Courtesy translation. This is an English translation provided for convenience. The official, legally binding text is the Spanish-language Privacy Notice. In case of any discrepancy, the Spanish version prevails.
Privacy Notice
Last updated: September 26, 2026 · Version 3.0
iAudita, operated by TSCANCUN, S.A.S. de C.V. (the "Controller"), with fiscal address at Av Chapultepec #417 A PH Col. Juárez, Mexico City, 06000, Mexico, is responsible for the personal data collected on EFOSGratis.com, under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette (DOF) on March 20, 2025.
EFOSGratis.com is an iAudita website. This notice explains what data is collected on the site (when browsing, checking an RFC, joining the waitlist and signing up), what it is used for and how to exercise your rights.
Your account lives on iAudita. When you sign up from EFOSGratis.com (with the form or "Sign up with Google"), the account is created on the iAudita platform (app.iaudita.com). From then on, your account data —including your e.firma (FIEL) if you choose to connect it— is governed by the iAudita Privacy Notice (in Spanish) and the iAudita Terms & Conditions (in Spanish).
1. Controller
iAudita, operated by TSCANCUN, S.A.S. de C.V. Address: Av Chapultepec #417 A PH Col. Juárez, Mexico City, 06000, Mexico. Privacy Department: [email protected].
2. Data we collect on EFOSGratis.com
2.1 When you browse
- Visitor and session identifiers stored in first-party cookies (see section 5).
- IP address and approximate country (provided by our network provider, Cloudflare).
- Browser, operating system and device type.
- Pages visited, referring page and campaign parameters (for example, an ad's UTM tags).
- Usage events: scrolling, button clicks, time on page and loading performance.
2.2 When you check an RFC
- The RFC you type is used only to look it up in our copy of the SAT lists and is not stored.
- We record the result (for example, "not listed" or "definitive") without the RFC, to measure how the tool is used.
- To prevent abuse we count lookups per IP address and per visitor. If an IP repeatedly exceeds the limits, we keep that IP, its country and the number of attempts while the block lasts (7 days).
2.3 When you join the waitlist
Email address, approximate number of suppliers and clients, language, the page you joined from, whether you came from the button or after reaching the lookup limit, visitor and session identifiers, and approximate country.
2.4 When you sign up (data is sent to iAudita)
First and last name, email, phone, title, user type, promo code (optional) and password. The password is hashed in your browser before it is sent. EFOSGratis.com does not keep this data: it sends it to iAudita to create your account. To measure the site's effectiveness it only keeps a conversion record with your email in irreversible hashed form, user type, title, promo code and the first two digits of your phone number.
If you sign up with Google, iAudita handles the process; Google provides your name, email, profile picture and account identifier.
2.5 What we do not collect
EFOSGratis.com does not request sensitive personal data, nor your e.firma (FIEL), CIEC, digital stamp certificates or SAT passwords. If you choose to connect them, you do so inside iAudita, under its privacy notice.
Third-party information in the lookup. The lookup shows the name, RFC and status of taxpayers that the SAT publishes in the Official Gazette and on its portal under Articles 69-B and 49 Bis of the Federal Tax Code, a publicly accessible source. We reproduce it as published. If you appear in the lookup and believe the information is outdated, write to [email protected] so we can check our copy against the official publication; clarifications about your status before the SAT must be made with that authority.
3. Purposes
3.1 Primary purposes (necessary)
- Answering the RFC lookup.
- Protecting the site and the lookup against abuse, automated data extraction and fraud (lookup limits, IP blocking and reCAPTCHA).
- Sending your sign-up data to iAudita to create your account.
- Letting you know when list monitoring is available, if you joined the waitlist.
- Measuring site usage to improve it and learn which pages and campaigns work.
- Answering your requests and questions.
3.2 Secondary purposes (optional)
- Sending waitlist members related information about EFOSGratis and iAudita: news about EFOS and the 69-B list, launches and promotions.
- Producing aggregate statistics about site usage.
