PRIVACY POLICY

Information you provide directly:

• Name (first and last)
• Mailing address
• Email address
• Phone number
• Age verification (18+ confirmation)
• Raffle entry quantity and preferences
• Messages sent through our contact form

Payment information: Payment is processed by Stripe, Inc. We do NOT receive or store your full credit card number, CVV, or bank account information. We only receive a transaction confirmation and last-4 digits from Stripe for verification purposes.

Automatically collected: IP address, browser type, device information, pages visited, and timestamps — collected through standard server logs and analytics tools.

• To process your raffle entry and payment
• To send you a confirmation email with your ticket information
• To contact you if you are the winner
• To respond to your contact form inquiries
• To fulfill legal and regulatory obligations
• To detect and prevent fraud
• To improve our website and services

We do NOT sell, rent, or share your personal information with third parties for their marketing purposes.

We may share your information with:

• Stripe, Inc.— for secure payment processing. Subject to Stripe's Privacy Policy.
• Supabase — our database and storage provider, for storing entry information. Data is encrypted at rest and in transit.
• Law enforcement or legal authorities — when required by law, court order, or to protect the rights and safety of La Bestia en el Arte or others.
• Prize delivery — your mailing address will be shared with necessary parties only for delivering the prize if you win.

We retain your personal information for as long as necessary to:

• Complete and administer the raffle
• Comply with legal and tax obligations (typically 7 years for financial records)
• Resolve disputes and enforce our agreements

After these periods, your data will be deleted or anonymized.

We implement industry-standard security measures to protect your information, including:

• HTTPS/TLS encryption for all data in transit
• AES-256 encryption for data at rest (via Supabase)
• Row-level security policies on our database
• No storage of raw payment credentials

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Depending on your state of residence, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information (subject to legal retention obligations)
• Opt out of marketing communications

To exercise these rights, contact us via our contact form. We will respond within 30 days.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt-out of the sale of personal information. We do NOT sell personal information. To submit a CCPA request, contact us via our contact form with the subject "CCPA Request."

Our Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us with personal information, we will delete such information promptly.

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

For privacy-related questions or requests, contact us via the contact form on our website.