1. Introduction & Scope
This Privacy Policy explains how Ecovilla Rentals ("Platform", "we", "us") collects, uses, shares, and protects the personal information of the people who use our website and application — including guests, property owners ("Hosts"), and community administrators (together, "you").
We are committed to handling your personal data in accordance with the laws of the Republic of Costa Rica, in particular Law No. 8968 on the Protection of the Individual with regard to the Processing of their Personal Data ("Law 8968") and the regulations of the Agency for the Protection of Data of the Inhabitants ("PRODHAB").
By creating an account or using the Platform, you acknowledge that you have read and understood this Policy.
2. Information We Collect
2.1 Account & profile information. When you register we collect your name, email address, and a password (stored only in encrypted/hashed form by our authentication provider). You may optionally add a phone number, nationality, short biography, and a profile photo.
2.2 Listing information (Hosts). If you list a property, we collect the property details you provide — title, description, location and lot identifier, community, photographs, pricing, availability, amenities, and house rules.
2.3 Booking & transaction information. When a booking is requested or confirmed, we collect the stay dates, booking status, and any message you send with the request. Payment and Host payout details are processed by our payment provider (Stripe); we do not store full card numbers on our systems.
2.4 Messages. We store the in-app messages exchanged between Hosts and guests so that conversations are available to both parties and to help us enforce our community standards.
2.5 Saved listings. We record the listings you mark as favourites so we can show them back to you.
2.6 Information collected automatically. Like most online services, our servers and providers automatically receive technical data such as your IP address, device and browser type, and basic usage information. We use browser storage (see Section 6) to keep you signed in.
3. How We Use Your Information
We process your personal information to:
- Create and manage your account and authenticate your sign-in;
- Publish listings and enable guests to search, view, and book properties;
- Process booking requests, payments, and Host payouts;
- Enable secure communication between Hosts and guests;
- Send transactional notifications (e.g. booking requests, status updates, and messages);
- Maintain the safety and integrity of the Platform and prevent fraud or abuse;
- Comply with our legal, tax, and regulatory obligations;
- Identify potential matches with participating communities and notify them using a unique identifier if a match is found in their CRM.
- Understand how the Platform is used so we can improve it.
4. Legal Basis & Consent
4.1 In accordance with Law 8968, we process your personal data on the basis of your prior, express, and informed consent, which you provide when you create an account and accept this Policy.
4.2 We also process data where it is necessary to perform the service you have requested (for example, to complete a booking) or to comply with a legal obligation.
4.3 You may withdraw your consent at any time (see Section 11). Withdrawing consent does not affect processing carried out before withdrawal, and may mean we can no longer provide certain features of the Platform.
5. How & When We Share Your Information
5.1 With the other party to a booking. When you request or confirm a booking, we share the information necessary for that stay between the Host and the guest (such as your name and your messages). To keep communication on-platform, messages may not contain email addresses or phone numbers, and we do not share your contact details with other users.
5.2 With service providers. We rely on trusted third parties to operate the Platform, and share only the data they need to perform their function:
- Supabase — secure database, authentication, and hosting of your account data;
- Stripe — payment processing and Host payouts;
- Cloudinary — hosting and delivery of listing and profile images;
- An email delivery provider — to send you transactional notifications.
5.3 For legal reasons. We may disclose personal data where required by law, court order, or a competent authority, or to protect the rights, safety, and property of our users or the Platform.
5.4 Business transfers. If the Platform is involved in a merger, acquisition, or transfer of assets, your information may be transferred as part of that transaction, subject to this Policy.
5.5 Participating residential communities. Where applicable, we may share a unique identifier with a participating community where a match has been identified as described in Section 3 of this Policy.
6. Cookies & Tracking Technologies
6.1 We use your browser's local and session storage to keep you securely signed in and to remember basic preferences. These are essential to the functioning of the Platform.
6.2 We do not use third-party advertising or cross-site tracking cookies. Any analytics we use are limited to understanding aggregate usage of the Platform.
7. Data Retention
7.1 We keep your personal information for as long as your account is active and for as long as necessary to provide the Platform.
7.2 Certain records — such as booking and payment history — may be retained for a longer period where required to meet legal, tax, accounting, or dispute-resolution obligations under Costa Rican law.
7.3 When you close your account, we delete or anonymise your personal data within a reasonable period, except for information we are required or permitted to retain as described above.
8. Data Security
8.1 We apply technical and organisational measures to protect your data, including encryption in transit (HTTPS), hashed passwords, role-based database access controls, and row-level security so that each user can access only their own data.
8.2 No method of transmission or storage is ever completely secure. While we work hard to protect your information, we cannot guarantee its absolute security.
8.3 In the event of a security breach affecting your personal data, we will notify the affected individuals and PRODHAB within five (5) business days, as required by Law 8968.
9. International Data Transfers
Some of our service providers (such as Supabase, Stripe, and Cloudinary) may store or process data on servers located outside Costa Rica. Where this occurs, we take reasonable steps to ensure your information continues to be protected to a standard consistent with this Policy and applicable law.
10. Children's Privacy
The Platform is intended for users aged 18 and over. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it.
11. Your Privacy Rights
Under Law 8968 you have the right to:
- Access the personal information we hold about you;
- Rectify data that is inaccurate, incomplete, or out of date;
- Delete your data, subject to the retention exceptions in Section 7;
- Withdraw consent or object to certain processing; and
- Request a copy of your data in a portable format.
You can review and update much of your profile information directly from your account dashboard. To exercise any of these rights, contact us using the details in Section 13. You also have the right to file a complaint with PRODHAB if you believe your data has been handled improperly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Effective" date at the top of this page and, where the changes are significant, provide a more prominent notice. Your continued use of the Platform after an update constitutes acceptance of the revised Policy.
13. Contact Us
If you have questions about this Policy or wish to exercise your privacy rights, please contact our community management team at laecovillaa@gmail.com.