Privacy Notice

Last updated: 2026-09-12 Version: 1

The Spanish text governs. This is a faithful translation of

`aviso-de-privacidad.es.md`, provided for

convenience. Telesia's controller is a Mexican company and the processing is

governed by Mexican law, so where the two versions differ, **the Spanish

version prevails**.

Counsel review pending. This document was drafted internally and **has not

been reviewed by a lawyer**. The standing rule in this repository is that any

statement with legal effect needs counsel review before it is published as

final. The text accurately describes the processing Telesia performs today;

its formal sufficiency under Mexican law is yet to be confirmed.

Service status. Telesia is in a closed, invitation-only beta. As of

this notice's date there is no user account and no user's personal data has

ever been processed. This notice describes the processing that will take place

once the programme starts.

1. Who is responsible, and where

Innovaciones MADFAM, S.A.S. de C.V. ("MADFAM"), with its address in Cuernavaca, Morelos, Mexico, is the responsable — the controller — for the personal data collected through Telesia (telesia.quest) and its subdomains.

For anything relating to this notice or to the exercise of rights: [email protected].

Telesia is a MADFAM product. The brand a user sees is Telesia; the party legally responsible for the processing is MADFAM.

2. What personal data is processed

Telesia collects only what it needs to provide the service. No sensitive personal data is collected — meaning data whose misuse could lead to discrimination or entail a serious risk to the person it concerns. No financial or payment information is requested or stored: billing, when it exists, belongs to another platform in the MADFAM ecosystem, and Telesia keeps no record of subscriptions, invoices, or payment methods.

2.1 Identity and contact data

• Email address and identity data from Janua, MADFAM's identity provider.

Telesia does not manage passwords: sign-in happens at Janua, and Telesia receives only the already-verified identity and the account identifier.

• The email address of a person invited to the beta programme. During the

beta, the list of admitted people is maintained in a system configuration file. This means the address remains in the version history of MADFAM's internal repository even after that person leaves the programme: removing it stops the processing, but does not erase the historical configuration record. This is stated expressly, for transparency, and the mechanism will be replaced as the programme grows.

2.2 Linked third-party account data

When a user chooses to link a gaming-platform account:

• That account's public identifier (for example, a Steam id).
• The game library and playtime that platform exposes for that account.
• Where applicable, the access credential the platform itself issues, which

is stored encrypted and used solely to read that same account's data from the platform that issued it.

Linking is always voluntary and always revocable. Telesia does not query, crawl, or collect information from accounts that their owner has not linked, even where the corresponding profile is publicly readable.

2.3 Waitlist data

Anyone who signs up to the waitlist from the public site provides:

• An email address.
• A language preference.
• The gaming platforms they are interested in.

This data is collected for one purpose: to tell that person when Telesia opens. It is not consent to receive marketing about other MADFAM products.

2.4 Technical data

Technical records generated automatically by running the service: IP address, browser or client type, timestamps, requested paths, and application errors. They are used to operate, diagnose, and secure the service.

3. Purposes of the processing

3.1 Primary purposes

These are necessary for the relationship with the user to exist and be performed. Without them the service cannot be provided:

1. Create and maintain the account and allow authenticated access through

Janua.

1. Keep the progress record: quests, their status, playtime, achievements,

and the imported library.

1. Import and keep up to date the library of the third-party accounts the

user has linked, and only those.

1. Administer admission to the beta programme during the invitation phase.
2. Send email about account matters, progress milestones, and sync failures,

from [email protected] and [email protected].

1. Announce the service's opening to anyone who joined the waitlist.
2. Operate, diagnose, secure, and maintain the platform, including detecting

and correcting errors.

1. Handle requests to exercise rights and comply with legal obligations.

3.2 Secondary purposes

These are not necessary for the service, and a user may object to them without that affecting the service they receive:

1. Aggregate product-usage analysis, to understand which surfaces are useful

and improve the product. These events record what happened, not who did it: they contain no email address, no account identifier, no third-party platform identifier, and no game title. This purpose is switched off unless consent exists (section 7).

To object, simply do not give the corresponding consent, or ask at any time at [email protected].

3.3 What Telesia does not do

• It does not sell, rent, or trade personal data, under any circumstances

and for any consideration.

• It does not share one user's data with another.
• **It sends no identity data, email address, or session token to any

third-party gaming platform.**

• It makes no automated decisions producing legal effects or significantly

affecting the person concerned.

• It builds no advertising profiles and hands no data to ad networks.

4. Processors and transfers

4.1 Processors

The following third parties process personal data on MADFAM's behalf and under its instructions, solely for the purposes described in this notice:

PhyndCRM, a MADFAM platform, receives waitlist records (section 2.3) and is the system of record for the resulting prospect. Telesia holds that data only transiently, until it is relayed.

