Privacy Policy

This Privacy Policy describes how Las Arecas (our trade name; hereinafter "we", "us" or "our") collects, uses, shares, retains and protects personal information on the internal apartment management platform and related services (the "Service"). We operate this platform to manage rental apartments in Mérida, Yucatán, Mexico, including bookings, guests, payments, documents, calendar and communications. The company that owns the "Las Arecas" brand is the controller of personal data.

This policy is issued in compliance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and other applicable regulations. It explains what data we collect, for what purposes and legal bases, with whom we share it, how long we keep it and how you can exercise your rights. By using the Service or connecting your Google account, you accept the practices described here.

1. Information We Collect

We collect only the information necessary to operate and provide the Service. Depending on the type of user and the operation, we process the following categories:

• 1.1 Account and access data (staff and administrators): name, email address, password (always stored as an irreversible hash, never in plain text), role, area or department, permissions and preferences. If you sign in with Google, we receive an account identifier and the basic information from your profile (name, email address and photo).
• 1.2 Contact data: phone number and WhatsApp account (of staff and, where applicable, of guests or clients), for operations and communication.
• 1.3 Official identification and documents: when the operation requires it (for example, guest registration), we may collect and store official identification documents (such as INE or passport) and supporting documents or receipts that the guest or staff upload to the platform. These documents are requested only where applicable and for the corresponding operational or legal purpose.
• 1.4 Booking and stay data: check-in and check-out dates, number of guests, assigned apartment, guest names, booking notes, tasks and operational activities.
• 1.5 Payment and billing data: amounts, concepts, payment status, payment method (cash, transfer or card) and the associated receipts, vouchers or invoices (files). We do not store full card numbers or CVV codes; where a card payment is involved, it is processed by the relevant bank or payment provider under its own policies.
• 1.6 Communications: messages exchanged over WhatsApp, internal notes and support requests.
• 1.7 Usage and technical data: IP address, device and browser type, activity and security logs, and diagnostic data, in order to keep the Service secure and working properly.
• 1.8 Google data (Calendar): as described in section 4, only when an administrator voluntarily connects a Google account.

Third-party data. Some guest or client information is entered by Las Arecas staff as part of operations. In those cases, whoever enters the data must have the corresponding legal basis with respect to the data subjects.

We do not request or collect special categories of data (health, ethnic origin, beliefs, etc.) that are not necessary for operations.

2. How and Why We Use Information

We use information for the following purposes, each supported by its legal basis:

• Provide and operate the Service: manage bookings, guests, apartments, payments, documents and communications. Legal basis: contractual relationship.
• Authenticate users and protect the security of the platform, prevent fraud and unauthorized access. Legal basis: legitimate interest and contractual relationship.
• Synchronize the internal Calendar with Google Calendar when you expressly authorize it. Legal basis: your consent.
• Send operational notices, reminders and notifications related to the Service. Legal basis: contractual relationship.
• Handle support, compliance and privacy rights requests. Legal basis: consent and legal obligation.
• Comply with legal, accounting, tax and security obligations. Legal basis: legal obligation.
• Improve the visible features of the platform (for example, fixing errors and streamlining workflows). Legal basis: legitimate interest.

We do not use information for secondary purposes such as advertising, commercial prospecting, marketing or building consumer profiles. If we ever wished to use it for a different purpose, we would ask for your consent again.

3. With Whom We Share Information

We do not sell, rent or transfer your personal information. We share it only with the following providers and in the following situations, and only to the extent necessary to operate the Service:

• Infrastructure and database: cloud and managed database providers (for example, Google Cloud and the provider of the Postgres database) that host the platform and the information.
• Messaging: WhatsApp / Meta, to send and receive operational communications.
• Google Calendar: when the administrator authorizes the connection, as described in section 4.
• Support providers: transactional email, PDF generation, antivirus and error monitoring services.
• Authorities and legal obligations: when required by law, or to protect rights, safety and the integrity of the Service.
• Professionals: legal, accounting or audit advisors bound by confidentiality duties.

All providers act as processors or subprocessors under contracts or obligations that require confidentiality and reasonable security measures, and they process the data only in accordance with our instructions.

4. Use of Google Calendar Data

When an administrator voluntarily connects a Google account to the Las Arecas Calendar, the app requests the following permissions (scopes) from the Google API:

Google data we access. When you connect your account we access only your name, your email address, your profile photo and the events and calendars of your Google account (Google Calendar) that the app needs to reach for the internal calendar. The permissions in the table above describe exactly that scope: nothing more.

