Privacy Notice

Last updated: August 8, 2026

PINNCOR ("PINNCOR", "we", "us" or "our"), with registered address at Cerrada Misión 124, San Felipe Tlalmimilolpan, Toluca, State of Mexico, C.P. 50250, Mexico, in its capacity as data controller in respect of the website lapalabradeifa.com (the "Site"), issues this Privacy Notice pursuant to the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and its implementing regulations.

1. Personal data collected

• Account data: name, email address and a password retained in encrypted form.
• Founder's-price reservations: name, email address, and the plan and term elected.
• Payment data: processed by Stripe, Inc. PINNCOR neither receives nor retains card numbers; we receive only the status of the subscription and a customer identifier.
• Usage data: the pages visited, time spent, country of access, device and browser type, and referring source. This includes which Odù a User consults. Such data is collected by the measurement tools described in clause 2.
• "Tu camino" ("Your path") profile data (optional): where the User completes that section of "My account", PINNCOR retains the User's role in the religion (aleyo, santero or babalawo), the User's personal Odù and, in the case of a babalawo, the two witnesses of the cuarto de Ifá; the anniversaries of Osha, of Ifá and of Mano de Orula; and the Odù marked as favorites.
• Review data (optional): the name under which the User signs —which may be a religious name— and the text submitted. Where a review is approved, both are published on the home page and are visible to any visitor.
• App waiting list (optional): the User's email address, where submitted in order to be notified upon release.
• Referral programme (optional): where the User shares their referral link, PINNCOR retains a code linked to the User's account. Where a person subscribes through it, PINNCOR retains who referred, who purchased, that person's email address and the plan contracted, in order to credit the free month. A User who arrives through another's link and subscribes should note that the referrer is able to see their email address alongside the month so earned.

1 bis. Sensitive data: the User's path in the religion

1 bis.1. The data retained under "Tu camino" ("Your path") (role, personal Odù, witnesses, dates of initiation and the Odù marked as favorites) reveals the User's religious beliefs. Such data constitutes sensitive personal data under Mexican data protection law, which requires that its processing be expressly declared, and a special category of personal data under article 9 of the General Data Protection Regulation. It is accordingly declared in express terms, so that the User may know it before entering anything:

• Provision is voluntary. The Site functions identically without it: the User may explore the 256 Odù, subscribe and use every other feature without completing a single field of that section.
• No other user can see it. The database applies row-level rules: neither another subscriber nor a visitor can read the User's profile. PINNCOR, as administrator, holds technical access to the database —the Site could not otherwise be operated— but exercises it solely to resolve a fault, and never to browse.
• It is put to no other use. It is not combined with the measurement described in clause 2, is not transmitted to third parties, is not used to construct profiles or advertising, and is not sold. It serves one purpose only: to render the User's panel and to indicate the time remaining until the next anniversary.
• It may be erased at any time. Clearing a field erases that entry immediately and unaided. Deletion of the account —which is requested from "My account" and effected within twenty (20) business days— erases with it the entire profile, the favorites and any review.

1 bis.2. By entering and saving such data the User gives express consent to its processing for the purposes stated. Where the User prefers that it not be processed, that section may be left blank; no content and no subscription entitlement is thereby lost.

1 bis.3. Reviews are of a different character and should not be confused with the foregoing: what the User writes there is public by design. Where the User signs with a religious name or recounts their path, that information becomes visible on the home page. It should be submitted only where that is the User's intention; it may be edited or deleted at any time from the User's account.

2. Cookies and measurement

2.1. The Site employs three third-party tools in order to understand how the Content is read and to identify defects. Their respective functions are as follows:

• Cloudflare Web Analytics: counts visits in aggregate form. It employs no cookies and identifies no individual. It applies to every visit and requires no consent, there being nothing to consent to.
• Google Analytics 4: measures visits and navigation paths. It employs cookies and assigns the User's browser a randomly generated identifier. Neither the User's name nor email address is transmitted to it.
• Microsoft Clarity: records an anonymous replay of the visit — movement, taps and points of difficulty — so that obstacles to reading may be identified. It employs cookies. It operates only where the User expressly accepts it, and never on the account or payment pages.

2.2. Upon arrival the User is presented with a notice bearing two buttons of equal prominence: «Accept» and «Essential only». No option is concealed and no box is pre-ticked.

