Last updated: August 6, 2026
This Privacy Policy describes how Nagua and its affiliates (collectively “Nagua,” “we,” “us,” or “our”) collect, use, share, and protect your personal information when you visit nagua.live, use our apps, or otherwise interact with us (together, the “Services”). We are the controller of your personal information.
By using the Services you agree to this Policy. For details about cookies and similar technologies, see our separate Cookie Policy. This Policy should be read together with our Terms of Service, which govern your use of the Services more broadly.
Nagua operates nagua.live and the associated Nagua mobile and web experiences. We are based in Mexico and sell plant-medicine formulas — microdosing capsules, ceremonial cacao, and related products — direct to consumers online.
If you have a question about this Policy or how we handle your information, our privacy team is reachable at privacy@nagua.live, or by post at Nagua, Attn: Privacy, Mexico City, Mexico. We aim to respond to every inquiry within 5 business days.
The Services are not intended for, and we do not knowingly collect information from, anyone under 21. If we learn we have collected such information, we will delete it. Contact us at privacy@nagua.live if you believe a child has provided us information.
“Personal information” means information that identifies, relates to, describes, or could reasonably be linked with a particular individual or household. It does not include publicly available, anonymized, or aggregated information that can no longer be linked to you.
Information you give us. When you create an account, make a purchase, complete a form, contact support, or sign up for updates, you may give us your name, email address, phone number, and shipping and billing address. We do not collect card details: payment is by bank transfer or stablecoin, so what we hold about a payment is the order it belongs to, the amount, and the method you chose. If you send us a payment receipt, we keep it only until the payment is matched to your order.
Information we collect automatically. When you use the Services we automatically collect a device/visitor identifier, IP address, approximate location, browser and device type, operating system, referring URL, the pages and screens you view, links and buttons you click, scroll depth, time spent, and access dates and times.
Information from third parties. We may receive usage measurements from our analytics provider and delivery-status updates from our shipping carriers. We do not buy personal information about you from data brokers.
We use cookies, localStorage, SDKs, and pixel tags to run the Services, remember your preferences, and understand usage. We group them into three kinds: strictly necessary (e.g. keeping your cart and session working — these don’t require consent), analytics (measuring traffic and usage), and preference (remembering choices like currency or a saved login). Analytics and preference technologies are only set after you opt in through our consent banner. For the full list of cookies, their purposes, and durations, and for how to manage or delete them, see our Cookie Policy.
We use the information we collect to: deliver and operate the Services; process orders and payments; provide customer support; personalize and improve the Services; measure traffic and understand usage; send service messages and, where permitted, marketing communications; detect and prevent fraud and security incidents; and comply with our legal obligations.
For users in the EEA/UK, our legal bases under the GDPR are:
| Purpose | Legal basis |
|---|---|
| Provide the Services and process orders | Performance of a contract |
| Support, security, and improving the Services | Legitimate interests |
| Analytics/marketing cookies and marketing emails | Consent |
| Meeting legal and regulatory obligations | Legal obligation |
Where we rely on consent, you can withdraw it at any time without affecting processing already carried out.
Creating an account — whether you join through our community page or sign in for the first time — subscribes you to emails about new products, restocks, and offers. The sign-up form says so before you continue, and that statement is the consent we rely on. We never sell or rent your contact details to marketers, and marketing communications come only from Nagua, never from a third party on our behalf.
Every marketing email includes an unsubscribe link that takes effect immediately. You can also update your preference anytime from your account’s Profile page, or by emailing privacy@nagua.live. Opting out of marketing doesn’t affect the transactional emails we send about an order you’ve placed (e.g. shipping confirmations).
We do not sell your personal information. We share it only:
We and our providers may process your information in countries other than your own, including outside the EEA/UK. Where we transfer personal information internationally, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses or reliance on an adequacy decision.
We keep personal information only as long as necessary for the purposes in this Policy, then delete or anonymize it — for example, account data while your account is active and for 24 months afterward, analytics data for 14 months, and support correspondence for 3 years. We may retain information longer where required by law.
You can review and update most of your information directly, anytime, from your account’s Profile page — contact details, saved addresses, and marketing preferences. For anything you can’t change yourself, or to verify what we hold about you, email privacy@nagua.live and we’ll correct or provide it.
We use reasonable technical, administrative, and physical safeguards — including encryption in transit (HTTPS/TLS), encryption of stored payment tokens, access controls limiting who at Nagua can view your data, and secure hosting — to protect your information. No system is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.
Because there is no common industry standard for “Do Not Track” signals, our Services do not currently respond to them. You can control tracking through our consent banner and your browser settings.
United States (including California). Depending on your state, you may have the right to know and access the personal information we collect, request that we correct or delete it, know the categories of sources, purposes, and third parties involved, and opt out of the “sale” or “sharing” of personal information and of targeted advertising. We do not sell your personal information. You may designate an authorized agent to act on your behalf, and we will not discriminate against you for exercising these rights.
EEA / UK (GDPR). You have the right to access, correct, and erase your personal data; to restrict or object to processing; to data portability; and to withdraw consent at any time. You may lodge a complaint with your local supervisory authority (in the UK, the ICO).
Mexico (LFPDPPP). You have the right to access, rectify, cancel, and object to the processing of your personal data (the “ARCO” rights). To exercise them, write to privacy@nagua.live with proof of identity; we will respond within 20 business days as required by the Federal Law on Protection of Personal Data Held by Private Parties.
To exercise any right, contact us at privacy@nagua.live with “Privacy Rights Request” in the subject line. We will respond within the time required by law.
If Nagua collects information about your physical or mental health, wellness, symptoms, treatments, or related activity, additional US state laws may apply — including the Washington My Health My Data Act and similar laws in Nevada and Connecticut. Under these laws you may have the right to confirm whether we collect your consumer health data, access it, withdraw consent, and have it deleted, and we will obtain your consent before collecting or sharing such data beyond what is necessary to provide the Services. We do not sell consumer health data. Contact us at privacy@nagua.live to exercise these rights.
This Policy describes our practices and is not itself a contract that grants you rights beyond those already provided by applicable law. We may update it from time to time to reflect changes to the Services or to legal requirements; the “Last updated” date at the top always reflects the current version, and where a change is material we will notify you — by email or a notice on the Services — before it takes effect. We encourage you to review this page periodically.
If you have a question, concern, or complaint about how we handle your personal information, email privacy@nagua.live and we will do our best to resolve it directly. You also have the right to lodge a complaint with your local data protection authority at any time.
Nagua — email privacy@nagua.live.