Privacy Notice

Last updated: October 1, 2026

Who is responsible for your data

Pinto y Corral Constructora e Inmobiliaria, Materiales y Servicios, S.A. de C.V. ("PINNCOR"), with registered address at Cerrada Misión 124, San Felipe Tlalmimilolpan, Toluca, State of Mexico, C.P. 50250, Mexico, is the data controller for the website lapalabradeifa.com and for the La Palabra de Ifá apps for iPhone and Android (together, the "Service"). This Notice covers the website and both apps.

Contact for anything about your data: contacto@lapalabradeifa.com · phone +52 729 128 9964.

This Notice is issued under the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and, for people in the European Union or the European Economic Area, under the General Data Protection Regulation (GDPR).

1. Personal data we collect

• Account (optional in the apps): in the apps you can read without an account; it is asked for only to back up your notebook to the cloud and to buy (the purchase is linked to your account and also opens the website). On the website, the account gives access to the preview and to the content you have bought. We keep your email address and, where you create the account on the website with a password, the password in encrypted form and, if you enter it, your name (optional). If you sign in with Apple, Apple gives us your email address (or, if you choose to hide it, a relay address that does not reveal it) and, the first time, your name. If you sign in with Google, Google gives us your email address, your name and the address of your profile picture. From the apps you can also sign in with a one-time code sent to your email.
• Sign-up from the app: if you create your account in the app, we also keep the app language, the fact that the account was created in the app and that you accepted the Terms and this Notice when you continued, with the date.
• Year of birth: on creating the account, or on first signing in, the User is asked for the date of birth solely in order to verify that the User is of age; only the year is retained (the day and month are not stored), together with the time of that confirmation. See clause 1 ter.
• Your notebook (apps, only with your express consent): what you write in the app notebook (your own readings and their works, the readings you give to other people, your vault of signs, the text of your itás, the prayers of your house, your notes per sign and your favorites) is backed up to your account so that it is with you on all your devices. See clause 1 bis.
• Voice notes on itás: they are stored on your phone and are not backed up to your account. When you transcribe a voice note, the app uses the phone's offline speech recognition when the device allows it; otherwise the audio is processed by Apple's or Google's speech recognition.
• Your devices: for each phone or browser in which your account is open we keep its type (iPhone app, Android app or browser), model, app version, time of last use, the technical identifier of its session and an installation identifier: a random code the app creates when it is installed (in the browser, when you sign in) that says nothing about you. On iPhone that code is stored in the phone's keychain, so it is kept even if you delete and reinstall the app. It is used to count your devices (three at most) and to let you sign one out remotely.
• Purchases in the apps: they are charged by Apple (App Store) or Google (Google Play); we never see your card. We keep the transaction identifier (Apple) or the purchase token (Google), the product bought and the date the paid period ends, so that the content also opens on the website with the same account.
• Payments on the website: closed today. When they exist, they will be processed by Stripe; we will not see your card and will only receive the status of your subscription and a customer identifier. If before October 2026 you reserved a price on the website, we keep the name, email, plan and term you gave us, in order to honour what you were offered and to write to you when website payments open.
• Security log: to stop abuse when signing in with a code from the apps, we record each code sent and each failed attempt together with an encrypted fingerprint (HMAC) of your email address and your IP address. The fingerprint is used to count attempts, not to know who you are, and is kept for 180 days. In addition, our account provider (Supabase) records the IP address and browser of each sign-in, for security.
• Usage of the website: the pages visited, time spent, country of access, device and browser type, and referring source. This includes which Odù you consult. It is collected by the measurement tools in clause 2, and those that use cookies only if you accept them.
• "Tu camino" ("Your path"), optional and only with your express consent: if you complete that section of "My account", we keep your role in the religion (aleyo, santero or babalawo), your personal Odù and, if you are a babalawo, your two witnesses of the cuarto de Ifá; your Osha, Ifá and Mano de Orula anniversaries; and the Odù you mark with the heart.
• Reviews (optional): the name you sign with (it may be your religious name) and the text you write. If we approve the review, both are published on the home page, visible to anyone. We publish every genuine review, whatever its rating; we only reject insults, spam or other people's personal data.
• Referrals (optional): if you share your link, we keep a code linked to your account. When someone subscribes with it, we keep who referred, who bought, that person's email address and the plan, in order to credit the free month.

1 bis. Sensitive data: your path and your notebook

What you save under "Tu camino" (your role, your Odù, your witnesses, your initiation dates and the Odù you mark with the heart) reveals your religious beliefs. Mexican data protection law calls this sensitive personal data and the GDPR treats it as a special category (article 9). That is why we only keep it with your express consent: in "My account" there is an unticked box that you must tick yourself before anything is saved, and we record the date you did so.