How we use it. We use that data only to provide and improve the visible functionality of the internal Las Arecas calendar: create, edit, view and synchronize events (bookings, tasks and operational activities) between the platform and the shared calendar chosen by the administrator, and to authenticate the connection. We do not use it for any other purpose.

With whom we share or transfer it. We do not transfer or disclose your Google data to third parties for purposes other than those described in this policy. It is shared only with the subprocessors necessary to operate the Service (for example, the cloud infrastructure provider and the database provider), subject to contractual confidentiality and security obligations, or when required by law or to protect the security of the Service. Other personnel only access what is strictly necessary for their role.

What we do not do: AI/ML, advertising and sale. Data obtained from the Google Workspace and Google Calendar APIs is not used to develop, improve or train artificial intelligence or machine learning models (AI/ML), whether personalized or non-personalized. It is also not used for advertising, personalized ads, sale or resale of data, credit scoring or to build consumer profiles. We do not share this data with third parties for marketing purposes.

Compliance with Google policies. Las Arecas's use of information received from the Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. In particular: (a) we only use the data for the visible features described in this policy; (b) we do not transfer it to third parties except as necessary to provide the Service, for security reasons or to comply with legal obligations; (c) we do not use it for advertising; and (d) we do not allow anyone to access it unless it is necessary to operate the Service, for security reasons or to comply with legal obligations.

5. Cookies and Similar Technologies

We use cookies and local storage strictly necessary to keep the session active, remember preferences (such as light/dark theme) and protect the platform against fraud and unauthorized access. These technologies are not used for behavioral advertising. You can block or delete cookies from your browser; some sign-in features may stop working.

6. Security

We apply reasonable technical and organizational measures to protect information, including encryption in transit (HTTPS/TLS) and at rest by our infrastructure providers, passwords stored as hash, role-based access control, employee authentication, audit and security logs, backups, malware scanning of uploaded files and private storage of files. These measures explicitly protect the Google data we access (name, email address, profile photo, calendars and events) and, in particular, the access tokens, which are stored encrypted and segregated, and used only for authorized features. Security logs do not include passwords, tokens or unnecessary personal data. No system is 100% infallible, but we work continuously to reduce risk.

7. Data Retention and Deletion

We keep data only for as long as necessary for the purposes described and to comply with legal obligations. In general:

• Account and access data: while there is an active relationship with the company and, afterwards, for the applicable legal or contractual periods.
• Booking, stay and payment/billing data: during the relationship and, afterwards, for the applicable legal, accounting and tax periods (as a general rule, up to 5 years).
• Official identification and documents: only for the time necessary for the purpose that gave rise to them and, where applicable, for the legal period.
• Communications and files: while the relationship is active or they are necessary for operations; you may request their deletion as set out in this policy. Uploaded files are scanned with antivirus and stored in a private environment.
• Usage data and technical/security logs: for limited periods and, afterwards, they are deleted or anonymized.
• Google Calendar data: access tokens and synchronization information are kept only while the Google connection remains active. You can revoke access at any time from your Google account at myaccount.google.com/permissions or by disconnecting the account from the Calendar panel. When you revoke access, we delete the tokens from our databases and immediately stop synchronizing; events already created in your Google calendar remain yours and you can delete them from Google.

Once the periods end, the data is deleted from our databases or irreversibly anonymized.

Deletion requests: you can request the deletion of your personal data through our data deletion form or by writing to DinoCodeAdvisor@gmail.com with the subject "Data Deletion Request". We will verify your identity and handle the request within a maximum of one month.

8. Your Rights (ARCO)

As a data subject, you may exercise your rights of Access, Rectification, Cancellation and Objection (ARCO), as well as withdraw the consent you have given, limit the use or disclosure of your data and request its portability where applicable. To exercise them, use the data deletion form or write to us at DinoCodeAdvisor@gmail.com stating your name, the data concerned and the right you wish to exercise. We will handle your request within a maximum of one month and, if it is not appropriate, we will explain why. You may also file a complaint with the data protection authority that applies to you (in Mexico, the INAI).

9. Minors

The Service is an internal tool for work use and is not directed at minors. We do not knowingly collect data from minors.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in the Service or in regulations. We will publish the current version on this page with its last updated date. If the changes are relevant, we will notify you through the usual channels.

11. Contact

For questions about this policy, about how we process your data or to exercise your rights, write to us at DinoCodeAdvisor@gmail.com.