Privacy notice

Last updated: October 2, 2026

This is a translation for your convenience. If the two differ, the Spanish version governs.

Who is responsible for your data

Destella (the “Controller”) is responsible for processing the personal data collected through this site and the platform. For anything related to this notice you can write to [email protected].

What data we collect

From your account: your email address and, if you sign in with Google or Apple, the name that provider shares with us. We do not use passwords: you sign in with a code we send to your email.
About your company and your role: the company name, its subdomain, your name, your role and what you tell us you want to understand about your business.
About your company's operation:the information you upload or connect from your systems (sales, collections and similar data). If that information includes personal data of third parties (for example, your customers' names), your company is responsible for it and Destella processes it only on its behalf, to provide the service.
Technical: the IP address and browser data needed to keep your session, protect you against automated access and detect errors.
About your use of the platform: some of the steps you take and when (for example, loading a file, saving or sharing a report, or entering the portal), linked to your account and your company.
About the subscription: the status of your plan. Your card details are processed and stored by Stripe; Destella never receives or stores them.

What we use it for

Purposes necessary to provide the service:

Create and protect your account and your company's workspace.
Organize your company's information and prepare your readings and reports.
Send you the sign-in code and the service notices you set up.
Charge your subscription, when you take one out.
Give you support and fix errors.

Additional purpose, which you can object to by writing to us without affecting the service: understanding how the platform is used in order to improve it, for example which steps each company completes and how long they take.

We do not sell your data, we do not use it for advertising and we do not use it to train general-purpose artificial intelligence models. Your company's information belongs to your company: we use it to provide the service, and for nothing else.

Who we share it with and where it is stored

Only with the providers we need to operate. They process the data on behalf of Destella, under their own privacy and security policies:

Supabase:accounts, access and each company's settings.
Neon:each company's own database, with its operational information.
Railway: the servers where the application runs.
Cloudflare: the network that delivers the site, the check against automated access (Turnstile) and the measurement of visits to the site, without cookies (Web Analytics).
Resend:sending the service's emails, such as the sign-in code.
Sentry:the record of the application's errors and response times, to fix them and make it faster.
Stripe: charging the subscription, once it is active.

Your data is stored in the United States(East region, Virginia), on these providers' infrastructure. If we add another provider that processes your data (for example, for assistance with artificial intelligence), we will add it to this list before using it.

How we protect it

Each company has its own database: one company's operational information does not live next to another's. The platform's access rules prevent an account from seeing the workspace of a company it does not belong to. Information travels encrypted, and the credentials of each database are stored encrypted. Internal access to customer data is limited to the team that operates the service.

Your rights (ARCO)

You can request access to your personal data, its rectification or cancellation, or object to its processing, as well as revoke your consent or limit its use, by writing to [email protected]. State your name, your account's email and what you need. We will respond within the time limits set by Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).

Cookies and similar technologies

We use only those needed to keep your session and remember your preferences (such as the light or dark theme and the language). We do not use advertising cookies. To count visits to the site we use Cloudflare Web Analytics, which stores no cookies and does not identify visitors; we also count the clicks on the home page's buttons without an account. Inside the platform we record some steps ourselves (for example, loading a file or saving a report) with your account and your company, with no measurement cookies and no third-party services, and we delete them after 400 days. If you object, we stop recording them and delete the ones we have.

How long we keep the information

While your account is active, and afterwards for as long as needed to meet tax and legal obligations. If your company leaves the service, it can ask us to delete its database and its operational information.

Changes to this notice

If we change this notice, we will publish the new version on this same page and update the date above. Important changes are also announced by email.