• Providing it is voluntary. The Service works exactly the same without it: you can explore the 256 Odù, subscribe and use everything else without filling in a single field of that section.
• No other user can see it. The database applies row-level rules: neither another subscriber nor a visitor can read your profile. As administrators we have technical access to the database (we could not run it otherwise), but we use it only to fix a problem, never to browse.
• We use it for nothing else. We do not combine it with the measurement in clause 2, do not send it to third parties, do not build profiles or advertising with it and do not sell it. It serves one purpose: to draw your panel and remind you how long until your next anniversary.
• You can erase it at any time. Clear a field and it disappears immediately. If you delete your account, everything goes with it: your profile, your notebook, your favorites, your devices and your review (see how to delete your account).

Your notebook in the cloud

The app notebook says even more about you: which signs have come to you, which saints and powers you have received, which works were prescribed, what you pray in your house. It is also sensitive data, and that is why it is never uploaded to your account without your express authorization: the app asks with a box you must tick yourself, and we record when you accepted and which version of this Notice you had in front of you. If you do not tick it, the app works the same and your notebook stays only on your phone; you can turn on backup later from Profile.

• It serves one purpose: that your notebook is not lost if you change phones and that you have it on all your devices. We do not read it, analyse it, combine it with anything or use it for advertising or profiling.
• Other people's data. In "Las que doy" ("The ones I give") you record whom you gave a reading to and what came out. That is third-party data, and sensitive. By saving it you confirm that the person knows you record it and agrees; if not, do not write their name. If someone asks us to erase what concerns them in your notebook, we will let you know.
• Deleting is deleting. What you delete from your notebook is deleted from our servers at that moment; only an empty marker, without content, remains so that it disappears from your other devices.
• Withdrawing your consent. You can do it at any time in the app, under Profile, with "Stop backing up my notebook" ("Dejar de respaldar mi libreta"): your notebook (readings, readings given, vault of signs, itás and prayers of the house) is erased from the cloud and stays only on your phone. Favorites and notes on the website are not touched. You can also ask by writing to contacto@lapalabradeifa.com, and deleting your account also withdraws it and erases everything backed up immediately.

Reviews are different and should not be confused with the above: what you write there is public on purpose. If you sign with your religious name or tell your path, that information becomes visible on the home page. Publish it only if that is what you want; you can edit or delete it at any time from your account.

1 ter. Adults only

La Palabra de Ifá is intended solely for persons 18 years of age or older: the Content addresses adult subject matter (sexuality, violence, suicide and illness) and the Service involves payments. For that reason, on creating the account or on first signing in, the User is asked for the date of birth solely in order to verify that the User is of age; only the year is retained. Where the date indicates that the User is under 18, no account is created (or the session is closed) and nothing of it is retained. PINNCOR does not collect data from minors: where an account is found to belong to a person under 18, it is deleted together with all of its data.

2. Cookies, local storage and measurement

The website uses these third-party tools to understand how it is read, to find defects and to protect itself from bots:

• Cloudflare Web Analytics: counts visits in aggregate. It uses no cookies and identifies no one. It applies to every visit and needs no consent, because there is nothing to consent to.
• Cloudflare Turnstile: checks that you are a person and not a bot when you create your account, sign in or recover your password. To do so it analyses technical data from your browser at that moment. It is not used for measurement or advertising.
• Google Analytics 4: measures visits and paths through the website. It uses cookies and assigns your browser a random identifier. We do not send it your name or email. It is loaded only if you accept it.
• Microsoft Clarity: records an anonymous replay of your visit (where you move, where you tap, where you get stuck) so we can see what gets in the way of reading. It uses cookies. It runs only if you accept it, and never on your account pages, payment pages or personal panel. Text fields are masked and what you type is not recorded.

How it is decided, exactly

On arrival you see a notice with two identical buttons: «Accept» and «Essential only». There is no hidden option and no pre-ticked box.

• If you accept: Google Analytics and Microsoft Clarity are loaded.
• If you choose «Essential only»: neither is loaded and any measurement cookies already present are deleted.
• If you do not answer: neither is loaded either, wherever you live. Your visit is counted only by Cloudflare Web Analytics, without cookies.

You can change your mind at any time with the «Cookie preferences» link at the foot of any page or with the buttons below. We ask everywhere, not only where European law requires it, because Odù are consulted here and Osha and Ifá anniversaries are recorded: that speaks of your beliefs and deserves to be asked first.

The website's typefaces are served from our own domain: your browser does not request them from any third party.

You can disable Google measurement by installing the Google Analytics Opt-out Browser Add-on. Blocking cookies in your browser also stops it; the website keeps working the same.

