Privacy notice
Last updated: October 19, 2026
Argonaut Fleet, Inc. ("Argonaut," "we," "us," or "our") respects your privacy and is committed to protecting the personal data entrusted to us. This Privacy Notice explains how we collect, use, disclose, transfer, retain and safeguard personal data in connection with Sherlock Searches, the choices and rights available to you, and how we comply with applicable data protection laws, including United States federal and state privacy laws, Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (the "LFPDPPP"), and, where applicable, the European Union's General Data Protection Regulation ("GDPR") and the UK GDPR.
This Notice applies to the website at sherlocksearches.com (the "Website") and to the Sherlock Searches application and services (the "Platform" or "Services"). A Spanish-language version (Aviso de privacidad) is also available.
1. Who we are
Sherlock Searches is developed, operated and marketed by Argonaut Fleet, Inc., a corporation organized under the laws of the State of Delaware, United States, which is the controller of your personal data (the responsable under the LFPDPPP). For purposes of the LFPDPPP, Argonaut's address is Campos Elíseos 403, Col. Polanco II Secc., Alcaldía Miguel Hidalgo, 11530, Mexico City, Mexico. The full contact details appear at the end of this Notice.
Prometeo Legal, S.A.P.I. de C.V. is Argonaut's collection agent in Mexico. In that capacity it processes, on Argonaut's behalf and only to the extent strictly necessary, the data required to process payments and issue tax invoices.
2. The two kinds of personal data we handle
Sherlock Searches handles personal data in two distinct contexts, and your rights and our obligations differ depending on which applies.
- User data. Data about the individuals who create and use an account, billing contacts, Website visitors and people who contact us. Argonaut determines why and how this data is processed and acts as its controller.
- Research data. Information about the entity whose RFC (Mexican tax ID) a user enters and, where applicable, about its legal representative and the persons who appear in its public records. This information comes from publicly accessible sources and official registries and is compiled at the user's request. Argonaut processes it to operate the Platform and deliver reports. The user who obtains a report is independently responsible for how they use it, including any further processing of the personal data it contains, and must comply with the laws that apply to that use.
3. No sale of personal data
Argonaut does not sell personal data and does not "share" personal data for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and comparable U.S. state laws. We do not exchange, rent or otherwise disclose personal data to third parties for monetary or other valuable consideration, we do not engage in targeted advertising, and we do not offer financial incentives or different prices in exchange for personal data. Where required by applicable state law, we recognize opt-out preference signals such as the Global Privacy Control.
4. Definitions
"Personal data" (or "personal information") means information that, alone or combined with other information, identifies, relates to, describes or could reasonably be linked with a particular individual, as defined under applicable law. "Sensitive personal data" means the categories given special protection under applicable law, such as government-issued identifiers, account log-in credentials, precise geolocation, health data and the other categories listed in those laws, as well as datos personales sensibles under the LFPDPPP and "special categories" of data under the GDPR. A "controller" decides why and how personal data is processed; a "processor" processes personal data on behalf of, and on the instructions of, a controller.
5. Personal data we collect
From users
- Account and authentication data: name, email address and an account identifier. If you create an account with email and password, your password is stored only in hashed form by our authentication provider; we never see it. If you sign in with Google or Microsoft, we receive from that provider only your name, email address and an account identifier. If you sign in with a code sent by email, we receive only your email address. We do not receive or store your Google or Microsoft password.
- Organization data: the company you work for, when you provide it.
- Billing data, only if you request a Mexican tax invoice (CFDI): tax ID (RFC), legal name, tax regime, tax postal code, CFDI use and the email to receive it. You may also give us your country.
- Transaction and usage data: the searches you run (RFCs searched, type of search, dates and results), your credit balance, movements and expiration dates, your payments and receipts, your preferred language and the requests you submit.
- Communications and support data: the content of your inquiries and communications with us.
Card and payment method data is received and processed directly by our third-party payment processor. Neither Argonaut nor Prometeo Legal stores it.
From visitors who search without an account
If you run a free basic search without an account, we keep the RFC you searched, the date and time, the results, a random identifier of your browser and a one-way (hashed) version of your IP address. We use them to show you the result, to apply the limit of free searches per day and to move the search to your account if you later create one.
