Privacy notice (full)

Huatulco.app is a travel guide to Huatulco, Oaxaca, Mexico. Much of it works without an account.

If you never sign in, almost nothing we store is linked to you. We record usage events — which screens and places were viewed, what was searched for, how many results came back — in a table that has no user column at all: it cannot technically be tied to a person. Those events carry a session identifier generated in your browser, held in sessionStorage, which dies when you close the tab. It does not follow you between visits.

What IS linked to your device, account or no account, is the record that you accepted the Terms and read this notice: which version, when, in which language, from which platform and app version, and a random identifier for that install that your browser generates and keeps so that you are not asked again (Cookies and device storage explains it). Whatever you accept while signed in is also linked to your account.

What you tell the welcome screen (language, dates, party size, interests) stays in your own device storage until you create an account. If you never create one, it never reaches us.

If you fill in a form, signed in or not, we process what you put in it:

• Business contact: your name, your business’s name, your phone or WhatsApp, your email if you give it, your message and the plan you were interested in.
• Feedback: your message, what it is about, the page you were on, and your email if you leave it so we can reply.
• Help, in the dashboard of a business you manage: the topic, your message and our reply, linked to your account and to the business. The other people who manage that business see them too.
• A reservation request from a business’s page: the date, the time, the party size, your name, your phone and your notes. No account is needed; if you are signed in, the request is linked to your account, so the business’s answer reaches you in the app. Who receives it is in section 7.
• Information about a property, in the investment section: your name, your email or phone and your message; if you are signed in, it is linked to your account. If you list a property: your name as the advertiser — which appears on the listing — your email or phone, and the property’s details.
• Requests about your data: what you ask for, anything you write in your request and, if you file it without an account, the email you leave us for the answer.

If you stay somewhere that uses our welcome tablet: the host keeps their bookings in Hospitable, and from there we receive your first name, how many of you there are, the dates of your stay and whether the booking still stands, so the tablet can greet you. Hospitable also sends us your surname, your email and your phone, and we do not keep those. We delete your stay 14 days after you check out.

If you create an account, we also process:

• Identification and contact data: your email address and password, handled by Supabase Auth. Passwords are stored hashed and we never see them. If you sign in with Google or Apple, we receive the basic details that account shares: your email — with Apple, if you choose, an Apple relay address instead of your own — and your name, if you share it. We offer Sign in with Apple, and when you use it Apple also gives us a token that we keep on our servers for one purpose only: to ask Apple, when you delete your account in the app, to remove the link between Huatulco.app and your Apple ID. We use it for nothing else, no screen shows it, and it is deleted with your account; of that unlinking we keep only whether Apple confirmed it, with nothing that identifies you. If instead you ask us to delete your account — with the Delete my account form or with a cancellation request — our team deletes it outside the app and that route does not send the token to Apple today: the token is deleted with the account, but the link may stay on your Apple ID until you remove it yourself, on your iPhone, in Settings → [your name] → Sign-In & Security → Sign in with Apple → our app → Delete.
• Profile: display name, username, avatar image, language and country, if you provide them.
• Your trips: the dates; how many of you are travelling and, if you note them, the children’s ages; your budget and interests; how you arrive and leave — airline, flight number, airport and times, if you note them; where you are staying — name, address if you give it, dates and, if you save them, the confirmation number and your notes; how you get around; your trip notes; your itineraries; and the bookings or purchases you log on the trip, with their confirmation numbers. If you share an itinerary, anyone with the link sees the plan and its dates, but not who you are.
• Dietary, accessibility or special-occasion notes for a trip, if you write them. These fields are optional, and what you put in them can reveal sensitive data, such as health data — an allergy, a wheelchair. We use them only to build your itineraries and answer you, which is why they travel to Google with the rest of your trip (section 7 and the AI notice).
• Your saved activity: favourite places and events, your nature life list, any hours or content reports you file, and anyone you have blocked.
• Reviews: what you write and the rating you give. A review is published on the place’s page together with your display name.
• AI concierge conversations: the messages you write and the model’s replies, plus technical details of each turn (model used, token counts, latency). Before anything is first sent to Google we ask your permission, and if you give it we record your permission linked to your account: which version of the notice, when, in which language and from which platform. Read the AI notice — this is the most sensitive part of all of it.
• Reservation requests from your trip: the date, the time, the party size, your notes and your phone if you give it. They are linked to your account and to that trip, and the business sees your profile’s display name (or “Huésped” if you have none).
• In-app purchases: transaction identifier, amount, currency and what you bought — the pass and its tier, or a concierge message top-up. Payment details never touch our servers — Apple or Google Play process them.
• Notifications on your phone, if you allow them in the app: that phone’s notification identifier (an Expo token), whether it is an iPhone or Android, the app version and the phone’s language, linked to your account; which notifications you turned on or off in Profile → Notifications, with the date you turned on the optional ones; and the record of the notifications we sent you.
• Clicks through to partner sites from your trip: when you follow a link to a booking site — a tour, a hotel — from your trip or your itinerary, we record the click together with that trip and that stop, so it is linked to your account. A click that does not come from a trip is linked to nobody; until late September 2026 we also stored the account on every click made while signed in, and those older records keep it until you delete your account.
• If you claim a business or work as a photographer: in the claim, your name, your phone and your role at the business; the link between your account and that business or photographer profile; and whatever you publish from it. If you handle a business’s reservations and turn on WhatsApp alerts, your WhatsApp number too.

