Privacy Notice
Last updated: September 28, 2026
Data controller identity
Augurea by Noctivel
Mexico City, Mexico
Contact: ayuda@augurea.com
Who is responsible for your data
Augurea by Noctivel (“Augurea” or “we”) is responsible for processing your personal data under Mexico's Federal Law on Protection of Personal Data Held by Private Parties. You can reach us at ayuda@
Data we collect
We collect the data you give us when you create an account, place an order, or contact us: name, email, phone, shipping and billing address, and transaction data. We never store card numbers or CVV — payment is processed directly by our payment provider. When a payment is declined we record, linked to that order, the reason the bank or the processor reports — as bounded codes, such as insufficient funds or an expired card — together with the card's brand and its type (credit, debit, or prepaid). We do not store the card number, its last four digits, the cardholder's name, or the provider's free-text messages. We use this only to understand why payments fail, fix them, and support you. This record stays attached to that order and is deleted together with it. We keep orders and the receipts backing them for five (5) years from the date they are created, because our tax obligations and accounting duties require us to hold them that long; after that period we delete them. We do not collect sensitive personal data: we never ask you for health data, racial or ethnic origin, religious, philosophical or moral beliefs, union membership, political opinions, sexual preference, or biometric data, and we ask you not to send them to us in your messages. If you request an invoice we also collect your tax data: RFC (taxpayer ID), legal or personal name, CFDI use, and tax postal code. We use them only to issue your digital tax receipt (CFDI).
If you ask us to tell you when a “Coming soon” reference arrives, or when a sold-out product is back — the “Notify me” button — we collect only your email and the reference you are interested in. We keep them in a separate list, never crossed with your orders; we go through it by hand and delete them once that reference is no longer being prepared, or whenever you ask us to at ayuda@
If you bought without signing in, we can save those orders in your account with the same email when this browser proves your password and access to the order or your mailbox. When you open an order link while signed in, you can select "Add this order to my account"; opening the page alone does not add it. This lets you view and track purchases and does not subscribe you to advertising. You can also contact our support team to establish ownership of a purchase.
What we use it for
We separate the purposes we need in order to sell and deliver from the additional ones, which you can refuse without affecting your order.
Necessary purposes
- Processing, charging and delivering your order.
- Order updates and support by email and, once we enable those channels and you give us your number, by SMS or WhatsApp: confirmation, shipment, delivery, incidents and answers to your questions — never advertising.
- Preventing fraud and abuse and protecting the site and your account.
- Meeting our tax and accounting obligations, including your tax receipt when you ask.
- Handling your complaints, returns and rights requests.
Additional purposes, which you can refuse without affecting your order
- Sending you updates, promotions and recommendations by email and, once we enable those channels and you give us your number, by SMS or WhatsApp: only if you opt in, never as a condition for buying.
- Telling you when a reference you followed arrives.
- Analysing internally which campaigns bring purchases.
- Measuring how the site is used, through the interaction telemetry described below.
How to refuse the additional purposes: write to ayuda@
Internal analysis of your purchase history
To learn how many people buy from us again, and what is bought together with what, we analyze orders as internal statistics. Your email does not appear in that analysis: before the data leaves our operational systems we turn it into an irreversible key, using a secret key that lives only in that process, and the key cannot be turned back into your address. That key is what makes two guest orders placed with the same email count as the same person instead of two new customers; to compare them we use your email in lower case and without surrounding spaces, and we remove nothing else from it. The files produced by this analysis carry no name, email, phone number or street address, are not used for advertising, are not sold, and are not transferred to third parties: only whoever runs this analysis on our behalf and under our instructions handles them. If you have an account, the analysis uses your account and not your email. You may object to this processing through your ARCO rights, below.