Collected automatically (site measurement)
When you visit the Website or use the Platform, we collect, with our own first-party measurement tool and our hosting provider, the following information to secure the service, prevent abuse of the free searches, understand how visitors find and use Sherlock Searches, and improve it:
- a random visitor identifier (kept for up to 2 years) and a session identifier (30 minutes of inactivity), and the date of your first visit;
- the pages and screens you view, the time you spend on them, the main buttons you click, and key actions such as searches (including the RFC searched), limits reached, sign-ups, sign-ins, purchases and downloads;
- how you arrived: the referring website and campaign tags in the link (such as utm parameters and click identifiers from search engines and social networks);
- your IP address and the approximate location derived from it (country, region, city and approximate coordinates, never your precise location), and your time zone;
- your device type, operating system, browser, screen size, browser language settings and user agent; and
- your cookie choice.
When you sign in or create an account, this information is linked to your account, including where you came from when you signed up. We do not use it for advertising and we do not sell or share it for cross-context behavioral advertising. If we enable a product analytics service provider, it processes this information only on our behalf and under our instructions.
Research data
Depending on what the sources publish, a report may include: name or legal name, RFC, CURP (Mexican personal ID number), tax status and the lists published by the Mexican Tax Administration Service (SAT), matches against the sanctions lists of the United States government and the United Nations Security Council, the REPSE registry, trademarks registered with the Mexican Institute of Industrial Property, security interests recorded in the Registry of Security Interests over Movable Property (RUG), the National Registry of Foreign Investment, corporate records from the Public Registry of Commerce, court records and mentions in public internet sources. Some of these items, such as government-issued identifiers and court records, may be sensitive personal data under certain laws; we process them only to provide the Services.
The verifiable certificates issued by the Platform do not include the CURP, date or place of birth, sex or email addresses of the persons investigated.
Sensitive personal data of users
Argonaut does not require or request sensitive personal data from its users. Please do not send us sensitive personal data that we have not requested.
6. Notice at collection
The table below maps the user data Argonaut collects as a controller to the categories used under California law.
| Category | Examples | Purpose | Disclosed to |
|---|---|---|---|
| Identifiers | Name, email address, account identifier, IP address | Account, sign-in, security, service notices | Hosting, authentication and email providers |
| Commercial information | Credits purchased and used, payments, investigations run | Providing the Services, billing, history in your account | Payment processor, Prometeo Legal |
| Professional information | Company you work for | Identifying who requested a certificate | Persons who verify a certificate |
| Internet activity | Visitor and session identifiers, pages and screens viewed, time on page, clicks on main buttons, searches, sign-ups and purchases, referring site and campaign tags, device, operating system, browser and screen | Security, preventing abuse of free searches, measuring and improving the site, understanding how visitors find us | Hosting, security and analytics providers acting on our behalf |
| Geolocation (approximate) | Country, region, city and approximate coordinates derived from the IP address, and time zone | Security, limits on free searches, statistics about our audience | Hosting and analytics providers acting on our behalf |
| Account log-in (sensitive) | Email address with a one-time code, or a Google or Microsoft account | Signing you in securely | Authentication providers |
We retain each category for as long as needed for the purposes above, typically for the life of your account, plus any additional period required to meet legal, tax and accounting obligations or to establish, exercise or defend legal claims, after which we delete or de-identify it. We use sensitive personal information only to provide and secure the Services, and not to infer characteristics about you.
7. How and why we use personal data
Primary purposes, necessary for the service:
- creating and managing your account and enabling sign-in;
- running the investigations you request and generating reports, the Risk analysis, certificates and PDF and CSV downloads;
- keeping the history of investigations, credits and payments in your account;
- processing payments and issuing tax invoices;
- responding to your requests and sending service notices;
- securing our systems and preventing fraud, abuse and unauthorized use, including enforcing the daily limits on free searches; and
- complying with legal and regulatory obligations and responding to requests from competent authorities.
Secondary purposes, not necessary for the service: sending you information about Sherlock Searches features, news and events, and measuring how visitors find and use the Website and Platform (site analytics) to prepare statistics and improve our services. You may object to these purposes at any time by writing to privacy@sherlocksearches.com. Objecting will not affect the service you receive.
