Privacy Policy
In force since: 1 January 2026
1. Who controls your data
bymangia.space (the "Site") is operated by:
Marcelo Mangiacavalli Tax ID (RUC): 9131989-7 Av. Santa Teresa 2790, Asunción, Paraguay Privacy contact: mangiam@bymangia.space
Marcelo Mangiacavalli acts as the controller of the personal data collected through the Site and handles data subject requests personally.
2. Scope and applicable law
This policy covers bymangia.space, its subdomains, and every form, download, user account and restricted area hosted on them.
The Site is globally accessible. Depending on where you live, you are also protected by:
- Paraguay: Law No. 7593/2025 on Personal Data Protection, enacted on 27 November 2025 and fully enforceable from November 2027. Its principles are applied already.
- European Union and EEA: Regulation (EU) 2016/679 (GDPR).
- United Kingdom: UK GDPR and the Data Protection Act 2018.
- Argentina: Law No. 25.326 on Personal Data Protection and the supplementary rules of the Agencia de Acceso a la Información Pública (AAIP).
- Chile: Law No. 19.628 and, once in force, Law No. 21.719.
- United States: the California Consumer Privacy Act (CCPA) as amended by the CPRA, and equivalent state privacy laws.
Where two rules differ, the one that protects you more applies.
3. What data we process
| Category | Specific data | How we get it |
|---|---|---|
| Contact data | Name, email address, company, message content | You enter it in the contact form |
| Account data | Email address, hashed password, name, language preference, registration date | You enter it when you create an account |
| Acceptance record | Date, time, IP address and version of the legal documents you accepted | Recorded when you accept the Terms and this Policy |
| Content access data | Materials viewed or downloaded from your account, with date and time | Logged as you use the registered user area |
| Transaction data | Name, email address, billing details and description of what you acquired | You enter it when you purchase tools or services |
| Technical data | IP address, browser and device type, operating system, language, pages visited, date and time, referring site | Logged automatically as you browse |
| Cookies and identifiers | See section 5 | Stored on your device |
| Communications | Emails you send us and our replies | You provide them |
We do not process credit card or bank account data. Purchases are made on third-party platforms (Amazon and, once enabled, local payment gateways and Mercado Libre), which act as independent controllers of payment data under their own policies.
We do not process sensitive data (health, racial or ethnic origin, religious or political beliefs, trade union membership, sex life or sexual orientation, biometric or genetic data). Please do not submit any through the forms.
We do not sell your personal information and we do not share it for cross-context behavioural advertising, as the CCPA and CPRA define "sell" and "share".
We do not make automated decisions producing legal or similarly significant effects, and we do not profile you for that purpose.
4. Why we use it and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) | Basis in Paraguay, Argentina and Chile |
|---|---|---|---|
| Answering your enquiries and managing professional contact | Contact | Legitimate interest and, where relevant, pre-contractual steps | Free, express and informed consent |
| Creating and running your user account | Account | Performance of a contract | Contract performance and consent |
| Evidencing that you accepted the Terms and this Policy | Acceptance record | Legal obligation and accountability | Duty to evidence consent |
| Granting access to free content restricted to registered users | Account, content access | Performance of a contract | Contract performance |
| Delivering and supporting the tools and content you acquire | Transaction | Performance of a contract | Contract performance |
| Issuing and retaining invoices | Transaction | Legal obligation | Tax law obligation |
| Sending communications about content, articles, tools or speaking engagements | Contact, account | Consent, withdrawable at any time | Consent |
| Operating, securing and debugging the Site, and mitigating attacks | Technical | Legitimate interest in service security and integrity | Legitimate interest and security duty |
| Measuring audience in aggregate | Analytics cookies | Consent | Consent |
| Meeting legal obligations and responding to lawful requests | As applicable | Legal obligation | Legal obligation |
Where the basis is consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand.
5. Cookies and similar technologies
The Site uses three categories of cookies:
Strictly necessary. Session, authentication, security, attack mitigation, and remembering your language and consent choices. These include Cloudflare's technical cookies (__cf_bm, cf_clearance) and Supabase session cookies. They need no authorisation because the Site cannot work without them.
Analytics. The Site uses Google Analytics (cookies _ga and _ga_*) to measure aggregate page usage: visits, traffic sources, most-read content and navigation behaviour. Google LLC acts as a processor. IP addresses are handled in anonymised form where the configuration allows it.
Embedded third parties. The Spotify player, YouTube videos, and links to LinkedIn, X and Amazon may set their own cookies and receive your IP address when you load or click that content. Those activities are governed by each provider's privacy policy, not by this one.
Analytics and non-essential third-party cookies run only if you consent through the preference panel. Until you do, those scripts stay blocked. You can change your choice at any time from the "Cookie preferences" link in the Site footer, or by clearing cookies in your browser.
