Legal

Privacy Policy

Last updated:

This policy explains which personal data we collect when you visit numoru.com, why we collect it, who we share it with and how you can exercise your rights. It is written to comply with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).

1. Data controller

The controller of your personal data is Numoru, an AI consulting firm established in Mexico that operates the website https://numoru.com (the "Site").

For anything related to this policy or to your personal data, write to [email protected]. This is the only channel for privacy requests; we do not process them through social media.

2. Personal data we collect

We only collect data that you give us directly or that is generated technically while you browse. We do not collect special-category data (health, ethnicity, beliefs, sexual orientation, etc.) and ask you not to include any in our forms.

  • Contact form: full name, e-mail address, phone (optional), company (optional), service of interest, estimated budget (optional) and the message you write.
  • Resource downloads (lead magnets): e-mail address, browsing language and the resource requested.
  • Usage analytics: pages viewed, referrer, device and browser type, approximate country and interaction events (for example "form submitted"). This is collected in aggregate, without persistent identifiers; see section 5.
  • Security data: when you submit the contact form, Cloudflare Turnstile processes your IP address and browser signals to tell humans from bots.
  • Language preference: the language you pick (en/es/pt) is stored in your browser's localStorage. It is not a cookie and is never sent to a server.
  • Advertising: if you accept advertising cookies, Google may collect cookie identifiers, IP address and browsing data to serve and measure ads; see section 4.

3. Purposes of processing

We process your data for the following primary purposes, which are necessary for the relationship you request:

  • Answering your contact request, preparing service proposals and following up on the conversation you started.
  • Delivering the downloadable resources you request and, where configured, e-mailing them to you.
  • Protecting the Site against spam, abuse and automated traffic.
  • Meeting the legal and accounting obligations that apply to Numoru.

3.1 Secondary purposes

Unless you object, we may also use your data to measure Site usage and improve its content; to display third-party advertising in the articles section ("Contributions"); and to occasionally send you information about Numoru publications or services related to the topic you contacted us about.

You can object to the secondary purposes at any time by writing to [email protected]; doing so does not affect how we handle your main request.

Legal bases under the GDPR: performance of pre-contractual steps (contact form), consent (advertising cookies, lead magnets), and our legitimate interest in securing the Site and understanding how it is used.

4. Cookies, advertising and Google AdSense

The Site displays advertisements served by Google AdSense in the articles section. Google, as a third-party vendor, uses cookies to serve ads on this Site.

Google's use of the advertising cookie (historically known as the DoubleClick or DART cookie) enables it and its partners to serve ads to you based on your visits to this Site and/or other sites on the Internet. This lets Google build an interest profile and measure campaign effectiveness.

You may opt out of personalised advertising by visiting Google Ads Settings at https://www.google.com/settings/ads. You can also opt out of third-party vendors' use of cookies for personalised advertising at https://www.aboutads.info/choices/ (Digital Advertising Alliance) or, in Europe, at https://www.youronlinechoices.eu/.

To learn how Google uses information from sites that use its services, see https://policies.google.com/technologies/ads and https://policies.google.com/technologies/partner-sites.

Consent: in the European Union, the United Kingdom, Switzerland and other jurisdictions that require it, we do not load advertising cookies until you accept the consent banner shown on your first visit. You can withdraw or change your decision at any time from the cookie preferences link in the footer or by clearing your browser's cookies; from then on the ads you see will be non-personalised.

Besides Google, the ad networks that bid in AdSense auctions may set their own cookies. Google maintains the list of certified vendors at https://support.google.com/admanager/answer/9012903.

5. Third-party providers that process data

We only share data with providers we need to run the Site. Each acts under its own privacy policy and, where applicable, under a data-processing agreement.

  • Umami Analytics (self-hosted at umami.numoru.com): open-source web analytics run by Numoru on its own infrastructure. It sets no cookies, creates no persistent identifiers and anonymises the IP address before storing anything. The data never leaves Numoru's servers.
  • Cloudflare Turnstile (Cloudflare, Inc., USA): bot verification on the contact form. Processes your IP address and browser signals. Policy: https://www.cloudflare.com/privacypolicy/.
  • Google AdSense (Google LLC, USA / Google Ireland Ltd., EU): advertising in the articles section. See section 4. Policy: https://policies.google.com/privacy.
  • Google Fonts (Google LLC): the Site's typefaces are loaded from fonts.googleapis.com and fonts.gstatic.com; when downloading them, your browser sends your IP address to Google. Google states it does not use these requests for profiling: https://developers.google.com/fonts/faq/privacy.
  • Infrastructure: the Site and its API are hosted on servers provided by DigitalOcean, LLC. Contact-form messages and download e-mails are stored in a database operated by Numoru on that infrastructure.

6. International transfers

Numoru is established in Mexico. The providers listed in section 5 may process data in the United States and the European Union. When we transfer data of residents of the European Economic Area or the United Kingdom, we rely on the Standard Contractual Clauses approved by the European Commission or on the EU-U.S. Data Privacy Framework where the provider is certified.

Under article 36 of the LFPDPPP, by providing your data you consent to the transfers described in this policy. We do not sell your personal data or hand it to third parties for their own commercial purposes.

7. Retention periods

  • Contact-form messages and lead-magnet e-mails: up to 24 months from the last contact, or sooner if you ask us to delete them. If the conversation leads to a contract, they are kept for its duration plus the legally required periods.
  • Analytics data (Umami): aggregated and anonymised, with no deletion deadline because it is not identifiable.
  • Google advertising cookies: lifetime set by Google; you can delete them at any time from your browser.
  • Technical server logs: up to 90 days, for security purposes.

8. Your rights

ARCO rights (Mexico). Under the LFPDPPP you have the right to Access your personal data, Rectify it if inaccurate, Cancel it when you consider it is no longer needed for the purposes in this policy, and Object to its processing. You may also revoke any consent you gave us and limit the use or disclosure of your data.

GDPR rights (EEA and UK). You have the rights of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability and objection, including objection to automated decision-making and to profiling for advertising purposes. You also have the right to lodge a complaint with the supervisory authority in your country.

CCPA/CPRA rights (California). You have the right to know what data we collect, to request its deletion, to correct it, not to be discriminated against for exercising your rights, and to opt out of the "sale" or "sharing" of data for cross-context behavioural advertising. Numoru does not sell personal data; Google's personalised advertising may count as "sharing" under the CPRA and you can opt out through the consent banner or at https://www.google.com/settings/ads.

How to exercise them. E-mail [email protected] with the subject "Privacy rights", stating your name, the right you wish to exercise and, where needed, proof of identity. We reply within 20 business days (LFPDPPP) or one month (GDPR), extendable as the law allows for complex requests. Exercising these rights is free of charge.

In Mexico you may additionally file a complaint with the competent personal-data protection authority if you believe your data-protection rights have been infringed.

9. Security

We apply reasonable technical and organisational measures to protect your data: TLS encryption on all communications, encrypted database connections, access limited to the staff who handle contact requests, and bot verification on forms. No system is infallible; if we detect a security breach affecting your data we will notify you as required by applicable law.

10. Children

The Site is aimed at professionals and businesses. We do not knowingly collect data from anyone under 16. If you believe a minor has given us data, write to us and we will delete it.

11. Changes to this policy

We may update this policy when our providers, the law or the Site's features change. The current version is always published at this address with its update date. Material changes will be highlighted on the Site for a reasonable period.

12. Contact

Numoru — [email protected] — https://numoru.com