the fullest extent permitted by law, Castelo’s total liability to the Customer for any claim related to the service will not exceed the amount of the fees actually paid by the Customer to Castelo for the service during the 12 months before the event giving rise to the claim.

The limitations in this section do not apply to damages caused by Castelo’s wilful misconduct (dolo) or bad faith (mala fe), or to obligations that under the law cannot be limited or waived, and they do not limit the rights the law grants to Data Subjects.

18. Indemnification

The Customer will hold Castelo harmless and indemnify it for the damages, losses and reasonable expenses, including attorneys’ fees, that it incurs as a result of claims by third parties or authorities arising from:

• data the Customer or its Users uploaded or connected without the right to do so or without the required notices and consents;
• messages sent in breach of the law, of section 9 or of WhatsApp’s policies, including messages sent without opt-in or after an opt-out request;
• the use of portal credentials without authorization or in breach of the insurer’s terms, or
• any other material breach of these Terms by the Customer or its Users.

Castelo will notify the Customer of the claim promptly, allow it to take part in the defense and not accept a settlement at the Customer’s expense without its consent. This obligation does not apply to the extent the damage results from a breach by Castelo.

19. Suspension, termination and effects

Castelo may suspend or terminate access to the service, in whole or in part, if:

• these Terms are breached;
• the use presents a security, legal or operational risk to Castelo, to other customers or to third parties;
• the use of WhatsApp creates a risk to the platform, to other customers or to their numbers, or breaches section 9 or WhatsApp’s policies;
• the law, an authority or third-party platform requirements so require, or
• there are overdue payments, after the in-app notice described in section 5.

Where reasonable, Castelo will limit the suspension to the affected feature (for example automatic replies or a linked number). It may act without prior notice when there is an urgent risk.

You may stop using the service and cancel your plan at any time, in accordance with section 5.

Effects of cancellation or termination:

• when the paid period ends, access to paid features ends;
• if your plan stops including WhatsApp, your organization’s dedicated server is deleted 14 days later; the copy of the synced conversations is kept until you ask us to delete it;
• unlinking a number in Castelo erases the session and the copy of its conversations, contacts and messages; disconnecting the mailbox deletes only the app password; and archiving a portfolio stops the sync but keeps the information and the credential;
• after cancellation, we keep your account and organization data until the owner asks us to delete it; after deleting it, we will keep it only in blocked form (bloqueo) for as long as our legal obligations require;
• the owner can ask for a copy of the Customer Data or for its deletion by writing to contacto@castelotech.com, as explained on the Data Deletion page; today, deleting an account or an organization is done on request, and
• the sections that by their nature must survive (including those on Customer Data, intellectual property, confidentiality, limitation of liability, indemnification and governing law) will remain in effect after termination.

20. Changes to the service and these terms

Castelo may add, change or withdraw features as the product evolves or when changes by insurer portals, WhatsApp or other third parties, or changes in the law, require it.

We may amend these Terms. We will publish the new version on this page with its update date and record it in the change history. Changes take effect on publication, unless the publication states a later date. If you keep using the service after that date, you accept the new version; if you do not agree, you may stop using it and cancel your plan in accordance with section 5.

21. Governing law, jurisdiction and language

These Terms are governed by the laws of the United Mexican States, without regard to their conflict-of-laws principles.

For the interpretation and performance of these Terms, the parties submit to the courts with jurisdiction under Mexican law.

Nothing in these Terms limits the non-waivable rights granted to you by applicable law, including, where applicable, the Mexican Federal Consumer Protection Law (Ley Federal de Protección al Consumidor).

These Terms are published in Spanish and in English. The Spanish version prevails over any translation.

22. General provisions

• Entire agreement. These Terms, the Privacy Policy, the plan conditions shown at checkout and, where applicable, any written agreement signed with Castelo make up the entire agreement between the parties about the service. If a written agreement conflicts with these Terms, that agreement prevails for the matters it governs.
• Severability. If any provision is held invalid or unenforceable, the others remain in effect and the affected provision will be applied to the fullest extent permitted.
• Assignment. The Customer may not assign these Terms without Castelo’s written consent. Castelo may assign them to whoever succeeds it in operating the service, without affecting the Customer’s rights.
• Force majeure. Neither party will be liable for failures caused by events beyond its reasonable control, such as general internet or provider outages, natural disasters or acts of authority.
• No waiver. A party’s failure to exercise a right does not mean it waives that right.
• Relationship of the parties. The parties are independent. These Terms do not create a partnership, an employment relationship or an insurance agency or intermediation relationship between them.
• Notices. Legal notices to Castelo must be sent in writing to contacto@castelotech.com. Castelo may give you notices about your account within the application and will publish notices about these Terms on this page; replies to your requests are sent by a person on our team from contacto@castelotech.com.

23. Contact

For legal matters or questions about these Terms, write to us at contacto@castelotech.com; a person on our team will reply. For technical support, write to soporte@castelotech.com. For general questions you can also message Castelo’s WhatsApp line, +52 81 1009 0177.

Controller

Castelo Tech S.A.P.I. de C.V.

Personal data requests (ARCO)

Castelo’s Personal Data Protection team

E-mail

contacto@castelotech.com

See also the Privacy Policy and the Data Deletion page.

Change history

• October 22, 2026: Full new version: definition of cobranza (premium collection follow-up), what Castelo is not, controller and processor roles, insurer portal access, use of WhatsApp and prohibited uses, AI features, plans and payment, limitation of liability, English version and precedence of the Spanish text.
• September 15, 2026: Portfolio x-ray section added (the update date was not changed at the time).
• April 12, 2026: First version.