4.2 Transfers

MADFAM transfers no personal data to third parties other than the processors named above, except where legally required by a competent authority acting within its powers, or where necessary to perform obligations arising from a legal relationship. None of these transfers requires the person's consent under the applicable law.

4.3 International transfers — express notice

Personal data processed by Telesia is stored and processed on servers located outside Mexico, specifically in the European Union, as well as in the systems of the processors named in section 4.1, some of which operate from jurisdictions other than Mexico.

By using Telesia, the person concerned is informed of this. MADFAM contractually requires each processor to observe protections equivalent to those set out in this notice and in applicable Mexican law, together with a duty of confidentiality that survives the end of the relationship with that processor.

5. ARCO rights — access, rectification, cancellation, objection

A person, or their legal representative, has the right to:

• Access their personal data and know how it is being processed;
• Rectify it where it is inaccurate or incomplete;
• Cancel it where they believe it is not needed for any of the stated

purposes, or is being used for purposes they did not consent to;

• Object to processing for specific purposes, in particular the secondary

purposes in section 3.2;

• Withdraw any consent they have given;
• Limit the use or disclosure of their personal data.

5.1 How to exercise them

By email, to [email protected], stating:

1. The person's name and a means of replying to them;
2. A document evidencing their identity, or their legal representation;
3. A clear description of the data concerned and of the right being exercised;
4. Anything else that helps locate the data.

In the product, where that surface exists, through the account export and delete functions.

MADFAM will respond within the periods set by applicable law. Exercising these rights is free of charge; only justified reproduction or delivery costs may be charged, as the law allows.

5.2 What happens in each case

A deletion request is not answered by disabling an account. Deleting means the records cease to exist.

6. Retention periods

The twelve-month waitlist period applies even if the PhyndCRM integration never comes into operation. A deletion that depends on another system being connected is not a retention policy.

7. Cookies, tracking, and consent

Telesia runs with no analytics cookies unless consent is given. The usage-analysis tool runs in a mode that writes no cookies, stores no identifier on the device, and keeps no state between visits. Two visits by the same person are therefore, to the system, two anonymous visits — a limitation accepted deliberately.

Only if a user gives express, affirmative consent may persistence of such identifiers be enabled. No box is pre-ticked, and silence or merely continuing to browse does not constitute consent. Consent may be withdrawn at any time by the means in section 5.1.

Cookies strictly necessary to keep a session signed in and to secure the service do not require consent, being indispensable to providing the service requested.

8. Security measures

MADFAM has implemented administrative, technical, and physical measures intended to protect personal data against damage, loss, alteration, destruction, or unauthorised use, access, or processing. Among them:

• Encryption in transit on every public surface.
• Encryption of linked-account credentials using an authenticated encryption

algorithm; such credentials are never stored in the clear.

• Secrets held outside the source code, in a dedicated store.
• Restricted and audited access to the infrastructure.
• Least privilege: each service component receives only the credentials it

needs.

No system is invulnerable. In the event of a breach significantly affecting the proprietary or moral rights of the people concerned, MADFAM will inform them as applicable law requires, so that they can take appropriate measures.

9. Minors

Telesia is not directed at minors and does not knowingly collect their personal data. If it emerges that information about a minor has been collected without the involvement of a parent or guardian, that information will be deleted.

10. Legal framework and authority

The processing is governed by the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) published in the Official Gazette of the Federation on 20 March 2025 and in force from 21 March 2025, together with its amendments and with its implementing rules to the extent they do not conflict with that law.

A note on currency, for transparency. This law repealed the 2010

Federal Law on the Protection of Personal Data Held by Private Parties.

Because it is a new statute rather than an amendment, **its article

numbering does not correspond to the previous one**; this notice therefore

states the obligations without citing article numbers, rather than

reproducing references that might belong to a repealed statute. The counsel

review flagged at the top covers exactly that — adding the precise citations.

The competent authority for the protection of personal data held by private parties is the Secretaría Anticorrupción y Buen Gobierno, which took over those powers following the dissolution of the National Institute for Transparency, Access to Information and Personal Data Protection (INAI). Anyone who considers their right to personal-data protection has been infringed may approach that authority.

11. Changes to this notice

This notice may change to reflect changes in the service, in the processors involved, or in applicable law.

Any change will be published at https://telesia.quest/legal/privacy-notice with an updated date and version number. Where the change is material — in particular if it broadens the purposes, adds a processor, or alters retention periods — it will also be communicated by email to users with an active account before it takes effect.

The version in force is always the one published at that address.

Innovaciones MADFAM, S.A.S. de C.V. — Cuernavaca, Morelos, Mexico [email protected] Last updated: 2026-09-12 · Version 1 · Counsel review pending