6. Who else sees your data
We do not pass your data to third parties for commercial purposes. It is shared only with providers serving us under contract, on our instructions and under a duty of confidentiality:
| Provider | Function | Processing location |
|---|---|---|
| Lovable | Site hosting and delivery | United States and the provider's global network |
| Cloudflare, Inc. | Reverse proxy, DNS, perimeter security and attack mitigation | Global network, nearest node to the visitor |
| Supabase | Database, authentication, file storage and account transactional email | United States, us-east-1 region |
| Google LLC | Web analytics (Google Analytics) | United States and the provider's global network |
When you buy books or tools, the relevant sales platform (Amazon and, in future, local Paraguayan gateways or Mercado Libre in Argentina) processes your purchase and payment data as an independent controller under its own terms. We do not receive your financial data.
If you subscribe to the newsletter, the subscription is handled entirely on LinkedIn under its own privacy policy, and we neither receive nor manage that list.
We may also disclose data where required by a competent authority, a legal obligation, or the defence of legal claims in court or before an administrative body.
7. International transfers
The controller is domiciled in Paraguay and the Site's infrastructure is hosted mainly in the United States. Your data may therefore be processed outside your country of residence.
From the European Union, the EEA and the UK. Transfers rely on the mechanisms in Chapter V of the GDPR: the European Commission's Standard Contractual Clauses signed with the providers, together with the supplementary technical and organisational measures required, including encryption in transit and at rest and minimisation of the data transferred.
From Argentina. Argentina benefits from a European Commission adequacy decision, and its own rules allow international transfer with the data subject's informed consent and adequate contractual safeguards, both present here.
From Paraguay and Chile. Transfers rest on your informed consent and on contractual commitments requiring the recipient to maintain protection equivalent to this policy.
You can request a copy of the applicable safeguards at mangiam@bymangia.space.
8. How long we keep data
| Data | Retention period |
|---|---|
| Contact form messages | 24 months from the last exchange |
| User accounts | While the account is active, plus 12 months after closure |
| Legal document acceptance records | While the account is active, plus the limitation period of any applicable claim |
| Communication subscriptions | Until you withdraw consent |
| Technical and security logs | 12 months |
| Invoices and accounting records | 10 years, under Paraguayan tax law |
Once the period ends, data is deleted or irreversibly anonymised, unless a legal obligation requires longer retention.
9. Your rights
In every jurisdiction covered here you may request: access to your data, correction of inaccurate data, erasure, objection to processing, restriction of processing, portability in a structured, commonly used format, and withdrawal of consent.
If you live in the European Union, the EEA or the UK, you also have the right not to be subject to automated decision-making and the right to lodge a complaint with your national supervisory authority.
If you live in California or another US state with a privacy law, you may request the categories of information collected and the categories of recipients, deletion, correction, and opt-out of any sale or sharing. As stated above, we neither sell nor share data within the meaning of those laws. No discriminatory treatment is applied to anyone exercising their rights. You may appoint an authorised agent to act for you.
How to exercise them. Write to mangiam@bymangia.space stating which right you are invoking. A reply follows within 30 calendar days, extendable for complex requests, in which case you are told before the deadline. We may ask for reasonable additional information to verify your identity, and for that purpose only.
If you hold an account on the Site, you can also export your data and request account deletion from your user panel.
Complaints to supervisory authorities:
- Paraguay: Agencia Nacional de Protección de Datos Personales, under MITIC.
- EU and EEA: the authority of your country of residence or work.
- United Kingdom: the Information Commissioner's Office (ICO).
- Argentina: Agencia de Acceso a la Información Pública (AAIP).
- Chile: Agencia de Protección de Datos Personales, under Law 21.719.
- United States: your state attorney general and, in California, the California Privacy Protection Agency.
10. Minors
The Site is aimed at professionals and is not directed at children. We do not knowingly collect data from anyone under 16, or the minimum age set by your local law, which is 13 in the United States for COPPA purposes. If we learn that a minor's data was received without parental authorisation, it is deleted. If you believe this has happened, contact us.
11. Security and breach notification
Reasonable technical and organisational measures are in place: TLS encryption in transit, encryption at rest in the database, passwords stored using key derivation functions, role-based access control, least privilege, row level security policies in the database, event logging, backups and perimeter protection.
No system is infallible. If a security breach creates a risk to your rights, the competent supervisory authority will be notified within 72 hours of becoming aware of it, and you will be notified without undue delay where the risk is high. Incident handling is carried out directly by Marcelo Mangiacavalli, at mangiam@bymangia.space.
12. Changes to this policy
This policy may be updated. The version in force is always published at this address with its effective date. If a change is material and affects processing based on your consent, you will be told and, where required, asked for fresh consent before continuing to use your account.
13. Contact
Marcelo Mangiacavalli Av. Santa Teresa 2790, Asunción, Paraguay mangiam@bymangia.space