Pimo Earn with Pimo

Pimo Privacy Notice

Version 1.0. Last updated: September 26, 2026

This Privacy Notice is published in English and Spanish. In case of any discrepancy, the Spanish version prevails.

This is Pimo's comprehensive privacy notice under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, published March 20, 2025, the "Law").

1. Who is responsible for your data

Pimo is a trade name operated by John Patrick McCarthy Moreno, an individual doing business in Mexico, with address at Lava 279-6, Jardines del Pedregal, 01900, Mexico City, Mexico. He is the data controller (responsable) of your personal data.

Privacy contact and personal data department: privacidad@getpimo.com. This contact handles all requests about your data.

2. The personal data we process

Depending on how you use Pimo (as a Traveler, a Host or a visitor), we process:

Sensitive personal data. The comparison of your selfie with your ID uses biometric data, which Pimo treats as sensitive personal data. We only process it with your express written consent, given through a box that is not pre-ticked inside your signed-in account (section 4). We do not ask for other sensitive data. If a claim requires information about injuries or health, we will ask for your express consent, unless a legal exception applies.

Data of other people. If you give us data about another person (for example, a person involved in an accident), you must have the right to share it and let that person know about this notice.

3. What we use your data for

3.1 Primary purposes (necessary for the service)

  1. Create and manage your account and sign-in.
  2. Verify your identity, your driver's license and, for Hosts, the vehicle and its documents.
  3. Publish listings, process bookings and support the rental agreement between the Host and the Traveler.
  4. Collect payments, pay Hosts, process refunds, handle the Security Deposit and post-trip charges.
  5. Enable messages between Hosts, Travelers and Pimo, and provide support.
  6. Handle claims, damage, fines, tolls, disputes and chargebacks.
  7. Prevent fraud, identity theft and misuse, and protect the safety of users and vehicles.
  8. Send service emails about your account, bookings, payments and security.
  9. Meet legal and tax obligations and respond to requests from competent authorities.
  10. Keep the platform working and secure, and fix errors.

We need these purposes to provide the service. Under article 9, section IV of the Law, they do not require your consent because they are necessary for the legal relationship between you and Pimo.

3.2 Secondary purposes (not necessary)

In addition to the purposes necessary to provide the service, and only if you consent by ticking the relevant box at sign-up or by turning on "Promotional emails" in Settings, we will use your name, email address, language, city and your Pimo usage history to send you promotions, discounts, news and surveys (marketing, advertising and commercial prospecting purposes). We send these emails through our email provider Resend, which acts on Pimo's behalf and under our instructions.

Refusing or stopping them does not affect your account or bookings. You may refuse these purposes, withdraw your consent or object at any time, free of charge, through any of the following: (i) the "Unsubscribe" link in any promotional email or your email client's unsubscribe button; (ii) turning off "Promotional emails" in your Account Settings; or (iii) writing to privacidad@getpimo.com with the subject "Marketing objection". We apply your request immediately and in any case within 48 hours, add your email to our suppression list, and confirm the opt-out to you. Withdrawal has no retroactive effect. If you gave us your data other than at sign-up and do not want us to use it for these purposes, you can tell us through the same channels.

4. Identity and document verification with AI assistance

What data we process. To register as a Host or Traveler, we ask for images of your official ID (INE, front only unless we ask otherwise, or passport), your driver's license, the vehicle registration card if you are a Host and, where applicable, a selfie with a liveness check. From these images we obtain your name, date of birth, license number, type and expiry date, vehicle details and the photo on the document. Comparing your selfie with the photo on your ID uses your facial features. We treat this as sensitive personal data and only do it with your express consent.

Why. (i) To verify your identity and that your license is valid and current. (ii) To verify that the vehicle is registered and that the Host may offer it. (iii) To detect and prevent fraud, identity theft and altered documents. These purposes are necessary for your relationship with Pimo. Without them we cannot activate your account to rent or list vehicles.

