Privacy Notice
Version 1 · Effective October 26, 2026 · Grayscale Interactive S.A.S. de C.V. This document is a courtesy English translation of the Spanish original. The Spanish version governs: in case of any discrepancy between the two versions, the Spanish version prevails.
C. Comprehensive Privacy Notice (Data Use Policy)
Comprehensive Privacy Notice of Argent XR. The following rules supplement the terms of service and describe the processing according to the interaction and the features used.
Controller and privacy contact
Grayscale Interactive S.A.S. de C.V. is the controller of the processing of personal data it carries out to manage the relationship with users and comply with its own obligations.
Privacy matters, the exercise of ARCO rights (access, rectification, cancellation and opposition) and requests for the address for legal notices are handled exclusively by email at support@argentxr.com.
Processing on the Customer's behalf and our own responsibilities
When the Customer determines the purposes of processing third-party personal data that it incorporates into the service, the applicable controller obligations will fall on the Customer, including the legitimacy of its use and the legally required notices or consents. In the processing it carries out on the Customer's behalf, Grayscale will act as processor and will follow the Customer's documented instructions that are compatible with the law. If it finds that an instruction is unlawful, it will inform the Customer and will not be obliged to carry it out.
Grayscale will retain its own responsibilities for the data it processes to manage accounts, invoice, protect the service and comply with its obligations. Roles will be determined for each processing operation and its actual operation, not solely by the plan's name. This allocation will not shift to the Customer obligations or liabilities that legally correspond to Grayscale, nor will it modify the duties of security, handling of rights and incident notification already provided.
Information collected from users
Account and access: we will process the email address, account identifier and authentication data necessary to create and manage the account, identify its sign-ins, maintain its security and send operational communications. When an external sign-in provider is used, we will disclose the identity data received from that provider and the data optionally added to the profile, according to the enabled flow.
Profile: we will process the display name that the user provides or adds through the enabled means and, when the user chooses, the profile image from their sign-in provider, to identify their participation and personalize the presentation of their account. Company or job title will not be required as a general condition for using an individual account. Those data may be processed when they are provided in a business inquiry or purchase and are relevant to handling it, with information about that purpose.
Organization: when a person participates in an organization, their membership data, roles, permissions and, when the organization provides it through the enabled means, their internal employee identifier will be processed to manage their participation and authorized access. Viewing these data will be limited to those with the corresponding permissions. Profile data do not by themselves grant administrative functions or permissions.
This distinction does not prevent requesting the tax, identification or representation data necessary to invoice, contract on behalf of an organization or handle a justified verification. Providing profile or organization data does not by itself authorize advertising, use of content in portfolios or artificial intelligence training; the separate permissions already provided are maintained.
Billing details: We will keep your tax information necessary for issuing receipts. Your payments are processed through an authorized external platform, so Argent XR does not collect or store card numbers or bank passwords. Retention of issued invoices and tax adjustment documents is governed by the section “Retention of invoices and tax documents”, separately from other billing data.
User files: Files and projects are hosted in order to provide the service. CAD originals are kept according to the plan, in accordance with the section “Retention of CAD originals”.
Browsing records: In order to ensure optimal performance of the environment, Argent XR may collect the device's IP address, browser type, device used and operating system. Routine technical and security logs containing these data will follow the periods of the section “Retention of audit, support and security records”.
Sensitive personal data and anatomical models
The general service is not intended to host or process clinical records, identifiable medical information or other sensitive personal data, including biometrics intended to identify people when they have that character under applicable law. The Customer must not incorporate such data into models, annotations or files, unless agreed in advance and in writing with Grayscale. The data subject's consent alone does not enable that use in Argent XR.
This restriction does not prevent generic anatomical models or content that does not allow people to be identified or re-identified. A 3D scan or model will not automatically be classified as sensitive data: the information it contains, its context and the intended use will be considered. Content restrictions and the other legal requirements will continue to apply.
