Privacy policy

Who is responsible for your data

Data controller: PENDING COMPLETION, tax ID PENDING COMPLETION, registered at PENDING COMPLETION.

For anything related to your data, including asking for it to be deleted, write to PENDING COMPLETION.

What is collected and why

When you create an account: your name and your email. The name is so we know what to call you in the chat, and the email is so you can sign in and recover your password. The password itself is not stored: what is stored is a cryptographic hash, which cannot be turned back into your password.

When you place an order: which items you reserved, the price you accepted, the payment method you chose and the pickup point. Without this there is no order.

If you pay by bank transfer: the photo of the receipt you upload. Before it is stored it is reprocessed to strip its metadata, including the location your phone usually embeds in every photo.

The messages in each order's chat. They are the record of what was agreed — time, place, any change — and that is why they cannot be edited or deleted, not by you and not by the shop.

Minimal technical data: the IP address of sign-in and sign-up attempts. It is used only to slow down brute-force attacks and is deleted after fifteen minutes.

What is NOT collected

There are no advertising cookies, no analytics cookies and no social media cookies. The only cookies this site sets are your session cookies: without them you could not stay signed in.

Your information is not shared with advertisers or social networks. There are no third-party tracking pixels.

No card data is stored because there is no payment gateway: here you pay by bank transfer or in cash, in person.

In-person deliveries

Deliveries happen in person, at a public place agreed through the order's chat. The shop does not ask for or store your address: there is no field to write it in.

The pickup point you choose is stored with the order, so both sides know where you agreed to meet. It is a shopping centre or another public place, not your home.

How long it is kept

Orders and their conversations are kept while the account exists, because they are the record of what was bought and agreed.

Payment receipts are kept for as long as Ecuadorian accounting rules require. TODO(owner): confirm the exact period with your accountant and state it here.

Sign-in attempt records are deleted automatically after fifteen minutes.

Who else sees your data

Supabase, which is where the database and file storage live. It acts as a data processor and its servers are outside Ecuador.

Cloudflare, which serves the site and protects it from attacks.

Nobody else. Data is not sold or handed over.

Your rights

You can ask for access to your data, for it to be corrected or deleted, or for its processing to stop. Write to PENDING COMPLETION and you will get an answer.

There is one honest limit: if you have orders, simply deleting your account would also delete the record of those purchases, which the shop needs to keep. In that case you will be told what can be deleted and what cannot, and why.

If you believe your data is not being handled properly, you can go to Ecuador's Superintendency for Personal Data Protection.

Minors

This shop is not aimed at minors and no data is knowingly collected from them.

Changes

If this policy changes, the date above will say so. Important changes are announced by email to anyone with an account.