Site telemetry and statistics
To measure availability, speed, navigation, and the purchase funnel, we use first-party server telemetry and a bounded first-party performance beacon, without third-party beacons. We may record the visited route, date, response status and duration; language; general device, browser, and operating-system classifications; country code; an approximate city and a region or state code, all derived from the Cloudflare-verified IP address. A VPN, mobile network, or CGNAT may attribute a different city or state, and the city may not arrive at all. We do not retain coordinates, postal code, time zone, or the visitor's street address; only the referring site's host, without its path or query; and limited campaign tags. When the server rejects an action you submit — adding to the cart, confirming payment, or signing in, for example — we record the route template, the HTTP status code, the duration, and a closed label for the kind of action; never the form content, the error message, or anything you typed. When your own browser detects a JavaScript error, we record only a closed, two-value tag -- a script error or an unhandled promise rejection -- never the error message, the file, the line, or the stack. We also record when a semantic page section becomes visible and, on product pages and cards, when the cover, a gallery image, or a presentation format is viewed. Only bounded internal keys are sent: we do not capture text, HTML, free-form selectors, or the pointer coordinates on your screen. From a click we also retain two approximate bands: which of a hundred cells of the clicked element it fell in, and which slice of the page's height that element sat in. When you open a product card from a showcase — the home page, the catalogue, the search results, a house or origin page, or the same-house grid on a product page — we also record which product you opened and which section of the page that card sat in. We do not record the rank the card held in the list: whether it was the first, the fifth or the twentieth. Of its place on the page only the height band already described above remains, the same one we keep for any click. From the instant search menu we record only that a suggestion or the see-all-results link was chosen: never which suggestion, nor its text, nor what you had typed. A verified IP address is used transiently to calculate a different HMAC identifier each day; the raw address is not retained. When you search, we retain normalized, bounded text and replace detectable email, phone, and card patterns; this filter cannot detect every name, address, RFC/CURP, or obfuscated identifier, so search text is not universally free of personal data. That is exactly why your search text has its own retention period, shorter than the rest of the telemetry: we keep it for at most 90 days. After that the daily statistic holding it is deleted and the text is removed from the event that produced it, even though that event is still stored without it. A first-party cookieless beacon sends, when the page is hidden or closed, up to one sample each of LCP, INP, CLS, and TTFB with the logical route and general device and country classifications. It sends no visitor identifier, URL, or query. In neither events nor these samples do we retain the raw IP address, raw user agent, or full referrer. For customers with an already authenticated session we record a coarse actor class, successful credential-login events, and an account hash that changes every day. We retain no account relationship or stable cross-day account identifier. The coarse marker reuses the necessary authentication session and creates no analytics cookie. We record, in aggregate and without identity, how many times the cookie notice is shown, what is decided on it (accept, reject, save preferences, or withdraw consent), and how long passes between it appearing and the decision; we also record whether your browser sends the Global Privacy Control (Sec-GPC) or Do Not Track (DNT) signals. Only GPC is applied as an automatic opt-out for the optional identifier; DNT is recorded and does not by itself change the processing. This record is what lets us evidence your decision, as the law requires, and it carries no identifier at all: not the aug_aid identifier, not the session key, not the daily visitor or account hashes. When the cart or the checkout refuses a purchase for lack of stock, we record which product and which presentation (the size in millilitres) could not be bought, and at which point the refusal happened. When an order is confirmed we record the total amount charged, the currency, the number of lines, and the payment method chosen; never card data. That record is grouped with your browsing for the day and does not carry the order number. Separately we keep an origin snapshot — where the visit came from, the campaign tag, and the kind of device, together with the same technical and regional data described above — tied to the order's internal identifier and carrying no amount, no payment method and no session, visitor or account identifier: it is written once, never rewritten, and is used for internal statistical analysis of which campaigns bring purchases. You may object to that analysis by writing to ayuda@
Who we share it with
We share only the data strictly needed with shipping carriers (for delivery) and our payment provider (to process the charge). During registration and checkout, Cloudflare Turnstile processes the strictly necessary browser and network signals to prevent abuse, fraud, and automated inventory reservations. We never sell your personal data to third parties. When you request an invoice we transmit your tax data to Mexico's Servicio de Administración Tributaria (SAT) and, where applicable, to the authorized certification provider (PAC) that stamps the receipt on our behalf. That transmission is provided for by tax legislation and does not require your consent.
When SMS or WhatsApp notifications are active, we share your phone number with Twilio, the provider that delivers those messages on our behalf.
Data transfers without your consent
Sharing your order data with the shipping carrier that delivers it and with our payment processor doesn't require your consent. Both process that data on our behalf and on our instructions, and Mexico's Federal Law on Protection of Personal Data Held by Private Parties allows data to be shared without consent where it is necessary to maintain or fulfill the legal relationship you have with us when you place an order. We don't share your data with any other category of third party without your consent.