Minors' data and requests from representatives
Argent XR does not admit users who are minors, in accordance with the section “Capacity to contract, authorized users and minors”. If we identify an account of a minor, we will restrict access and handle their data in accordance with the law.
Legal representatives may request assistance regarding a minor's data at support@argentxr.com. Requests for access, rectification, cancellation or opposition will follow the ARCO procedure and a proportionate verification of identity and representation through secure means. Receiving a report does not authorize delivering data to someone who merely claims to represent the minor. Urgent protective measures, limited retention and notices to authorities will be governed by the law and the applicable sections.
Authorized access, providers and disclosure
Access to personal data and non-public content will be limited to authorized personnel and to the providers necessary to provide the service, according to their functions, access controls and applicable obligations.
Argent XR uses cloud infrastructure, authentication and payment processing providers. Those acting on Grayscale's behalf will receive only the necessary information and will be subject to the corresponding obligations. Other providers may act as independent controllers in certain operations. The privacy notice describes their functions by category and the applicable international processing.
Providers and international processing
Grayscale relies on providers of cloud hosting, authentication, database and storage, email delivery, payment processing and analytics. You can request the list of specific providers by writing to support@argentxr.com. Processing takes place mainly in Mexico and the United States. The main storage location will not by itself be presented as the exclusive residence of all processing.
Processing on Grayscale's behalf will be distinguished from transfers to independent controllers. When a transfer requires consent, its recipients and purpose will be disclosed and its acceptance or refusal will be facilitated before it is made; applicable exceptions must be substantiated. Adding or changing a provider will not by itself authorize new purposes or transfers, or replace the applicable notices and permissions. The rules on changes to the notice and Grayscale's own obligations are maintained.
Shared content will be shown only to the authorized audience. Members and administrators of organizations will have access according to their permissions. Information may be communicated to authorities or legitimate third parties when there is a valid basis, limited to the necessary scope.
Personal data will not be sold. Uses of content or brands for advertising and AI training will continue to require the express and separate authorizations provided in these terms.
Cookies and optional analytics
Technologies intended for non-essential analytics or other optional tracking will require prior, informed permission separate from acceptance of these terms. Their purposes, providers and duration will be disclosed.
The user may refuse them or withdraw their permission without losing contracted features. Processing strictly necessary to authenticate users, maintain security and provide the requested service will keep its corresponding basis and scope.
Analytics and visible activity by plan
In Freemium, Pro and Studio, Argent XR may analyze usage and performance data to understand and improve the service, in accordance with the disclosed purposes and the prior-permission regime for non-essential analytics. Processing necessary to provide and protect the service will keep its own purpose, basis and scope.
For purposes of analytics and visible activity, Early Adopters will be governed by the Pro rules and Hosting by the Freemium rules, solely for the features and publications actually available in each plan. These equivalences do not add new commercial services or guarantee dashboards or reports that are not enabled.
Purchasing or changing plans will not automatically grant or restore optional analytics permissions. Prior permission, its refusal and withdrawal, the limits on data and recipients, the capture exclusions, retention and erasure, and the provider conditions already provided are maintained. Strictly necessary records will keep their own purposes and rules. This equivalence does not authorize new providers, events or surfaces, nor does it extend website analytics to the app or the viewers. Enterprise will keep its specific regime.
Depending on the features actually enabled, the holder and authorized administrators may view visits and actions performed on the content they manage. The visitor's identity will only be shown when it is legitimately available in the context of an identified access, with prior information about the data, purpose and recipients and with the applicable permissions or bases. Anonymous visitors will not be automatically identified, and their activity on other people's content will not be shown. IP addresses are excluded from ordinary reports to the customer; the necessary infrastructure or security records and legally appropriate communications keep their own limited-access regime.
In Enterprise, the default scope will be limited to the data necessary to provide the service, control access, invoice and protect security. Optional analytics will remain turned off unless there is a specific written agreement on its scope, with the applicable notices and permissions before it starts. Necessary access and security records may identify users when necessary for those purposes; they will not for that reason become behavioral reports.
