Comprehensive Privacy Notice

PP-PRIVACY-0.3.6 · 2026-09-09

1. Controller and scope

Aztlan Engineering, at Sabadonas 53 PA, La Concordia, Naucalpan, Edo Mex, 53126, is responsible for the processing described here under the name Poke Primos. Our privacy contact is Aztlan Engineering Privacy Contact, reachable at sales@aztlan-eng.com or in writing at that address, marked for privacy.

This notice covers accounts on customers.aztlan-eng.com, account linking and access checks in Discord server 1537592665535942709, Project Garfield inventory notices, support and moderation activities we perform. Discord and retailers also process data within their own services; this notice does not replace their notices.

2. Data and sources

We do not request sensitive data, identity documents, your complete birth date or banking details for ordinary pilot registration. Avoid including them in support messages. If documents are necessary to verify a rights request, we will provide a restricted channel and explain the minimum information needed. The 18+ declaration is not documentary verification. If we identify an underage account, we will restrict access and address deletion or justified retention; we do not seek participation by minors.

Linking uses Discord's identify identity permission. Our flow does not request permissions to read your private messages or contact list. The access token is used transiently to check identity, then discarded and revoked; the bot checks membership and roles in this server. This does not delete data Discord retains within its own service.

3. Purposes and consent

We process the data needed to create and authenticate your account, link Discord, check membership and roles, record terms acceptance and adulthood, enable or restrict access, display inventory and notices, handle support and rights requests, investigate incidents and meet legal obligations. To perform duties arising from our relationship with you, we use only necessary data; where processing requires consent, we obtain it in the required form. Contract acceptance is not unlimited permission to process data.

Automated membership and role checks occur approximately every 15 minutes and can affect access. While free access is enabled, server membership qualifies without any particular role, subject to the other onboarding requirements. Poke Primos Membership is required when free access is disabled; Inventory Access is only a generated marker and never qualifies its holder by itself. Administrative revocation overrides eligibility; you may request human review through Garfield support tickets or, if you cannot access tickets, at sales@aztlan-eng.com. Privacy rights remain available if your account is restricted.

We do not undertake secondary purposes of optional advertising or enable optional direct messages through server membership. If we propose these purposes, we will describe them beforehand and offer a separate, revocable choice without conditioning the core service on acceptance. A rights request or refusal of advertising will not be grounds for a penalty.

4. Providers, communications and transfers

For ordinary support, account issues and access reviews, open a ticket through Garfield support tickets. This requires Cloudflare email sign-in and a customer account. Tickets remain reachable when Discord membership or terms checks deny inventory access. If you cannot sign in or access the ticket system, email sales@aztlan-eng.com. For privacy and ARCO rights, use that email directly without signing in or opening a ticket; do not send identity documents through ordinary tickets.

Cloudflare, Inc. provides email-code authentication through Access, request processing through Workers and database hosting through D1. It processes the account and technical data described here on our behalf for those services. Its applicable contract and data-processing terms govern that work. Cloudflare also describes certain processing for its own service security and operation in its privacy policy. Processing can take place outside Mexico; we do not promise Mexican-only storage. Cloudflare privacy policy.

Discord Inc. operates the Discord service for users outside the European Economic Area; Discord Netherlands BV is identified for EEA users. Linking, bot membership/role queries and any role changes exchange the relevant Discord user and server identifiers with Discord. These communications support the Discord-linked service you request. Discord runs its own platform and is not described here as our exclusive processor. It processes data in the United States and potentially other countries under its own notice. Discord privacy policy.

Optional ticket transfer to Discord: when you choose the Discord-supported ticket channel and separately authorize forwarding, we send the message, request/customer IDs, category and time to a private staff Discord channel to answer your request. The payload does not add your email, but authorized staff can resolve your customer ID. You can refuse that transfer and receive support by emailing sales@aztlan-eng.com, without losing inventory eligibility. Do not submit identity documents, passwords, sign-in codes, financial details or sensitive information in tickets. Privacy/ARCO requests go directly to that email, without sign-in or a ticket. Tell us there if you want to withdraw permission for further ticket forwarding.