Use of AI and human decision. To review your documents we use Google's Gemini model through Netlify's AI Gateway service. The tool only suggests a result: it reads the data, flags possible inconsistencies and, if you agreed, compares your selfie with your ID. The liveness check is reviewed by a person. No account is approved or rejected automatically: a member of Pimo's operations team reviews it and makes the final decision. At any time you may ask for another person to review the decision again, explain your situation, provide other documents, or object to your documents being reviewed with AI. In that case we will review them manually only, although verification may take longer. Email privacidad@getpimo.com with the subject "Human review". Vehicle registration cards may be approved automatically by Pimo’s document rules when the extracted plate, VIN and expiry pass all checks; uncertain cases require human review. This document approval does not approve an account, identity or insurance coverage.

Consent for the selfie comparison. Before we compare your selfie, you see this box, which is not pre-ticked: "I agree that Pimo may compare my selfie with the photo on my ID to confirm it's me and to prevent fraud. This comparison uses my facial features, which Pimo treats as sensitive personal data. Pimo uses an artificial intelligence tool (Google Gemini, via Netlify, in the U.S.) that only suggests a result. A member of the Pimo team makes the final decision. Google may retain prompts and responses for a limited period to detect abuse. If I don't agree, I can verify my identity by video call or when I pick up the car. I can withdraw this consent and request human review at privacidad@getpimo.com. See the Privacy Notice at getpimo.com/privacy." We record the date, time, account and version of the text you accepted.

AI support and operational assistance. When you use Pimo’s AI help channel, your question, recent conversation and the relevant status of your own selected booking or vehicle documents are processed by our AI provider to prepare a response. Pimo stores conversations and source references for support and follow-up under the message retention terms below. Authorized staff can review escalated conversations. Operational assistance also summarizes pending trips, document status, payment exceptions and incident records for authorized staff. The assistant does not execute booking changes, refunds or damage charges. Do not enter payment card details or upload identity documents in this chat. You can request a human response within the conversation.

Providers. Netlify, Inc. (U.S.) runs the infrastructure and the AI Gateway. Google LLC (U.S.), or the relevant Google entity, provides the Gemini model as a sub-processor of Netlify. These providers may process data in the U.S. and in other countries where they have facilities. Netlify does not store the content of requests or responses, but logs technical metadata about each call (date, model, usage), without images or text. Google may retain prompts and responses for a limited period to detect abuse.

Your choice. If you do not consent to the selfie comparison, or you withdraw your consent, you can verify your identity by video call or in person at handover. Withdrawal does not affect processing already carried out.

5. Service providers that process data for Pimo (processors)

Pimo sends personal data to providers that act as processors (encargados): they process it on Pimo's behalf, only on our instructions and under confidentiality obligations. Sending data to a processor is not a "transfer" under article 2, section XX of the Law, so it does not require your consent.

-

If you choose to sign in with Google, Google processes your sign-in under its own privacy policy.

6. Third-party services your browser connects to

To show maps and search addresses, your browser connects directly to these services, which receive your IP address and the technical data of the request:

These services act under their own terms and privacy policies. Pimo does not send them your name, email or documents.

7. Transfers of your data

We only transfer personal data to third parties in the cases allowed by article 36 of the Law, which do not require your consent:

If the operation of Pimo is assigned to a company, as described in the Terms, we will inform you in advance and, when the law requires it, ask for your consent. Pimo does not sell your personal data.

8. Processing outside Mexico

Our providers are mainly located in the United States, and your data is stored and processed there. We choose providers with contractual confidentiality and security obligations.

9. Automated decisions

AI assists with document review as described in section 4, including the limited automatic approval of vehicle registration cards. Identity, insurance and damage-charge decisions require human review. You can request human review at any time.

10. Cookies and browser storage

On our early-access registration page, if you accept advertising cookies, we use the Meta Pixel to measure visits and successful host applications and support advertising audiences. Meta receives browser and connection information, page URLs and event identifiers and may associate them with your Meta account. We do not intentionally send registration fields (name, email, phone or vehicle details) through this integration. You can reject these cookies and still register, or withdraw permission using “Cookie preferences” on that page. Browser blocking and withheld consent can prevent measurement.