These rules do not by themselves authorize session recording, advertising use of content or artificial intelligence training. The separate permissions, the rights of refusal and withdrawal, the obligations of each party according to the actual processing and the retention periods provided are maintained. Refusing optional analytics will not prevent viewing or the features that correspond to authorized access.
Permission for non-essential analytics does not authorize its providers to use the content or data sent by Argent XR to develop or train artificial intelligence models for their own purposes.
Scope of in-app analytics capture
Optional in-app analytics will be limited to events and properties expressly defined to measure feature usage, operation outcomes and performance, with the relevant technical data and, when necessary, pseudonymous identifiers. These identifiers will not be considered anonymous merely because they do not show a name.
Names, email addresses, telephone numbers or tax data, files or model content, free-text titles or descriptions of projects and files, text entered in forms, credentials, tokens or access links will not be sent to that internal analytics set. Nor will non-anonymized IP addresses be kept within those events. The necessary infrastructure or security records and authorized access reports will keep their own purposes, audiences and rules.
The user's screen activity is not recorded; any recording would require a specific permission, separate from the general analytics permission.
Website analytics retention
User and event data from optional website analytics that can be linked to a person are kept for at most two months.
Aggregated website statistics are not used to identify people. Prior permission for optional analytics and erasure rights are maintained.
In-app analytics retention
Optional analytics events that can be linked to a person, even through pseudonymous identifiers, will be used for at most twelve months from each event; afterwards they will be erased or anonymized following the ordinary deletion cycle of the section “Trash, account deletion and backups”.
Information retention and purging
Canceling the subscription is not equivalent to requesting deletion of the account and does not entail automatic deletion of all projects. Retention of CAD originals after the effective change is governed by the section “Retention of CAD originals”. Account deletion and the handling of backups are governed by the section “Trash, account deletion and backups”.
Retention of CAD originals
CAD originals will be kept for seven calendar days from upload in Freemium and thirty calendar days from upload in Pro, Early Adopters and Studio. In Enterprise they will be kept while the contract is active, unless there are specific conditions.
These periods are independent of the monthly or annual billing period of the subscription.
After cancellation, non-payment with an effective plan downgrade, or a move to Hosting, the originals that still exist will be kept for at least ninety calendar days from the effective change, respecting any later date already granted. This protection does not recover previously deleted originals or prevent an applicable express deletion or legal preservation, in accordance with the section “Legal holds and evidence preservation”.
The expiration date will be shown, and notice will be given before the scheduled deletion. Expiration of the source CAD does not by itself delete the converted model or the published experience. It does not apply to models uploaded already in a web format.
Trash, account deletion and backups
Projects sent to the ordinary trash may be recovered for seven calendar days, with a visible expiration, and will continue to count toward storage. Their deletion will disable their publications. Restoring them will not republish them automatically. An expressly confirmed permanent deletion will skip the trash.
A request to delete a personal account submitted by its holder will have a seventy-two-hour grace period, during which the request may be canceled and the information still available and authorized may be exported. When that period ends, deletion begins; it is completed in active systems within at most thirty calendar days and in backups within their ordinary rotation cycle, which does not exceed ninety calendar days. The delimited exceptions already provided and the legal deadlines that must be met earlier are maintained.
Backups will be used for contingencies, without a guarantee of individual file restoration. If a backup is restored, deletions already made will be kept.
Tax, evidentiary or legal exceptions will be limited to the justified classes, with restricted access. Deleting an organization requires its own authorization and procedure; deleting a member's account does not delete the organization's projects. Issued invoices and tax adjustment documents are governed by the section “Retention of invoices and tax documents”. Legal preservations are governed by the section “Legal holds and evidence preservation”.
Access data managed by our authentication provider are deleted according to that provider's cycle, which may exceed the periods above, without those data being used for any other purpose.
Retention of invoices and tax documents
Issued invoices, including their XML/PDF files and the corresponding tax adjustment documents, form part of the accounting and tax archive of Grayscale Interactive S.A.S. de C.V. and will be kept for the period required by tax law, even after the account is deleted.
