Privacy Policy

Last updated: October 17, 2026

Draft for review: this text is a good-faith template and must be reviewed by a Florida-licensed attorney before it is published. Text in [brackets] is still to be filled in.

This policy explains what personal data we collect when you visit respiraconmar.com, message us or book VUELVO A MÍ, how we use it and how you can exercise your rights.

1. Who is responsible

[LEGAL ENTITY NAME], which operates Mar Montoya's experiences ("we", "us").
Address: [BUSINESS ADDRESS]
Privacy and data-rights email: [EMAIL]
Phone: [PHONE]

2. What we collect

When you message us (Instagram, email or text): name, Instagram handle, email, phone number and the content of your messages.
When you book: name, email, phone, the option you chose and proof of payment. Payments are processed by our payment processor; we never receive or store full card numbers.
Health and wellbeing information you choose to share (for example pregnancy, medical conditions, medication, allergies or dietary needs) so we can keep you safe during the practices and the cacao ceremony. This is sensitive data: we only process it with your explicit consent, sharing it is optional, and we use it only for your safety at the event.
Photos and video at the event, only if you agree (consent wristband) and, for sensitive moments or testimonials, with specific written consent.
Website data: technical data needed to serve the site securely (IP address, browser, our host's server logs) and, only if you accept them, analytics or marketing cookies. See the Cookie Policy.

3. How we use it

To reply to your messages and send the information you ask for.
To manage your booking, payment, the text message with the exact address, and event logistics.
To look after your safety and wellbeing during the practices.
To tell you about future gatherings, only if you opt in (you can unsubscribe at any time).
To measure and improve the site and our ads, only with your cookie consent.
To meet legal, accounting and tax obligations and to protect our rights.

Legal bases (where the GDPR or similar laws apply): your consent, performance of your booking contract, our legitimate interest in operating and protecting the service, and legal obligations.

4. Who we share it with

We do not sell your personal data for money. We share it only with those who help us provide the service, under confidentiality:

Our website host and security provider (Cloudflare, Inc.).
Meta Platforms (Instagram) when you message us and, only if you accept marketing cookies, to measure ads.
Our payment processor, to process payments; and [SMS PROVIDER] for transactional text messages.
The event's co-host (Lisayly Hurtado) and production team, as needed to run the gathering.
Authorities, when the law requires it.

If we turn on marketing cookies (such as the Meta Pixel), some US state laws, such as California's, may treat that as "sharing" data for advertising. You can opt out at Do Not Sell or Share My Personal Information.

5. International transfers

We operate from the United States, and our providers may process data in the US and other countries.

6. How long we keep it

We keep booking data as long as needed for the event and to meet legal and tax obligations ([PERIOD, e.g. 5 years]). Health information is deleted [PERIOD, e.g. 30 days] after the event unless the law requires otherwise. Authorized images are kept while published or until you withdraw consent. Our databases remain in force for as long as the business operates.

7. Security

We use reasonable administrative, technical and physical safeguards. No system is perfect; if a breach occurs we will notify you and the authorities where the law requires (for example, Section 501.171 of the Florida Statutes).

8. Your rights

Depending on where you live, you may: know what data we hold, access it, correct or update it, ask us to delete it, withdraw consent, opt out of targeted advertising and of the "sale" or "sharing" of data, and receive a portable copy. We will not discriminate against you for exercising your rights.

You can ask us to access, correct or delete your data by emailing [EMAIL]; we respond within 30 days.

California and other US states. Where the CCPA/CPRA or another state law applies, you have the right to know, delete, correct, limit the use of sensitive data, and opt out of the sale or sharing of your data. We honor the Global Privacy Control (GPC) signal. You may use an authorized agent.

EU and UK. Where the GDPR applies, you may also object to processing based on legitimate interests and complain to your data protection authority.

To exercise any right, email [EMAIL]. We may ask for information to verify your identity.

9. Age

VUELVO A MÍ is for adults 18 and over. We do not knowingly collect data from minors.

10. Email and text messages

We only send promotional email if you opt in. Every email includes our physical address, an honest subject line and an unsubscribe link, which we honor within 10 business days (CAN-SPAM Act). Text messages about your booking (such as the event address) are transactional; reply STOP to stop them. We do not send promotional texts without your prior express consent.

11. Changes

We may update this policy. We will post the new version with its date and let you know about significant changes.

12. Contact

[LEGAL ENTITY NAME] · [BUSINESS ADDRESS] · [EMAIL]