ZipCodes

Postal Code API

Privacy Policy

Last updated: September 8, 2026

C9 STUDIO DESIGN, S.A. DE C.V. (Mexican Tax ID / RFC: CSD201216A82), with its registered fiscal address at Cerrada de Concepción Beistegui #15, Colonia Del Valle, Benito Juárez, C.P. 03100, Mexico City, Mexico (referred to as "C9SD" or "we"), is responsible for processing your personal data under this privacy notice regarding the ZipCodes platform (http://zipcodes.c9sd.com), in compliance with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP).

1. Personal data we collect

  • Registration data: name, email address, and password (stored encrypted/hashed, never in plain text). Your company name is optional.
  • API access data: the authentication token we generate for your account and the date/time it was last used. We do not store a detailed log of each individual API request (country or postal code looked up) beyond what's needed to answer the request in real time.
  • Billing data: managed by our payment processor, Stripe. We keep your Stripe customer and subscription ID, your plan, your subscription status, and your invoice history — never your full card number.
  • IP address: processed transiently to enforce per-minute rate limits and prevent abuse of the service; not stored permanently as part of a per-user history.

We do not collect sensitive personal data (health, ethnic origin, religious beliefs, etc.), nor do we request it for any purpose of this service.

2. Purposes of processing

We use your personal data for the following purposes, necessary for the service you requested:

  • Creating and managing your client account.
  • Authenticating your requests to the postal code API.
  • Processing your subscription payment through Stripe and granting access to your plan.
  • Sending you operational communications: account confirmation, password resets, two-factor verification, and notices about your subscription or API token.
  • Providing technical support and responding to your requests.
  • Preventing fraud and abuse of the service.

We do not use your data for third-party marketing purposes, and we do not sell, rent, or trade it.

3. Data transfers

To process payments, we share the necessary billing data with Stripe, Inc. (United States), our payment processor. This international transfer is necessary to carry out the service you contracted. Stripe maintains its own security and compliance measures (PCI DSS) for handling payment data. You can review Stripe's privacy policy at stripe.com/privacy.

We may also disclose your personal data when required by a competent authority through a properly founded and justified request.

4. Security measures

All communication with ZipCodes travels encrypted over HTTPS/TLS. Passwords are stored hashed (never in plain text), and API access tokens are generated and validated securely. Access to your data within our team is restricted to what's strictly necessary to operate the service.

5. Retention period

  • Account data: for as long as your account remains active, plus a reasonable additional period after cancellation to meet legal obligations or resolve disputes.
  • Billing data: in accordance with C9SD's applicable tax obligations in Mexico (generally 5 years, per the Federal Fiscal Code).

6. ARCO rights

You have the right to Access, Rectify, Cancel, or Object (ARCO rights) to the processing of your personal data, and to revoke any consent you may have given us. To exercise these rights, email admin@c9sd.com with the subject "Solicitud ARCO" (ARCO Request), including your full name and your account's email address.

We will acknowledge receipt of your request within 5 business days, provide a substantive response within a maximum of 20 business days, and — where applicable — carry out the request within 15 business days following the date we communicate our response.

7. Use of cookies

We only use cookies essential to the site's operation: the session cookie (to keep you logged in) and the CSRF protection cookie. These cookies do not require your consent, as they are strictly necessary to operate the platform. We do not currently use analytics or third-party advertising cookies.

8. Children's privacy

ZipCodes is not directed at individuals under 18 years of age. If we become aware that we have inadvertently collected personal data from a minor, we will delete it from our systems.

9. Changes to this privacy notice

We may modify this privacy notice at any time. Changes will be published on this same page, indicating the date of the last update.

10. Authority

If you believe your right to personal data protection has been violated, you have the right to file a complaint with Mexico's National Institute for Transparency, Access to Information and Personal Data Protection (INAI). For more information, visit www.inai.org.mx.

11. Contact

For any questions about this privacy notice, write to us at admin@c9sd.com.