Privacy notice

Who is responsible for your data

Pablo Álvarez Aceves is responsible for the personal data collected at palacev.noko.mx, with address at (not published yet — ask for it in writing and it will be provided).

This is a one-person site: a photographer selling his work. There is no data department and no automated processing that decides anything about you.

What data is collected

The ones you type, when you choose to type them:

• Your name, email and phone, if you fill in the contact form or place an order.
• Your shipping address — and only if what you ordered is a print that has to be shipped. Anyone buying a digital file is never asked for an address.
• What you ask the assistant. The text of your question is stored so we know which doubt is the most common and which work causes it.

And what gets recorded on its own

When you open a page, the following is recorded without asking you for anything:

• Which pages you viewed and which work you were looking at.
• Whether you came from a phone, a tablet or a computer, and which browser and operating system you use.
• Your screen size, grouped into categories (“phone”, “laptop”), never the exact number.
• The language your browser is configured in.
• An approximate country, inferred from the time zone your browser declares. Your IP address is neither stored nor looked up against any geolocation database.
• The domain you arrived from (for example “instagram.com”), never the full address: that could carry what you searched for or which private message you came from.
• The campaign tags carried by the link you came in through (utm_source, utm_medium, utm_campaign, utm_content). The photographer writes them when he builds the link he posts, and they say which post the click came from, not who made it.
• How many seconds you had the page in view and how far down you scrolled. It tells us whether a work is looked at or skipped past; nothing about what you did with your mouse or finger is stored.
• Whether you opened a photo full screen.
• What you left in your cart, if you did not end up buying it. This is not new data: it is what you yourself put there, and all that happens is that it is remembered, so we know what gets abandoned halfway.

How all of that is measured

It is worth saying because almost no site does: the measurement above happens in two notices your browser sends once it has finished drawing the page, and one more when you close it or leave it in the background. That is two messages per page. Not one per mouse movement, and nothing that runs before you see the photo.

None of it reads a fingerprint of your browser. Your installed fonts are not inspected, nor your extensions, and nothing hidden is drawn to measure your graphics card — the three techniques used to recognise someone without cookies. If you clear this site’s cookie, you become a new person here — and that is by design.

What is NOT done

• Your IP address is not stored.
• Sensitive data is neither requested nor wanted: nothing about health, ethnic origin, beliefs, political opinions or sexual preferences. If you type them into the chat, they are deleted as soon as you ask.
• No lists are bought, your data is not cross-referenced with anyone else’s, and it is not sold. Ever.
• There is no third-party advertising embedded in the gallery, and no fonts or scripts pulled from outside servers: everything is served from here.

What it is used for

For what is needed in order to serve you, which comes first:

• Answering you, preparing a quote and fulfilling your order: charging it, printing it, packing it, shipping it and invoicing it if you ask.
• Delivering your licensed digital file and being able to tell that the download is yours and not someone else’s who was passed the link.
• Understanding which work draws people in and which doubt keeps repeating, to decide what to print and what to explain better. That is the only reason the site measures itself.
• Keeping the site standing: detecting abuse of the assistant and of the downloads.

The measurement, said plainly

Two kinds of measurement live here and they are not the same thing. It is worth knowing which is which, because only one of them asks you.

The site’s own measurement stays here. It is stored on the computer this site lives on, it is not sent to any provider, it is not cross-referenced with anyone and it cannot be used to follow you around the internet: the cookie that ties it together cannot be read by any other site or script. That is why it keeps working even if you say no to the notice — and why you can also ask for yours to be deleted, and it is.

Third-party measurement does leave this site, and that is why you are asked. Meta’s pixel tells Facebook what you looked at, and Facebook joins it with what it already knows about you. If you say no, that script is not downloaded: it is not loaded and then politely asked to behave — it never comes into existence in your browser.

If your browser sends a “do not track me” signal (Global Privacy Control or Do Not Track), it is taken as a no and you are not even asked.

Who it is shared with

With as few as possible, and each for a concrete reason:

• The assistant’s provider (DeepSeek). Your question is sent to it so it can be answered. Your name, your email and your visit identifier are not sent: only the text of the question and the catalogue of published work.
• Meta Platforms, and only if you accepted the measurement notice.
• Whoever charges and whoever delivers: the payment platform and the courier, when you buy something. They receive the minimum needed to charge and to deliver, and each has its own privacy notice.
• The authorities, if the law requires it. That is the only transfer that cannot be refused.

How long it is kept

Order data is kept for as long as the order requires and for as long as the law requires records of a sale to be kept.

Measurement data lives for one year, which is how long the cookie that ties it together lasts. After that, joining two visits no longer says anything useful about anyone.

If you wrote and there was no purchase, your contact details are deleted as soon as you ask — and if you never ask, when they stop making sense.

Your rights: access, rectification, cancellation and objection

There are four and they are always yours. In short:

• Access: being told what of yours is held here.
• Rectification: having what is wrong corrected.
• Cancellation: having it deleted.
• Objection: having it stop being used for something specific, even if not everything is deleted.

How to exercise them

For any of the four, write to pabloalvarezaceves@gmail.com. Tell me your name, a way to reply to you, which right you want to exercise and over which data. If proof of identity is needed you will be told what to send; you will not be asked for a document without an explanation of what it is for.

The answer arrives within twenty business days or less, and where applicable it is carried out within the following fifteen business days. Exercising these rights costs nothing.

For the measurement you do not need to write: the notice’s decision can be changed by clearing this site’s data in your browser, and you will be asked again.

If you believe your right was not respected, you may turn to the Mexican data protection authority, currently the Secretaría Anticorrupción y Buen Gobierno.

If this changes

Changes are published on this same page, dated at the top. There is no email notice: no mailing list is kept for this, which would mean collecting one more piece of data precisely in order to talk about collecting data. This version is from 2026-08-13.

Cookies, one by one

They are all here. An automated test fails if anyone adds a cookie to the site and does not declare it here.