Privacy Policy

Aventhera Group LLC, a company incorporated in the State of Wyoming (USA), operating under the trade name Mesa Real. You may contact us on privacy matters at contact@aventhera-group.com.

• Identification and contact data: first name, surname, postal address, email and telephone.
• Billing and shipping data required to fulfil your order.
• Account data: credentials, order history and preferences.
• Browsing and usage data, when authorised via our analytics or marketing cookies.

We do not collect special categories of data or data from minors.

• Performance of the contract: order management, shipping, returns, customer care and warranty.
• Compliance with legal obligations: invoicing, accounting, taxation and responses to authorities.
• Consent: newsletter sending, non-essential cookies and commercial communications.
• Legitimate interest: fraud prevention, site security and service improvement.

We keep your data only for as long as necessary to fulfil the purpose for which it was collected and, thereafter, for the periods legally required (tax, commercial and liability). Newsletter data is kept until you unsubscribe.

We name only the providers that actually process your data. We do not sell or transfer your data to third parties for commercial purposes.

• Lovable Cloud (Supabase) · Supabase Inc.

  Hosting & database · EU

  Site hosting, database, authentication and file storage.

  Data: Account data and credentials · Orders and addresses · Inquiries and complaints · Private file attachments

  Documented safeguards: EU region · Row-Level Security enabled · DPA published by Supabase.

  PRIVACYDPA
• Cloudflare Turnstile · Cloudflare, Inc.

  Anti-spam · Global

  Anti-spam protection on forms (contact, newsletter, complaints).

  Data: IP address · User agent · Anti-bot signals (no personal identifiers)

  Documented safeguards: Turnstile does not use tracking cookies or build advertising profiles.

  PRIVACYDPA
• Google Analytics 4 · Google Ireland Ltd.

  Analytics · US

  Aggregated site usage statistics. Only activated with your consent.

  Data: Truncated IP (anonymize_ip) · Navigation events · GA session identifier

  Documented safeguards: Consent Mode v2 defaults to denied · IP anonymised · no advertising signals until marketing consent. · Only activated with analytics consent.

  PRIVACYDPA
• BTCPay Server

  Payments · EU

  Optional Bitcoin payment processing. Contacted only if you choose this method at checkout.

  Data: Order reference · Amount and currency · Invoice address (no personal data shared)

  Status: We have not yet published a formal DPA for this provider. Self-hosted instance. We do not transmit name, email or address to the processor.

• Google Fonts · Google Ireland Ltd.

  Fonts & CDN · US

  Delivery of site typography (Cinzel, Cormorant, Inter).

  Data: IP address · User agent

  Status: We have not yet published a formal DPA for this provider. We are evaluating self-hosting fonts to remove this transfer.

  PRIVACY

Because we rely on providers established in the United States and other countries, your data may be transferred outside the European Economic Area. In such cases we apply the Standard Contractual Clauses approved by the European Commission or other equivalent legal mechanisms.

You may exercise your rights of access, rectification, erasure, objection, restriction of processing, portability and withdrawal of consent through our request form or by writing to contact@aventhera-group.com. All requests are logged with a reference code and answered within the applicable legal deadline. If you believe your rights have not been properly addressed, you may file a complaint with the supervisory authority competent in your country of residence.

For details of the cookies used, please consult our Cookie policy.