Privacy notice

Who is responsible

The data controller is the Atitlán Conecta Team. For any question or request about your data, write to us at hola@atitlan.app.

What data we use

Business data: name, category, phone, address, opening hours, social media and description. It comes from what the business itself published on its social media, website or Google, from field visits with the written authorization of the person in charge, or from the owner. We never make up data: anything missing is shown as “Not available”.

Your account: your email, the date you accepted this notice and, if you want, a public name. You sign in with a link sent to your email; we do not store passwords.

What you send through forms: suggestions, registrations, listing claims, events and reports.

Reviews: stars, text, tags, date and whether you scanned the business's QR code.

Technical data: Cloudflare Turnstile analyzes browser signals to tell people from bots; we keep an encrypted fingerprint of your connection for 30 days only to stop abuse. To keep you signed in, the site stores an identifier in your browser's storage. We do not use advertising cookies or third-party trackers.

We do not ask for sensitive data (ethnic origin, health, religion, political opinions or sexual orientation). If you write it in a comment, we remove it during moderation.

What we use it for

Publishing and maintaining the directory, checking that the data is correct and moderating what is submitted.

Showing reviews and responding to reports.

Sending listing owners their welcome kit and notices about their listing.

Sending you promotions only if you agreed to them separately; you can unsubscribe at any time.

We do not use your data for any other purpose without asking your permission again.

Your consent

We ask for your explicit consent before collecting your data: when you create your account you tick the acceptance box, and the date and the version of this notice are recorded; each form has its own box.

You can withdraw your consent at any time by deleting your account or writing to us. Withdrawing it does not affect anything done before.

Who it is shared with

We do not sell or trade personal data.

We use providers that process it only on our behalf and with security measures: Supabase (database and accounts, servers in Oregon, United States), Vercel (site hosting), Cloudflare (bot verification), Resend (email delivery) and OpenFreeMap with OpenStreetMap data (maps your browser downloads directly).

This means your data is stored outside Guatemala. By creating your account you expressly accept that transfer; we choose providers that encrypt information and grant you enforceable rights.

What is shown publicly

Business data. For public institutions, only name, phone and address.

Reviews with a short name (for example, «María G.») or «Visitor». Your email is never published.

How long we keep it

Account, profile and reviews: until you delete your account.

Business listings: while the business is active; if it closes or the owner asks for it to be removed, it is taken off the site.

Rejected submissions and unpublished field surveys: 24 months, after which they are deleted automatically.

Encrypted connection fingerprint: 30 days.

Listing change history: as long as the listing exists, so we can explain why a piece of data changed.

Your rights

You have the right to: know whether and how we process your data (information and access); correct it (rectification); ask for it to be deleted (erasure and the right to be forgotten); object to or ask us to limit its use (objection and restriction); and receive it in a commonly used format to take it to another service (portability).

From «My account» you can download all your data in a file and delete your account instantly. For any other request, write to us at hola@atitlan.app: it is free and we reply within 30 days at most.

If you own a business that appears in the directory and do not want to be listed, ask us to remove the listing and we will.

If you are not satisfied with our response, you can go to the relevant data protection authority or to DIACO (Guatemala's consumer protection office). If you are visiting from the European Union or another country with its own law, you also have the rights that law gives you.

Automated decisions

We do not make decisions about you based solely on automated processes. Itineraries and searches are suggestions you choose, and all moderation is decided by a person.

Security

We protect information with encrypted connections, row-level permissions in the database, restricted team access and bot verification.

If a security breach affecting your data occurs, we will notify you and the competent authority within 72 hours at most of becoming aware of it, explaining what happened, its possible consequences and what we did to fix it.

Minors

Accounts and reviews are for adults only.

Changes to this notice

If we change it, we update the version and date above. If the change is significant, we announce it on the site and, if it affects what you agreed to, we will ask for your consent again.