We store your cookie choice for up to 180 days and opaque identifiers locally to avoid counting repeat submissions in the same browser. Meta may set its own advertising cookies. See Meta’s Privacy Policy at https://www.facebook.com/privacy/policy/. We also use browser technologies needed for the site to work:

You can delete this data in your browser settings. If you do, you will be signed out and some features may not work.

11. Your rights (ARCO) and how to withdraw consent

You have the right to access your data, rectify it if it is inaccurate, cancel it and object to its use (ARCO rights). You can also withdraw your consent, limit the use of your data for marketing, and ask for human review of decisions.

How to make a request. If you are signed in, you can request permanent account closure from Account → Profile. We record the request and respond by email after checking bookings, payments, disputes and legal retention duties. Your account stays accessible while we review it. You can also write to privacidad@getpimo.com from the email linked to your account, or from another email with proof of identity. Your request must include:

Deadlines. We will tell you our decision within 20 days from the date we receive your request. If it applies, we will carry it out within 15 days after we tell you. We may extend each period once, for the same length, when justified, and we will tell you why.

Cost. It is free. We may only charge for reproduction or shipping costs, as the Law allows.

When we may deny a request. When the identity or authority is not proven, we do not have the data, it affects the rights of a third party, a law or an authority prevents it, or it was already done. We will explain the reason and, when possible, fulfil the part of the request that is valid.

Cancellation. When we cancel data, we first block it and keep it only for the legal periods in section 12, and then delete it. We may keep data that we need to fulfil a contract with you or to comply with the law.

Withdrawing consent. You can withdraw your consent for the selfie comparison or for marketing at any time by the same channel. It does not have retroactive effect, and withdrawing consent for the selfie comparison means you will verify your identity by the alternative method.

Limiting marketing. Besides the opt-out options in section 3.2, you can register with PROFECO's Public Registry for Consumers (REPEP).

If you are not satisfied. If you disagree with our answer, or we do not answer within the deadline, you may file a data protection request with the Secretaría Anticorrupción y Buen Gobierno within 15 days after our answer or after the deadline expires.

12. How long we keep your data

We keep data only as long as needed for the purposes in this notice and the law. Then we block it and delete it.

13. Security

We apply administrative, technical and physical measures to protect your data against damage, loss, alteration, destruction and unauthorized use, access or processing. These include encrypted connections, access controls by role, access only for team members who need it, and contracts with our providers. If a security breach significantly affects your rights, we will notify you without delay so you can take steps to protect yourself.

14. Minors

Pimo is not for people under 18. We do not knowingly collect data from minors. If you think a minor has given us data, write to us and we will delete it.

15. Users in the United States and California

Pimo is operated from Mexico and this notice follows Mexican law. If you live in the United States, your data is processed as described here. Pimo does not sell or share personal information for cross-context behavioral advertising, as those terms are defined under California law. Promotional emails always include a working unsubscribe link, as U.S. law requires. If California or another U.S. state privacy law applies to Pimo, you may ask to know, correct or delete your data at privacidad@getpimo.com, and we will not discriminate against you for doing so.

16. Changes to this notice

We may update this notice because of changes in the law, our services or our providers. We will publish the new version with its date at getpimo.com/privacy and notify you by email or in the platform before important changes take effect. If a change requires your consent, such as a new secondary purpose or new sensitive data, we will ask for it first.

17. Data protection authority

The authority in charge of personal data protection in Mexico is the Secretaría Anticorrupción y Buen Gobierno (Anti-Corruption and Good Governance Ministry). You may go to it if you believe your rights have been violated.

18. Contact

Pimo, operated by John Patrick McCarthy Moreno

Lava 279-6, Jardines del Pedregal, 01900, Mexico City, Mexico

Privacy and ARCO rights: privacidad@getpimo.com