Access will be restricted to persons and providers authorized for accounting, tax, audit or legal-defense functions. They will not be used for advertising. This retention does not justify keeping projects, models, the full profile or any other billing data that is no longer necessary.
This policy will be applied respecting the corresponding legal bases and limits. Requests regarding rights over personal data will be handled under those conditions, without considering tax retention a general exception for all account data.
Retention of audit, support and security records
Ordinary audit records will be kept for up to fourteen months from each event; ordinary support tickets, for up to twelve months from their closure; and routine technical and security logs, for up to ninety calendar days from each event.
Only the necessary data will be kept, with restricted access. User files attached to support will be deleted when they are no longer necessary and will not automatically inherit the ticket's period.
When an account is deleted, unnecessary personal data will be erased or unlinked. These maximums do not authorize the indiscriminate retention of profiles or complete conversations.
If a confirmed incident, claim or request requires evidence to be preserved, only the necessary information will be kept while the cause remains. Documents that evidence contracts, commitments or claims will be classified according to their specific retention regime. The minimum records of acceptance and account deletion are governed by the section “Records of acceptance and account deletion”.
Records of acceptance and account deletion
Minimum evidence of acceptance of the terms will be kept during the contractual relationship and for ten years from its termination. The minimum record of account deletion will be kept for ten years from when the deletion is completed.
The evidence of acceptance will include the minimum data needed to establish the account, the date and the accepted version.
These records will have restricted access and will be separated from advertising use. They will not justify keeping full profiles, passwords, tokens, full IP addresses or device fingerprints for ten years. When the period expires, the personal link will be removed, unless a current obligation or file justifies keeping it in a delimited way.
Legal holds and evidence preservation
Only information that is necessary may be preserved in the face of a legal obligation, a valid request from an authority, a specific claim or a confirmed incident related to a possible proceeding. A generic report or abstract risk will not justify keeping the entire account. Data not involved will follow their ordinary schedule.
The preservation will be documented, will have restricted access and will be reviewed periodically, without indefinite automatic renewal.
The user will be informed of the existence and effects of the measure, unless a legal prohibition or a specific risk justifies deferring the notice. Preserving information does not by itself authorize disclosing it, publishing it, training AI or blocking all export.
When the cause disappears, the measure will be lifted and the ordinary deletion of the affected data will resume. Content will not be republished automatically.
Platform security and safeguarding
Grayscale will establish and maintain administrative, technical and physical security measures consistent with the risks and applicable law, including access controls and confidentiality duties.
Providers' certifications and assessments correspond to the services and scopes they document; they do not by themselves constitute a certification of Argent XR itself.
No system guarantees the absolute absence of incidents. This warning does not eliminate Grayscale's security, confidentiality, notification and handling obligations.
Access management: Authentication and permissions will limit access to authorized persons and audiences, including members of organizations and recipients of publications according to their permissions. Access by personnel and providers will be governed by the section “Authorized access, providers and disclosure”.
Security incident notices
In the event of a security breach that significantly affects the economic or moral rights of data subjects, Grayscale will inform the affected persons immediately in accordance with applicable law. The notice will include the available information about the incident, the data affected, the known risks, the measures adopted or recommended and the contact for assistance.
The information will be completed as the investigation progresses, without delaying the initial notice because all the details are not yet available. When Grayscale processes data on behalf of an organization, it will notify the organization of the incident without undue delay and provide the information and cooperation necessary for it to comply with its obligations, without replacing direct notices that legally correspond to Grayscale.
Support or service-restoration deadlines do not extend or suspend legal notification deadlines. Communications will be made through means appropriate to the affected persons, avoiding unnecessary disclosure of third-party data or information that worsens the risk.
Exercising ARCO rights
You may exercise your ARCO rights by writing to support@argentxr.com. Include your name, means of response, request and elements to locate the data. Describe the data affected, except in access requests. For rectification, state the changes and provide supporting documentation. We will verify identity and representation through proportionate requirements and secure means.