• Where the User accepts: Google Analytics and Microsoft Clarity are loaded, in every territory.
• Where the User selects «essential only»: neither is loaded and any measurement cookies already present are deleted. The visit is counted solely by Cloudflare Web Analytics, without cookies.
• Where the User does not respond: Clarity is never activated. Google Analytics is loaded only outside the European Union, the European Economic Area, the United Kingdom and Switzerland; within those territories no measurement cookie is placed. The territory is determined by Cloudflare from the User's IP address at the time of the visit; where it cannot be determined, Google Analytics is likewise not loaded.

The User may change this decision at any time by means of the control at the end of this section.

2.3. As to session recording, stated plainly. Microsoft Clarity was active until 28 July 2026, was withdrawn on that date, and is reinstated on 8 August 2026 subject to the User's express consent, as this Notice undertook. Consent is sought in every territory, and not solely where European law so requires, because this Site is used to consult Odù, to save favourites and to record Osha and Ifá anniversaries: such use discloses religious belief and warrants an express request. Further, Clarity is not loaded on /cuenta or during the payment process, so that the User's password, two-step verification code and card details never pass through any recording. Text fields are masked and keystrokes are not recorded.

2.4. The statistics so obtained are used for one purpose only: to remedy obstacles to reading. They are not linked to the User's account and are not used to construct a profile of the User.

2.5. In addition, the User's browser requests typefaces directly from Google Fonts, which receives the User's IP address by virtue of serving those files.

2.6. The User may disable Google measurement by installing the Google Analytics Opt-out Browser Add-on. Blocking cookies in the browser likewise disables it; the Site remains fully functional.

3. Purposes of processing

3.1. The personal data described above is processed for the following primary purposes, which are necessary for the existence and performance of the contractual relationship:

• to provide access to the Content corresponding to the User's plan and to maintain the authenticated session;
• to charge the subscription and to apply, where applicable, the founder's price;
• to communicate matters concerning the account or the Service, including the opening of payments where a founder's price has been reserved;
• to measure use of the Site and to correct defects therein.

3.2. PINNCOR does not sell or lease personal data, and does not disclose a User's name, email address or subscriber status to any third party for commercial purposes. PINNCOR acknowledges the religious character of the Site and treats a User's membership as a matter belonging to that User alone.

4. Transfers and processors

4.1. Personal data is disclosed to those technical providers necessary for the operation of the Service, each of which processes such data under its own data-protection undertakings:

• Supabase — database and account management.
• Stripe, Inc. — payment and subscription processing.
• Cloudflare, Inc. — infrastructure, delivery and aggregate statistics.
• Google LLC — usage measurement (Analytics) and typefaces.
• Microsoft Corporation — anonymous recording of the visit (Clarity), only where the User accepts it.

4.2. No further transfer is effected without the prior consent of the data subject, save where required by law.

5. Advertising

As at the date of this Notice the Site displays no advertising and no advertising cookies operate upon it. Should PINNCOR elect to display advertising in future, this Notice will be amended before the first advertisement is served, and will there identify the provider concerned and the cookies employed. PINNCOR shall in no event sell personal data to advertisers nor permit a User to be profiled by reason of religious affiliation.

6. ARCO rights

The data subject may at any time exercise the rights of access, rectification, cancellation and objection (derechos ARCO) in respect of their personal data, as well as request the deletion of their account or the revocation of consent, by written request addressed to contacto@lapalabradeifa.com from the email address of record. PINNCOR shall respond within a maximum of twenty (20) business days from receipt of the request. These rights are afforded to every User, irrespective of place of residence. Consent to the processing of the sensitive data described in clause 1 bis may in addition be revoked directly and with immediate effect, by clearing that section from the User's account.

7. Retention and security measures

7.1. Personal data is retained for so long as the account subsists and thereafter only for such period as may be required to comply with applicable legal obligations.

7.2. PINNCOR maintains administrative and technical safeguards proportionate to the sensitivity of the data, including encryption in transit (HTTPS), password hashing, and access controls designed to prevent the Content and personal data from being read by unauthorized third parties.

7.3. Usage statistics are retained by Google in accordance with its own retention period, which at the date of this Notice does not exceed fourteen (14) months. Recordings collected by Microsoft Clarity expire automatically upon its servers within thirty (30) days of each visit.

8. Amendments to this Notice

Any amendment to this Privacy Notice shall be published on this page together with the date on which it takes effect. Continued use of the Site following such publication shall constitute acceptance of the amended Notice, save in one case: where the amendment affects the purposes for which the sensitive data described in clause 1 bis is processed, it shall not be deemed accepted by continued use. Fresh consent shall be sought, and the User may decline it without loss of any content or subscription entitlement.