Apart from those optional trip fields, no screen asks for sensitive personal data — health, ethnic origin, beliefs, sexual preference, biometrics. It could also reach us if you type it into a concierge conversation, a reservation note or a form, which is why we ask you not to unless you need to — and the AI notice asks you plainly not to for the concierge.

When you tap a "near me" control or the map’s locate button, your browser or phone asks your permission and, if you grant it, we use your position to sort the list by distance. We never ask for it on load and never in the background.

Those coordinates, rounded to about 11 metres, travel in the page address (?lat=…&lng=…) so the server can order the results. We do not write them to our database and do not link them to your account, but, like every address you visit, they appear in our hosting provider’s request logs (section 7) and, if that page fails, in the technical error alert our team receives.

Necessary purposes — without these the service cannot be provided, and they need no separate consent because they are the service you asked for:

• Creating and maintaining your account and session.
• Storing and showing you your favourites, trip plans, nature list and concierge conversations.
• Generating concierge replies and itineraries, only after you give us permission to send Google what you type and your trip details; if you do not, we send nothing and the rest of the service works the same (see section 7 and the AI notice).
• Getting your reservation requests to the business you chose, emailing the people at that business who handle them, and showing you its answer on your trip.
• Notifying you on your phone, if you allow it, when a business answers your reservation request and the day before your pass ends; if you handle a business’s reservations, of every new request; and, if you get a business’s Monday summary and turn it on, when it is ready. A business’s notifications carry the business’s name, the date, the time and the party size — the Monday one, its visits and taps for the week —, never the name or phone of the person booking.
• Publishing the reviews you write.
• Dealing with what you send us through the forms, and alerting our team as soon as it arrives.
• Welcoming you on the tablet where you are staying.
• Processing and recording purchases, and giving you what you bought.
• Recording clicks through to our affiliate partners’ sites, which pay us a commission when somebody books there: it is one of the ways the service pays for itself. A click that comes from your trip is linked to that trip.
• Recording that you accepted the Terms and read this notice, so we do not ask every time and can show that you did.
• Preventing abuse: rate-limiting requests, moderating visitor-submitted content and handling reports.
• Meeting legal, tax and accounting obligations, and responding to lawful requests from a competent authority.
• Handling your ARCO requests and being able to show that we handled them.

Optional purposes — you can object to these and still use the service:

• Our own usage analytics, which is how places are ranked by real popularity and how the dashboards businesses pay for are populated. These events carry no user column, so they do not describe an identified person. You can switch them off in Profile → Privacy and data.
• Trip notifications and nature in season: one morning notification while your trip lasts — the sea, the sunset, cruise days, nature in season. They are off until you turn them on in the app, and we keep when you did.
• Commercial messages. Today we send none: the only email this service sends is your account’s own — the password-reset email or the sign-in link, for instance —; if you manage a business, the notices about it (that we approved your request, that its plan started, changed, is about to end or ended), with a link to get its page ready, and, on a plan that includes it, the Monday summary of its page’s numbers, with a link to stop it in every email, and our reply to what you write to us through Help; and, if you handle a business’s reservations, the notices of the requests it receives. If we ever send a newsletter it will be because you asked for it, with a way to unsubscribe in every message.

• Use the app without an account. Most of the content works signed out, and with no account almost nothing is linked to you (section 2).
• Answer “Not now” when we ask your permission to use the AI: we send nothing to Google and you can keep using everything else.
• Delete your account whenever you like, from Delete my account. Read section 10 first: some things do not go with it.
• Switch off usage measurement in Profile → Privacy and data. The setting is kept in that browser or on that phone.
• Choose which notifications you get in Profile → Notifications, or switch them all off in your phone’s settings. When you sign out, that phone stops receiving them.
• Open our partners’ sites from a place’s page rather than from your trip, if you do not want the click linked to your trip.
• Leave the optional trip fields empty — dietary, accessibility, special occasion — if you do not want us to process them; you can clear them at any time.
• Object to the optional purposes by writing to the privacy address in section 1. You do not need to give a reason to object to an optional purpose.
• Withdraw your consent at any time by the same route. Withdrawal has no retroactive effect on processing already carried out.
• Control your browser storage. Clearing site data removes the session identifier, the language preference, the welcome-screen draft and the local record of your acceptance.

You have the right to access your data, to rectify it when it is inaccurate or incomplete, to cancel it when you believe it is not needed for the purposes in this notice, and to object to its processing for a legitimate reason.

