Privacy Notice

The controller (responsable) for the account data in this notice is Searchlook, Mexico City, Mexico. Privacy contact: privacy@searchlook.mx.

This notice covers the Screening API and the developer portal. It follows article 15 of the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), published in the Diario Oficial de la Federación on 20 March 2025.

When you register and use the service we process:

• Account data: name, email address, and organization.
• Authentication data: password credentials, API keys, and session tokens.
• Billing data needed to charge the plan you select.
• Technical data: IP address, browser, and device data.
• Screening queries you send, including names and identifiers such as CURP or RFC, the endpoint you select, and the audit record of that call.

Sensitive data. Under article 3, fraction VI, of the LFPDPPP, sensitive data are data that affect the most intimate sphere of a person, or whose misuse can cause discrimination or a serious risk. Screening results can include that kind of data: party and PEP records can reveal political opinions, and sanctions or sex-offender registries can reveal data whose misuse can cause discrimination. We do not ask you for racial or ethnic origin, religious beliefs, genetic data, or sexual preference.

A name you submit about another person is that person's data. You are the controller of that screening. Searchlook processes it to perform the service you requested. Where Searchlook keeps its own indexes from public sources, Searchlook is the controller of those indexes. That processing is described in the notice for data subjects.

Purposes that do not need a separate consent. Article 9, fraction IV, of the LFPDPPP allows processing that is required to exercise a right or to perform a legal relationship with you. We use your account and query data to:

• Create and secure your account, and authenticate API calls.
• Run the screening queries you send and return the results.
• Bill the endpoints you select.
• Keep the audit log of each call, including each page of a result.
• Detect abuse and answer a legal request.

Purposes that need your consent. We do not use account data for a purpose outside this list. If we later want to, article 11 requires us to ask you again. Creating an account is acceptance of the purposes above. The signup screen asks you to accept this notice and the Terms of Use for API users before the account is created.

Article 10 of the LFPDPPP requires us to delete personal data, after any required blocking period, once they are no longer needed for the purposes in this notice. Records of a contractual breach are deleted after 72 months from the breach.

Screening audit logs are kept for 10 years. That period is article 18 of the Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita (LFPIORPI). The LFPIORPI is the anti-money-laundering law. It is not the personal-data law. It requires the person who carries out a vulnerable activity to keep the information that supports those notices. We keep the screening audit log for that period so the record still exists if you, or an authority, need it.

A cancellation request does not delete a record that a legal obligation requires us to keep. Article 33, fraction IV, of the LFPDPPP allows that refusal.

To limit use or disclosure of your account data, email privacy@searchlook.mx or file an opposition at /data-rights. We do not sell personal data.

Cloud hosting, email delivery, and payment processing are done by processors (encargados) acting on our instructions. Article 35 of the LFPDPPP treats a transfer as a disclosure to someone other than the processor. We transfer data to an authority when a law, treaty, or founded order requires it (article 36, fractions I and V). We do not transfer account data to another country for a purpose outside this notice.

The LFPDPPP gives the data subject four rights: acceso, rectificación, cancelación, and oposición (articles 21 to 25). Those rights belong to the person the data is about, or to their legal representative (article 27). They are not exercised from inside an API account.

File the request at /data-rights, before login. Article 28 requires the full name, a way to receive notices, and documents that prove identity, or the identity and authority of a representative. An official ID is mandatory on every request. Article 30 also requires, for rectification, a description of the correction and documents that support it.

Article 31: we communicate the decision within 20 business days of receiving a complete request. If we grant it, we carry it out within the following 15 business days. Each period can be extended once, for the same length, when the case justifies it.

Complaints about our handling of personal data go to the Secretaría Anticorrupción y Buen Gobierno, which the LFPDPPP charges with supervising this law.

When this notice changes, we publish the new text on this page with a new date, and we email the address on your account about a material change. A new purpose needs your consent again (article 11).

The grounds in this notice are the LFPDPPP, Diario Oficial de la Federación, 20 March 2025, articles 3, 8, 9, 10, 11, 15, 21 to 25, 27, 28, 30, 31, 33, 35, and 36, and article 18 of the LFPIORPI for the 10-year audit-log period only. Earlier drafts of this page called the LFPIORPI the personal-data law and listed GDPR rights (erasure, restriction, portability) as if they were Mexican ARCO rights. Those statements were wrong and have been removed.