3. What we use your data for

• To give you access to the content of your plan and keep you signed in.
• To back up your notebook and keep it the same on all your devices, only if you authorized it (clause 1 bis).
• To control sessions: your account can be open on at most three devices at once, and from any of them you can see the others and sign one out remotely.
• To open the website with what you bought in the app: we ask Apple or Google whether your purchase is valid and, if it is, link it to your account.
• To protect accounts: limiting sign-in attempts and detecting abuse (security log in clause 1, Turnstile).
• To know who uses the app: how many accounts there are, on which platform and version, to support you when you write and to decide what to improve. We look at it in aggregate, not by following anyone.
• To tell you about matters concerning your account or the Service.
• News (optional): only if you tick its box when creating your account, to send you occasional emails with what is new. You can unsubscribe at any time by writing to contacto@lapalabradeifa.com; stopping them does not affect your account or plan.
• To measure how the website is used and fix what does not work (only with the tools you accept, apart from Cloudflare's aggregate count).

We do not sell or rent your personal data, and we do not give anyone your name, email address or subscriber status for commercial purposes. We understand the religious nature of this Service: your membership of it is your own business.

Legal bases (if you live in the European Union or the European Economic Area)

• Performance of the contract: your account, access to what you bought, checking your purchases with Apple or Google, device control and account notices.
• Your consent: the sensitive data in "Tu camino" and in your notebook (article 9(2)(a) GDPR), measurement cookies (Google Analytics and Microsoft Clarity) and news emails. You can withdraw it at any time, without affecting what was processed before.
• Legitimate interest: account security (security log and Turnstile) and the aggregate, cookie-free count of visits.
• Legal obligation: keeping the purchase and invoice records required by tax law.

4. Who we share data with, and international transfers

With the technical providers we need to run the Service, which process data on our behalf and under their own data-protection commitments:

• Supabase: database and accounts (including your backed-up notebook and the security log).
• Cloudflare: infrastructure, delivery of the website, Turnstile and aggregate statistics.
• Resend: sending emails (the app sign-in code and account notices).
• Google: Sign in with Google, Google Play purchases, Android speech recognition if you use Transcribe and, only if you accept it, Google Analytics measurement.
• Apple: Sign in with Apple, App Store purchases and iPhone speech recognition if you use Transcribe.
• Microsoft: anonymous recording of the visit (Clarity), only if you accept it.
• Stripe: website payments, when website payments are open.

International transfers. Supabase, Cloudflare, Resend and Google process data in the United States (Cloudflare also across its worldwide network of data centres); Apple, Microsoft and Stripe may also process it outside Mexico. These are disclosures to providers that process the data on our behalf and only to provide their service to us. For data of people in the European Union, these transfers rely on the safeguards each provider offers (the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses, as the case may be).

We make no other transfer without your prior consent, unless the law requires it.

5. Advertising

The website shows no third-party advertising and uses no advertising cookies. To people without a paid plan we show promotions from our own house (our plans, the app, the Letter of the Year), without cookies or tracking. Should we ever decide to show third-party advertising, we will update this Notice before the first ad appears. We will never sell your data to advertisers or allow you to be profiled because of your religious affiliation.

6. Your rights

ARCO rights. You may request access to your data, its rectification or cancellation, or object to its processing, and you may also revoke your consent or limit the use of your data. Write to contacto@lapalabradeifa.com from your account's email address, saying what you request and about which data; if you write from another address, we will ask for what we need to check that the account is yours. We answer within 20 business days and, where appropriate, carry it out within the following 15 business days. These rights are the same wherever you live. If you believe we did not handle your request properly, you may go to the Mexican personal data protection authority.

If you live in the European Union or the European Economic Area, you also have the right to restriction of processing and to data portability, to withdraw your consent at any time and to lodge a complaint with the data protection authority of your country.

Deleting your account. You do it yourself, immediately: in the app (Profile → Delete my account) or on the website (My account). You can also ask us by email. The steps, what is deleted and what is kept are explained at lapalabradeifa.com/en/delete-account. A subscription bought on the App Store or Google Play is cancelled in that store: we remind you before deleting.

Withdrawing your consents. For "Tu camino", by clearing that section in your account (immediate effect) or by writing to us. For your notebook, in the app (Profile → "Stop backing up my notebook", which erases the notebook from the cloud and keeps it only on your phone) or by writing to us. For measurement cookies, with «Cookie preferences» at the foot of any page.

7. Retention and security

Your data is kept for as long as your account exists. When you delete it, it is erased from our database immediately, with two exceptions: the security log, which is erased after 180 days, and purchase records, which Apple, Google or Stripe keep under their own legal obligations. Google Analytics statistics (if you accepted them) are kept by Google under its own periods, currently no longer than fourteen months; Microsoft Clarity recordings expire on its servers within thirty days of each visit.

We use encryption in transit (HTTPS), hashed passwords and row-level access rules that prevent the content and the data from being read by third parties.

8. Changes to this Notice

Any change will be published here with the date on which it takes effect. Continued use of the Service after a change means you accept it, with one exception: if the change affects what we use the sensitive data in "Tu camino" or your notebook for, we will not treat it as accepted just because you keep using the Service. We will ask you again and you may refuse without losing any content or subscription entitlement.