How to opt out of secondary purposes: every email will include a way to unsubscribe. You can also write at any time to [email protected] with the subject "Baja" (unsubscribe). Opting out does not affect the primary purposes.
4. Transfers and providers
- iAudita: receives your sign-up data to create your account. It is the same controller.
- Providers processing data on our behalf (no consent required): Cloudflare (content delivery and site security; may see your IP and country), Google (reCAPTCHA v3 always, and Google Analytics 4 only if you accept cookies) and SMTP2GO (email delivery).
- Competent authorities, when required by law.
Some of these providers may process data on servers outside Mexico, under contractual clauses offering protections equivalent to the LFPDPPP. We do not sell or rent your personal data.
5. Cookies and similar technologies
- strefv (first-party, 1 year): recognizes returning visitors for our own analytics and validates RFC lookups. Always used.
- strefs (first-party, 30 minutes of inactivity): groups the pages of a single visit. Always used.
- ef_cookie_consent (browser local storage): remembers your cookie choice.
- Google reCAPTCHA v3 (third-party): tells people from bots at sign-up. Always loaded, based on our legitimate interest in preventing fraud.
- Google Analytics 4 (third-party): usage statistics. Only enabled if you accept cookies in the site banner.
If you choose "Reject", Google Analytics is not enabled; the first-party cookies and reCAPTCHA remain active because the site and the lookup need them to work and stay protected. To change your choice, clear this site's cookies and storage in your browser; the banner will appear again.
6. Retention
- Browsing data, events and conversion records: up to 24 months; after that they are deleted or kept only in aggregate form.
- IP blocked for abuse: 7 days.
- Waitlist: until you unsubscribe or, at most, 24 months after your last sign-up.
- The RFC you look up is not kept.
- Your account data is kept by iAudita under its privacy notice.
7. ARCO rights and withdrawal of consent
You have the right to Access, Rectify, Cancel or Object to the processing of your personal data, and to withdraw your consent. Send your request to [email protected] or to the address above.
Under Article 28 of the LFPDPPP, the request must include: the data subject's name and address or means to receive the answer; valid official ID of the data subject or, where applicable, the legal representative's power of attorney; a clear description of the data concerned; and any document that helps locate it.
Under Article 31 of the LFPDPPP, we will inform you of our decision within twenty days of receiving the request and, if applicable, carry it out within the following fifteen days. Both periods may be extended once for an equal period when justified, with notice to you.
8. Limiting the use or disclosure of your data
You can unsubscribe from emails at any time (section 3.2) and reject analytics cookies (section 5). You can also register with PROFECO's Public Registry to Avoid Advertising (REPEP).
9. Security measures
We apply administrative, technical and physical measures: TLS encryption on all connections, network and attack protection through Cloudflare, databases reachable only from our own server, credentials stored outside the website, access restricted to authorized staff, passwords hashed in your browser before being sent, and abuse monitoring.
10. Security breaches
Under Article 19 of the LFPDPPP, if a breach significantly affects your rights, we will inform you immediately —and in any case within 72 hours of confirming it— so you can take the appropriate measures.
11. Authority
If you believe your right to personal data protection has been violated, you may contact the Secretaría Anticorrupción y Buen Gobierno (gob.mx/buengobierno), the supervisory authority under the current LFPDPPP.
12. Changes to this notice
We will publish any change on this page and update the "Last updated" date. If a change is substantial, we will highlight it on the site and, if we have your email from the waitlist, send it to you.
13. Contact — Privacy Department
Under Article 29 of the LFPDPPP, iAudita has a Privacy Department that handles ARCO requests and any questions about the processing of your data.
Privacy Department
Av Chapultepec #417 A PH Col. Juárez, Mexico City, 06000, Mexico
Privacy: [email protected] · Support: [email protected]
Last updated: September 26, 2026 · Version 3.0 · Under the current LFPDPPP (DOF 03-20-2025)
See also the EFOSGratis.com Terms of Use.