Privacy notice.

Marcos Vega (Marcos Jesus Chavez Vega), an individual operating under the Onca Vega® brand (the Controller), is responsible for the processing of the personal data collected through the Platform. The Controller's address for service of notices related to your personal data is La Zandunga 177, col. Benito Juárez, Nezahualcóyotl, State of Mexico, Mexico.

Any change to the Controller's legal status will be reflected in an update to this Policy, with its corresponding date.

The Controller only collects the data needed for the way you use the Platform:

• Account (by invitation only): name, email address and country. The password is handled by the authentication provider and is never stored in readable form.
• Sign in with Google: the name and email address Google shares. The Controller never receives your Google password.
• Public author profile: avatar, links, biography, genres and your profile address, which you choose to publish.
• Books: the data of each work entered by the author or the editorial team (title, synopsis, cover, buy links, among others), also public.
• Forms on /editorial and /comunidad: your name, email address, the title and genre of your work, its description or your message and, where applicable, the services you are interested in; plus your approximate location (city, state and country), inferred on the server from the IP address you send the form from. The Platform never asks for your device's location.
• Browsing data, only if you accept analytics cookies and only on public pages: pages visited, time spent, scrolling, links and buttons you click, device and browser type, language and approximate location (city or region), collected by Google Analytics.
• Technical security data: when you use a form or a contact button, Google reCAPTCHA analyzes signals from your browser to tell people apart from automated programs.

We do not request sensitive personal data (ethnic origin, health, religious beliefs, union membership, sexual orientation, among others) anywhere on the Platform.

Google Analytics never receives your name, email, your work's title or description or your messages, and it never runs in your account, on sign-in or on registration: when you send a form it only records the form type, the genre picked from the list and the selected services.

The Platform is not directed at minors, and accounts are exclusively for people aged 18 or over (or the age of majority in their jurisdiction). If the Controller finds that it received a minor's data, it will delete it.

Primary purposes, required for the relationship you start with us:

• Creating, managing and authenticating your account.
• Publishing your author profile and your works in the catalog, as you configure them.
• Handling and following up on your requests for editorial services or to join the community.
• Keeping the Platform secure and preventing misuse (reCAPTCHA checks and rate limits).

Secondary purpose, which requires your consent and which you can refuse or revoke at any time without affecting the primary ones: producing usage statistics of the public pages to improve their content and operation.

We do not use your data for advertising or commercial profiling, and we do not sell your personal data.

Your author profile and your works' pages are public by design: they are shown exactly as you configure them, can be shared and can be indexed by search engines.

Your email address, your registration country and your requests' data are never shown publicly.

You can edit or remove your public information at any time from your account settings. To remove a whole work or close your account, request it through the means in section 10.

To run the Platform, the Controller relies on the following providers, which process data only to provide their service:

• Netlify: hosting of the Platform and its services; it logs technical data of each visit (such as the IP address) for security and operational purposes.
• TiDB Cloud: database storing your account, profile, works and requests.
• SuperTokens: authentication and sessions for your account.
• Google: sign in with Google (optional); reCAPTCHA Enterprise, only when you use a form or a contact button; Google Tag Manager and Google Analytics, only if you accept analytics cookies; and the download, from its servers, of a technical component that displays the 3D artifact on some pages.
• Cloudinary: storage and delivery of the images (covers and avatars) uploaded to the Platform.
• Brevo: transactional emails, such as the acknowledgment of your request or password resets.
• Slack: internal tool where the Controller is notified of each request, with the form data.
• Buscalibre: some buy links carry the imprint's affiliate identifier; when you follow them, the purchase happens on Buscalibre's site under its own policies.

These providers are mainly located in the United States and the European Union, so your data may be processed outside Mexico under their own privacy policies. Other than in these cases, the Controller does not transfer your personal data to third parties, except when required by a competent authority.

Cookies and local storage (localStorage and sessionStorage) are small records the Platform saves in your browser. We group them into two categories:

• Necessary: essential for the Platform to work, keep you signed in, remember your choices (language and cookie preferences) and protect the forms. They are always active and do not require consent.
• Analytics: statistically measure how the public pages are used through Google Analytics, loaded via Google Tag Manager. They are only activated if you accept them, and never in your account, on sign-in or on registration.

The Platform does not use advertising, e-commerce or marketing tracking cookies.

When you sign in with Google, Google sets its own cookies on its domain, under its privacy policy.

You can change your choice at any time from “Cookie preferences”, at the bottom of every page. When you revoke analytics cookies, they are deleted. Your choice is kept for 12 months; after that we will ask again. You can also block or delete cookies from your browser settings, although without the necessary ones you won't be able to sign in.

The Platform's domain name (DNS) provider does not set cookies.

Your account, profile and works data are kept while your account is active. Your requests' data are kept for as long as needed to handle and follow up on them. They are then deleted, unless there is a legal obligation to keep them.

You can refuse or revoke analytics cookies at any time from “Cookie preferences”, and adjust your public information from your account settings. For any other limitation, request it through the means in section 10, stating which use or disclosure you want to limit.

You have the right to access, rectify and cancel your personal data or to object to its processing (ARCO rights), as well as to withdraw any consent you have given.

To exercise them, send your request to the Controller's contact email or through the Platform's contact form, including:

• Your full name and, where applicable, that of your representative.
• A document proving your identity or the representation.
• A clear description of the data and the right you wish to exercise.
• A means to send you the response (preferably, your account's email).

The Controller will respond within the time limits set by law. If you believe your rights were not respected, you may turn to the personal data protection authority (as of the date of this Policy, Mexico's Secretaría Anticorrupción y Buen Gobierno).