How to limit the use or disclosure of your data
Beyond your ARCO rights (access, rectification, cancellation, objection) and withdrawal of consent, you have these means to limit the use or disclosure of your personal data. First, the “I’d like to receive news from Augurea” checkbox: it is not pre-ticked, you can leave it unticked when you register, and you can change it at any time from your account details. Second, unsubscribing from the updates: write to ayuda@
Your ARCO rights (access, rectification, cancellation, objection)
You can ask to access your personal data, rectify it when it is inaccurate or incomplete, cancel it when you believe we no longer need it, and object to our using it for a given purpose (ARCO rights), by writing to ayuda@
What your request must include
- Your name and the email, postal address, or other means by which you want us to send you our answer.
- A copy of your official identification — or your representative's, together with the document proving that representation — so we can verify you are the data subject.
- A clear, precise description of the data your request covers and of which of the four rights you are exercising: access, rectification, cancellation, or objection.
- Anything that helps us locate your data, such as the order number or the email you bought with.
- If you are asking for a rectification, also the correct value and the document supporting the change.
Timeframes: we will answer within twenty (20) business days of receiving your request and, where it is well founded, give effect to it within the fifteen (15) business days following that answer. Exercising these rights is free: we could only charge you justified postage or the cost of the copies you ask for. Among the things you can ask us to delete is the text of your searches on the site: it is erased on its own after 90 days, but if you ask us at that same address we delete it sooner, without waiting for the period to run out. If you are not satisfied with our answer, or if we do not answer, you can start a rights-protection proceeding before the supervisory authority for personal data protection.
Withdrawing your consent
You can withdraw, at any time, any consent you've given us for processing your personal data by writing to ayuda@
Cookies
We use first-party cookies that are strictly necessary for site operation and security, such as the session cookie and CSRF security cookie. During payment, Stripe may use cookies and similar technologies needed to process the transaction and prevent fraud. During registration and checkout, Cloudflare Turnstile processes browser signals to prevent abuse and fraud and, depending on its service configuration, may issue a clearance cookie. We do not add third-party technologies for our own behavioral advertising, and we never sell your data. With your explicit consent — through the preferences panel reachable from “Privacy & cookies” in the footer — we may also use the signed aug_consent_v1 cookie (it stores only your choice — granted or denied — the decision date, and which legal regime applied, never an identity) and, only if you grant consent, the aug_aid cookie (an opaque random identifier, never derived from your email, account, session, IP address, or order) to recognize you across visits. Both cookies last at most 180 days, accepting and rejecting are equally easy, and withdrawing consent deletes aug_aid immediately. Declining does not stop site measurement: what we do not create is the cross-visit identifier. The telemetry described in the previous section keeps being recorded without it. If your browser sends the Global Privacy Control signal (Sec-GPC), we treat it as an automatic opt-out request for the optional identifier and do not show the panel. See Stripe's and Cloudflare's privacy and cookie notices for their current practices. These are the cookies the site may place in your browser:
| Cookie | What it does | How long it lasts |
|---|---|---|
csrftoken |
Security: stops a third party from submitting forms in your name (CSRF protection). Strictly necessary. | Up to 1 year |
sessionid |
Keeps your session: the cart, the language you chose, and your sign-in. Strictly necessary; switching language with ?lang= renews this technical cookie, unrelated to your optional consent. | Up to 14 days |
aug_consent_v1 |
Stores your decision about the optional identifier (granted or denied), the decision date, and which legal regime applied. Never an identity. | Up to 180 days |
aug_aid |
Only if you grant consent: an opaque random identifier used to recognize your browser across visits. | Up to 180 days |
messages |
Carries a one-time notice from the store (for example, that your cart is empty) from one page to the next; deleted as soon as it's shown. Strictly necessary. | Lasts your browser session |
How to disable them: you can block or delete cookies from your browser's privacy settings — look for the cookies and site-data section — and you can also tell it to clear them on close. You can additionally withdraw consent for aug_aid at any time from “Privacy & cookies” in the footer: that cookie is deleted immediately. If you block the strictly necessary cookies, the site cannot keep your session or process forms securely.
Changes to this notice
We may update this notice; the current version is always published on this page with its last-updated date.