Where the GDPR applies, we rely on the performance of a contract, our legitimate interests (balanced against your rights), compliance with legal obligations and, where required, your consent, which you may withdraw at any time. U.S. privacy laws do not require a legal basis for processing; we limit our use to the purposes disclosed in this Notice.
8. Artificial intelligence and automated processing
The Platform uses rules defined in advance and artificial intelligence techniques, including third-party large language models, to organize the information gathered, calculate a risk level, draft the Risk analysis, read documents and translate content.
- No model training. Argonaut does not use user data or research data to train, fine-tune or otherwise improve its own or any third party's general-purpose models, and binds its AI service providers by contract to the same restriction.
- Decision support, not advice. The risk level and the Risk analysis are informational. They may contain errors or omissions, require human review and do not constitute legal, tax, accounting or other professional advice.
- No automated decisions by Argonaut. Argonaut does not make decisions about any person. Any decision based on a report is made by the user, who must review it.
- Your rights. Where applicable law provides (including the LFPDPPP, the GDPR and the EU Artificial Intelligence Act), you may obtain meaningful information about automated processing that significantly affects you, request human intervention and object to such processing.
9. When and with whom we share personal data
- Service providers and processors that act on our behalf, such as cloud hosting and infrastructure, authentication, email delivery, payment processing, information lookup services, AI and text processing, and security tools, under contracts that require them to protect the data and use it only to provide their services to us.
- Prometeo Legal, S.A.P.I. de C.V., as Argonaut's collection agent in Mexico, only for collection and invoicing.
- Persons who verify a certificate. Anyone who holds a certificate's reference number and verification code, for example through its QR code, can view that certified report and the name and company of the user who requested it. Share certificates only with people who need them.
- Legal, regulatory and safety recipients, to comply with applicable law, legal process or an enforceable request from a competent authority, to enforce our agreements, or to protect the rights, property and safety of Argonaut, our users or others.
- Corporate transactions, such as a merger, acquisition, financing, reorganization or sale of assets, subject to appropriate confidentiality protections.
- With your direction or consent, for other purposes you direct or to which you consent.
Under the LFPDPPP, these transfers do not require your consent when they fall within the cases provided by that law.
10. International data transfers
Argonaut operates across the United States and Mexico and uses service providers that may be located in other countries. Personal data may therefore be transferred to, stored in and processed in countries other than the one in which it was collected. Where we transfer personal data internationally, we implement the safeguards required by applicable law, which may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and appropriate technical and organizational measures. To request more information about these safeguards, contact us using the details below.
11. Data retention, blocking and deletion
We retain personal data for as long as necessary to fulfill the purposes described in this Notice and to comply with our legal, tax and accounting obligations, after which we delete or de-identify it. Where the LFPDPPP applies, we observe its blocking-and-deletion process at the end of the applicable retention period. Issued certificates are kept unaltered so that they can continue to be verified.
12. How we secure personal data
We maintain administrative, technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration and disclosure, including encryption in transit and at rest, access controls based on least privilege, security monitoring and logging, and security due diligence of our providers. No security program can guarantee absolute security. If a security incident affecting personal data triggers notification obligations under applicable law, we will notify affected individuals and the relevant authorities as, and within the timeframes, required.
13. Your privacy rights
The rights available to you depend on where you are and the law that applies. We will not discriminate against you for exercising your rights.
Rights that may apply to everyone
Depending on applicable law, you may have the right to access the personal data we hold about you, correct inaccurate data, request deletion, object to or restrict certain processing, withdraw consent and obtain a portable copy of certain data. If you are a person whose information appears in a report, you may also write to us.
United States
The United States does not have a single comprehensive federal privacy law. A growing number of states have enacted comprehensive consumer privacy laws, and we honor the rights they grant to the residents they protect. Most of these laws apply only to individuals acting in a personal or household capacity and exclude data processed in a business-to-business or employment context. California is the exception, so California residents may exercise these rights even in a business context.
Subject to the law that applies to you and to legal exceptions, you may have the right to: confirm whether we process your personal data and access it, including, in California, the categories and specific pieces of personal information collected, the categories of sources, the purposes and the categories of recipients; correct inaccurate personal data; delete personal data, subject to exceptions; obtain a portable copy; opt out of sale, sharing, targeted advertising and profiling (Argonaut does none of these, so there is nothing to opt out of); limit the use of sensitive personal information (California); withdraw consent; and not be discriminated against for exercising your rights. California Civil Code section 1798.83 ("Shine the Light"): we do not disclose personal information to third parties for their own direct-marketing purposes.