We will communicate our determination within twenty business days from receipt. If it is granted, we will make it effective within the fifteen business days following the response. Each period may be extended only once for an equal period, with a justification that we will communicate.
We will explain any total or partial refusal in accordance with the applicable legal grounds. Exercising these rights will be free of charge, except for legally permitted costs. Access will be provided through secure electronic delivery, after verification.
This procedure is different from canceling a subscription or requesting the operational deletion of an account. Operational deadlines will not extend the legal ones; any excepted retention will have a delimited scope and basis.
Revoking consents and limiting uses
You may separately revoke the optional consents and authorizations for advertising, portfolio or AI training, and request to limit the use or disclosure of your data, by writing to support@argentxr.com. State which permission or use you wish to withdraw. The procedure will be free of charge and the verification proportionate.
We will apply the withdrawal without undue delay and confirm the result. If essential data are missing, we will tell you which.
When applied, new uses based exclusively on the withdrawn permission will cease, and the digital advertising pieces under our control that depend on it will be withdrawn. The revocation will not have retroactive effects and does not guarantee the recovery of copies held by others outside our control or the automatic reversal of AI training already lawfully carried out.
Refusing or withdrawing these permissions will not affect the contracted features. Processing necessary to provide the service or comply with legal obligations will continue only with its corresponding basis and scope.
Availability and versions of the privacy notice
The Argent XR Comprehensive Privacy Notice will be available without the need to sign in, through a public address identified from the collection points and the relevant surfaces of the service. Its version and update date will be shown and its previous versions will be kept accessible. In electronic data collection, a short-form notice appropriate to the interaction and access to the comprehensive notice will be provided. In the viewers, visible access to the applicable notice will be provided, without requiring an account or subscription merely to consult that information.
Communicating changes to the privacy notice
Substantial changes that affect the purposes, categories of data, recipients or relevant conditions of the processing will be communicated before the modified processing is applied, through a notice at the relevant points of the service and by email to the affected persons whose email address we have available for that communication. For visitors without an available email address, the change notice will be provided in the context of the interaction before the modified processing. The communication will identify the relevant changes, their application date and access to the new version.
Formal corrections that do not alter the processing will be reflected in the published version without the need to send an individual email for each correction. When a new purpose or other change requires consent, it will be obtained before it is carried out. Publishing the notice or continuing to use the service will not replace the express and separate permissions already provided or by itself authorize new purposes. The additional deadlines and means required by applicable law will be complied with.
C.1 Short-form notice: website, waitlist and contact
Grayscale Interactive S.A.S. de C.V. is the controller of the data you leave on argentxr.com. If you write to us by email, we process your name, if you provide it, your email address and your message, solely to reply to you. On the waitlist we process your email address and, in business requests, your name, company and message, to confirm your registration, notify you of access to Argent XR and handle your request. Marketing communications require an optional, separate checkbox, which you can withdraw at any time.
Contact messages are kept for up to twelve months. Website analytics is only activated if you accept it in the cookie notice, in accordance with the section “Website analytics retention”. On the waitlist you accept this notice and also the General Provisions (Part I) of the Terms and Conditions. The rest of the Terms and Conditions is accepted when creating an account. You can exercise your ARCO rights, object to non-essential processing or request the address for legal notices at support@argentxr.com. See the Comprehensive Privacy Notice on the website.
C.2 Short-form notice: viewer and published experiences
You do not need an account to open a published experience. We record technical data such as IP address, browser, device and operating system to deliver and protect the service; those technical and security records are kept for up to ninety calendar days. The owner of the experience can view visits and actions in aggregate form, without IP addresses and without identifying anonymous visitors. In private experiences that ask you to sign in, the owner can see which email addresses accessed them. Screen activity is not recorded in the viewer, and website analytics is not used there. You can report content, exercise your rights, object to non-essential processing or request the address for legal notices at support@argentxr.com. See the Comprehensive Privacy Notice on the website.
Back to ArgentXR