The choice shown before a ticket is sent is: “I authorize Aztlan Engineering to transfer this message, its category, request ID, customer ID and timestamp to Discord Inc., including processing outside Mexico, so authorized Poke Primos staff can handle this support request in a private Discord channel.” The choice is initially unchecked. Refusal leaves email support available. Terms acceptance is not this consent.

Messages sent to sales@aztlan-eng.com pass through Cloudflare Email Routing and the Project Spawn email handler to a personal Gmail mailbox managed by the operator. Cloudflare handles forwarding; Google’s Gmail handles receipt and mailbox storage of sender/recipient information, message content and attachments for support and privacy requests. These services may process data outside Mexico. Personal Gmail uses Google’s consumer service terms and privacy policy; we do not describe it as a Google Workspace account or assume a Workspace processing agreement. Google provides this mailbox under its consumer terms and privacy policy, including its own service-security and operation purposes. We use it to receive and answer your request; this notice does not claim that Google has accepted a bespoke processing agreement with Aztlan Engineering. You may also submit privacy requests at our postal address. Google consumer-service guidance. Human operator access to this mailbox is limited to Philip. No additional mailbox users, onward forwarding or exports have been reported by the operator. The email handler forwards the email to Gmail and queues a generic Discord Ops alert so Philip knows to review the mailbox. The alert contains an opaque random reference and receipt time, not the sender, subject, message body or attachments. Alert-processing records also contain retry/lease and acknowledgment information. The reference and time may still be correlatable; we do not call them anonymous. We do not forward privacy-request content or identity documents into the ordinary Discord ticket bridge. We may disclose only necessary information to competent authorities when legally required. We do not sell your personal data.

Cloudflare service processing on our behalf is treated as processing by an encargado under the applicable arrangement, rather than automatically as an independent-recipient transfer. Necessary Discord linking/membership communications support the legal relationship for the service; optional ticket-content forwarding uses the separate consent above. This does not authorize other recipients or purposes. Our agreements and handling must meet applicable Mexican obligations; the label “private channel” does not itself establish those obligations.

Authorized AI assistance: Philip is the sole human user of the support/privacy mailbox. When he authorizes assistance with a specific task, Codex, an OpenAI service, may process task-relevant email content and metadata made visible through the signed-in Gmail browser interface, for example to diagnose email delivery or assist with handling a request. This can create additional copies in the task context and provider systems. The use described here is task-specific browser assistance, not a connected Gmail inbox feed or continuous inbox monitoring. We limit what is exposed to what is needed for the authorized task. Philip’s authorization to operate the tool does not replace any customer consent or other legal basis required for that processing. OpenAI processing is governed by the applicable account terms and settings; this notice makes no claim of zero retention, exclusion from training or business data-processing agreement coverage. To ask about or object to this use in your request, contact us by email or at our postal address.

5. Retention and closure

We use a manual review and deletion process; account closure is not automatic. Send closure requests through Garfield tickets, or use sales@aztlan-eng.com if you cannot sign in. Data-cancellation and other ARCO requests may always be sent directly to that email. Leaving Discord does not by itself delete the platform account.

The periods above govern our operating copies. Cloudflare documents D1 recovery history of 7 days on Workers Free or 30 days on Workers Paid; deletion from live tables does not immediately remove older recovery points. We restrict recovery use and reapply completed deletions before reopening a restored database. Cloudflare documents Workers Logs retention of 3 days on Free or 7 days on Paid, and Access authentication logs from 24 hours to 180 days depending on the plan. Any separately exported logs or backups must have an identified owner, location and deletion period; we do not create untracked copies. D1 limits, Workers Logs, Access log retention.

