Privacy Notice

[PENDING: legal entity name], with registered address at [PENDING: full tax address] and tax ID [PENDING: RFC], is responsible for processing your personal data.

For any question about this notice, write to us at pedidos@nayoescobar.com.

When you place an order we collect your name, email address, phone number and shipping address.

Your card details are captured and processed directly by Stripe. We never store card numbers or security codes.

We automatically record which steps are taken in the store — visit, cart, attempted payment — and which channel the visit came from. That record includes no name, email address or IP address, and is described below.

To process and deliver your order, issue the corresponding receipt and provide shipping updates.

To handle enquiries, returns and support requests.

To send you news about new releases, only if you gave us your consent.

Stripe, Inc. — payment processing. Your card details are captured on their servers, not ours.

Supabase, Inc. — hosting of the database that holds your order and shipping address, on servers located in the United States.

Vercel, Inc. — hosting of the site.

Resend — order confirmation and tracking emails.

[PENDING: shipping carrier(s)] — delivery of your order.

We do not share your data with advertising platforms. Were we to enable Google Analytics or the Meta Pixel in future, this notice would be updated first.

We do not sell or rent your personal data to third parties.

You may request access to, rectification, cancellation of, or object to the processing of your personal data at any time, and withdraw your consent.

Send your request to pedidos@nayoescobar.com stating your full name, the right you wish to exercise and a contact method. We will reply within 20 business days.

Your cart is kept in your browser’s local storage so you do not lose it if you reload the page or come back later. It stays on your device: it does not reach our servers until you choose to pay.

We also keep a visit identifier that is discarded when you close the tab. It lets us tell that the steps of one visit belong to the same visit. It cannot recognise you if you return tomorrow.

If you arrived from a campaign link, a social network or another site, we keep where you came from for 30 days, so we know which outreach works. It records the source, not who you are.

You can delete all of the above at any time from your browser settings, under site data. The store keeps working without it; you will only lose your cart.

Measurement is done by the store itself, not by a third party. We count how many visits arrive, how many add to the cart and how many buy, along with the channel they came from. None of it is tied to your name, your email or your IP address.

For security, to stop anyone flooding the store with automated requests, we keep a hashed fingerprint of the address requests come from for one hour. The fingerprint is irreversible: we do not keep IP addresses and they cannot be recovered from what is stored.

Should we enable Google Analytics or the Meta Pixel in future, both would set those companies’ own cookies and you would be told on this page before that happens. As of the last update to this notice, neither is active.

Any change to this Privacy Notice will be published on this page, stating the date it was last updated.