You can exercise them in the app, in Profile → Privacy and data — download your data, correct your profile, file a request that is recorded with its date, or delete your account; by writing to the privacy address in section 1; or, if you can no longer sign in, with the form at Delete my account. The full procedure — what your request must contain, how quickly we answer, and what to do if the answer does not satisfy you — is at Your data and your rights. Exercising these rights is free.

We do not sell your personal data and we do not share it with advertisers. These providers process it on our behalf, only so that the service can work:

Supabase, Vercel, Google, Resend, Meta, Expo, Apple and our team’s chat service operate mainly from the United States, so using the service involves an international transfer of data.

In addition, in these cases your data reaches third parties who process it on their own account, not on ours:

• The business you send a reservation request to. It receives in its reservations inbox the date, the time, the party size, your name, your notes and your phone if you gave it. It needs them to handle your request — confirm it, offer you another time or decline it — which is why we do not ask for separate consent. Its terms with us require it to use your data only for that reservation, keep it confidential and delete it once it no longer needs it; from the moment it receives it, it answers for what it does with it.
• Our affiliate partners’ sites, when you follow one of their links: Viator and GetYourGuide (tours and experiences), Hotels.com, Expedia and Booking.com (accommodation, through the CJ affiliate network), Discover Cars (car hire), SafetyWing (travel insurance) and Airalo (eSIM, through the Impact affiliate network). Your browser leaves through a link of ours and lands on their site, which receives your visit like any website does — your IP address, your device and whatever cookies it sets — plus a reference code: the screen you came from and a random click code. We do not send them your name, your email or your account. When a Booking.com link comes from your trip, it may also carry your stay’s dates and how many adults and children are travelling, so the search opens with them.
• What that code is for: if you book, the partner pays us a commission, and its report carries the code, which lets us match the booking to the click — and, if the click came from your trip, to that trip. Whatever you agree to on their site is governed by their privacy notice and their terms.
• Apple and Google, if you choose to sign in with their account: they know you signed in to Huatulco.app and confirm to us who you are (section 2). If you signed in with Apple and you delete your account in the app, we send Apple the token from section 2 so that it removes the link; if our team deletes it at your request, today we do not send it, and the link may stay until you remove it from your Apple ID (section 2). What they do with that is governed by their own notices.

Weather comes from Open-Meteo, and map data and species photographs from OpenStreetMap and iNaturalist. Those services receive destination coordinates and catalogue queries — never anything about you.

We also share data when a competent authority lawfully requires it, and we may do so in a corporate reorganisation, in which case the acquirer takes on the same obligations set out in this notice.

To limit how many requests one origin can make — which is how abuse of the concierge, the forms, the partner links and the analytics endpoint is held back — we take your IP address, run it through SHA-256 with a secret salt, and keep only the truncated result. The address itself is never stored in our database.

Separately, Vercel and Supabase log the IP of every request in their own infrastructure logs, as any internet server does. Those logs are theirs, outside our control, and we cannot delete them on your behalf.

In addition: if you asked about a property, that request is kept, with no link to your account; clicks through to partner sites that came from your trips stay without the trip, so there is no longer any way to link them to you; editorial content you created as a business owner (the listing, the menu, events) stays published, with no attribution to your account; what you wrote through Help and our reply stay in that business’s dashboard, without your name; and business membership payments are kept as accounting evidence. The record of your in-app purchases, on the other hand, is deleted with your account; Apple or Google keep their own.

• Passwords are hashed by Supabase Auth and we never see them.
• Every table holding personal data is protected by row-level security policies in the database: a query made with your session can only reach your own rows.
• Photos you submit wait for approval in a private bucket, not a public one.
• A photographer’s deliveries are private to the person receiving them.
• Traffic is encrypted with TLS.

We claim no certifications we do not hold, and no system is invulnerable. If we detect a breach that significantly affects your rights, we will tell you without delay at the email address on your account.

To create an account you must be at least 13, as the Terms of Service require. If you are between 13 and 17, we process your data with the consent of your parent or guardian: by accepting the terms you declare that you are 18 or older, or that you have that permission. We do not knowingly collect data from children under 13: if we find an account belonging to someone under 13, or to someone under 18 without that consent, we will delete it. If you are a parent or guardian, you may exercise the rights in section 6 — access, rectification, cancellation or objection — on their behalf by writing to the privacy address.

If you note on your trip the ages of children travelling with you, you are the one providing that data, as their parent or guardian, and it is used only to plan the trip.

This notice carries a version number and an effective date at the head of the page. When it changes, the version goes up.

• A substantial change — new data, new purposes, a new provider receiving your data — moves the major or minor number and is shown to you inside the app the next time you open it, before you carry on using it.
• A wording correction that does not change the meaning moves only the last number and updates the last-revised date, without interrupting you.

The version in force is always the one published on this page.

If you believe we have breached your right to data protection, you may file a solicitud de protección de datos with the Secretaría Anticorrupción y Buen Gobierno, which has been the private-sector data protection authority since INAI was dissolved. You have fifteen days from the day we give you our answer, or from the day our deadline to answer expired.

Resolutions of the Secretaría are challenged by juicio de amparo, heard by specialised judges and courts.