We delete support messages we control in Discord and request provider assistance where needed. Discord describes backup retention of 30–45 days and longer preservation in some legal/safety cases; we cannot promise immediate deletion from all of Discord's systems or deletion of your entire Discord account. Our deletion reply identifies completed actions, restricted/provider copies still pending and any justified retention. Discord retention.

The 7-day target does not replace the ARCO decision and implementation deadlines in section 6 or justify delaying a deletion that can be completed sooner. Discord API data are deleted promptly when no longer necessary or when validly requested, except where applicable law requires retention.

6. ARCO rights

You may independently request access to your data and processing information, rectification, cancellation or opposition by writing to sales@aztlan-eng.com or the controller's address. Active membership is not required, and you do not need to explain a reason for requesting access.

Include your name, a reply channel, the right or request, the data concerned where applicable, and information that helps locate them, such as your account email or customer ID if known. Verify your identity and, for a representative, their identity and authority. For rectification, describe and substantiate the correction. We will provide a proportionate, restricted identity-verification method; do not publicly post documents or send passwords or codes. Not knowing your customer ID does not prevent a request.

We will communicate a determination within 20 business days of receipt and, if granted, implement it within 15 business days after communicating the response. Each period may be extended once for an equal period if justified, with the reason communicated to you. We will explain any obstacle, refusal or partial fulfillment. After identity verification, data will be delivered through an agreed secure electronic channel; the process and electronic delivery will be free.

If dissatisfied or unanswered, you may approach the Secretaría Anticorrupción y Buen Gobierno, the authority identified in Mexico's private-sector data protection law, through its current channels. Legal filing deadlines apply to rights-protection requests: generally 15 business days after the response; if no response is given, a request may be filed after the controller's response period expires. You need not exhaust informal support reviews to pursue legal remedies. LFPDPPP, articles 27–40, Spanish official text.

7. Withdrawing consent and limiting use or disclosure

To withdraw consent or request limits on use or disclosure, write to sales@aztlan-eng.com, identifying the processing or communication you want stopped and a reply channel. We will use the same identity procedure and, as a service commitment, the 20- and 15-business-day periods above. We will explain any processing that must continue because of a legal obligation. Withdrawal is not retroactive.

If you stop authorizing processing essential to a feature, that feature may become unavailable; we will explain the specific effect. You may disable notifications using available Discord controls without deleting your account. Contact privacy for other disclosure limits, including review of the use of your ID in account watermarks.

8. Technologies and security

Access uses authentication and anti-abuse cookies. Cloudflare documents CF_Authorization with the configured session lifetime (24 hours if no relevant duration is set), CF_Session for 4 hours, CF_AppSession for 24 hours and CF_Device for 30 days. Optional CF_Binding depends on configuration. You can sign out at /cdn-cgi/access/logout and remove or block cookies in browser settings; blocking required cookies prevents or disrupts sign-in. Configured settings, not the documented default alone, determine the session on your account. Access cookies.

The inspected customer pages do not use application localStorage/sessionStorage, advertising cookies or analytics scripts. This does not mean providers collect no technical information. Access records authentication events; Workers/security services may process request metadata and configured logs. Discord uses cookies and similar technologies on its own service; use its privacy/cookie controls and browser settings. Discord cookie controls.

We restrict staff access, protect credentials and use administrative, technical and physical measures proportionate to the risks. If a breach significantly affects your economic or non-economic rights, we will inform you immediately as required by law. No system offers absolute security.

9. Changes and access to this notice

The current notice will be available without sign-in at Privacy Notice, with its version and date; previous versions can be requested at sales@aztlan-eng.com. We will announce relevant changes through the platform or registered email before new processing begins where appropriate and obtain any additional required consent. Updating this notice does not by itself authorize new purposes. You may request a copy from privacy. The Spanish and English versions aim to describe the same processing; discrepancies will be corrected without diminishing rights.