Exercising your U.S. rights. Email privacy@sherlocksearches.com. We will take reasonable steps to verify your identity before responding. You may use an authorized agent, and we may require proof of the agent's authorization. We will respond within the time required by law, generally within 45 days, with an extension of up to 45 additional days where reasonably necessary. Where state law provides a right to appeal our decision, you may appeal by writing to the same address; if we deny the appeal, we will tell you how to contact your state attorney general.
Mexico: ARCO rights
If the LFPDPPP applies, you or your legal representative have the rights of Access, Rectification, Cancellation and Opposition ("ARCO rights"), and you may revoke your consent, limit the use or disclosure of your data and object to automated processing that significantly affects you. To exercise them, write to privacy@sherlocksearches.com indicating: (i) your name and a means to receive our response; (ii) documents proving your identity or, where applicable, your legal representation; (iii) a clear and precise description of the data and the right you wish to exercise; and (iv) any information that helps locate the data. We will respond within the timeframes set by the LFPDPPP. Revocation of consent may not be possible when a legal obligation or a legal relationship requires the processing. If you believe your right to the protection of personal data has been violated, you may contact the Secretaría de Anticorrupción y Buen Gobierno (SABG), which assumed the data protection functions formerly held by the INAI.
European Economic Area and United Kingdom
If the GDPR or UK GDPR applies, you have the rights of access, rectification, erasure, restriction, objection and data portability, and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except as permitted by law. You may lodge a complaint with your local supervisory authority.
14. Cookies and browser storage
We use first-party cookies and browser storage (local and session storage). We do not use advertising cookies.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Sign-in session | Essential | Keeps you signed in to your account | Until you sign out |
| ss_idioma | Essential (preference) | Remembers your language | Until you clear it |
| ss_consent | Essential | Remembers your cookie choice | 1 year |
| ss_anon | Essential | Lets you reopen the free searches you ran without an account in this browser | Until you create an account or clear it |
| ss_vid | Essential and analytics | Random identifier of your browser: applies the daily limit of free searches and, if analytics are on, measures visits | 2 years |
| ss_sid, ss_ult, ss_ref, ss_utm, ss_geo | Analytics | Session, how you arrived and approximate location for site measurement | The browser session (30 minutes of inactivity) |
| ss_primera, ss_origen | Analytics | Date and source of your first visit | Until you clear them |
Your choice. If you are in the European Economic Area, the United Kingdom or Switzerland, we ask for your consent before sending any analytics. Elsewhere, analytics are on unless you choose "Only essential" in the cookie banner or in "Cookie settings" at the bottom of every page, and we treat a Global Privacy Control signal from your browser as a choice of "Only essential". Essential cookies and storage are needed for the service and cannot be turned off from the banner; you can delete them in your browser settings, but some features, such as the free search, may stop working.
15. Children's privacy
The Website and Services are intended for businesses and professional users and are not directed to children. We do not knowingly collect personal data from children under 13, in line with the Children's Online Privacy Protection Act ("COPPA"), or from minors in general. If you believe a child has provided us personal data, contact us and we will delete it.
16. Third-party links
Reports may include links to official sources, such as the sanctions lists of the U.S. government. This Notice does not apply to those third parties, and we are not responsible for their privacy practices.
17. Changes to this notice
We may update this Privacy Notice from time to time. When we do, we will revise the "Last updated" date above and publish the current version on this page. If changes are material, we will provide additional notice where required by law.
18. How to contact us
- Privacy requests: privacy@sherlocksearches.com
- United States: Argonaut Fleet, Inc., Attn: Privacy, c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, County of Sussex, DE 19958, USA.
- Mexico (ARCO requests): Argonaut Fleet, Inc., Campos Elíseos 403, Col. Polanco II Secc., Alcaldía Miguel Hidalgo, 11530, Mexico City, Mexico.
- EU and UK representative (GDPR Article 27, where applicable): Ronda de Poniente 12-2, 28760 Tres Cantos, Madrid, Spain.
Because Argonaut operates exclusively online and has a direct relationship with its users, email is our designated method for submitting privacy requests.