Privacy policy

1. Who is responsible for your data

The Yellow Page (yellowecuador.com) is operated by [Legal name and RUC — pending], the controller of the personal data described here under Ecuador's Organic Law on Personal Data Protection (LOPDP).

For any privacy question, write to hello@yellowecuador.com.

2. What we collect

Account: name, email address, account type and, if you upload one, a profile photo. Your password is handled by our authentication provider and is never stored in plain text.

Professional profile (agents and agencies): phone, WhatsApp, public email, website, social links, license number, service areas, logo and cover.

Listings and content: property photos, descriptions, location and price; posts, comments and reviews you write. We strip photo metadata (including GPS location) on upload.

Contacting professionals: when you message an agent or request a viewing we store your name, email, phone and message and share them with that agent or agency.

Messages and attachments you exchange on the platform.

Professional verification: the documents you submit (e.g. ID, license or RUC). Only the verification team sees them; we delete them 30 days after a request is rejected and 90 days after a verification ends.

Billing data: RUC or ID number, legal name, address and phone, if you subscribe to a plan.

Support requests: when you write to us from "Help & support" we keep the topic, the subject, your messages and our replies, your account's plan at that moment and, if you came from a property, an invoice or a specific page, that reference. The support team sees them and may add internal working notes; replies also reach you by e-mail. They are kept while your account exists and are deleted with it.

Technical data: your IP address (stored only as a hash, for rate limits and fraud prevention), a random browser identifier to count views without duplicates and, for professional accounts, a technical device fingerprint kept for 90 days to detect fake accounts.

Valuations and assistant: anonymous valuations are deleted after 90 days unless you ask to be contacted; assistant conversations are deleted after 30 days.

WhatsApp button: when you tap “WhatsApp” on a listing or on an agent's or brokerage's page, the message that opens carries a short reference (for example, Ref. YP-K7Q2M9) and we store the click: the listing or page, the date and time, that reference, the language and your browser's random identifier turned into a hash that cannot identify you. It lets the agent know which listing you are writing about. If you are signed in and the notice “When you open WhatsApp, the agent receives your name, your email and the listing you asked about” shows under the button, the agent also receives those details as a contact; without that notice the click is anonymous. We never read or store what you write in WhatsApp. Clicks the agent does not turn into a contact are deleted after 90 days; those that become one are kept with that contact.

Push notifications (only if you turn them on, per device): the address your browser's push service gives us for that device, its encryption keys (stored encrypted), the device type (for example “Chrome · Android”), language and when we last notified it. You choose what each type of notice sends and can turn a device off or remove it in Notifications; they are deleted when the push service reports the device gone, and with your account. Your data export lists your devices.

3. Why we use it, and the legal basis

To provide the service you ask for (your account, listings, connecting buyers and tenants with professionals): performance of a contract.

To keep the platform safe, prevent fraud, spam and abuse, and moderate content: legitimate interest.

To send saved-search alerts and notices you turn on: your consent, which you can withdraw at any time from the email itself or your dashboard.

For optional usage analytics (PostHog), which tells us which parts of the site are used and where a process is abandoned: only your consent, which you give or refuse in the privacy notice and can withdraw at any time.

To meet legal and tax obligations: legal obligation.

We do not sell your personal data or use it for third-party advertising.

4. Who we share it with

The agent or agency you contact, and the public, for what you choose to publish (listings, professional profile, reviews, posts).

Providers that process data on our behalf: Supabase (database, authentication and files), Railway (application servers), Vercel (site hosting and visit analytics), Resend (sending the platform's e-mails) and, only if you accept usage analytics, PostHog (product analytics, with servers in the European Union). The others' servers are in the United States, so your data is transferred outside Ecuador. Those transfers are made under data-protection contract clauses with each provider, which bind them to use your data only to provide their service to us and to protect it to a level equivalent to what the LOPDP requires.

Assistant and artificial intelligence: when you use the search assistant, ask for an estimated price to be explained, or an agent generates a listing description or receives a summary of an enquiry, we send Anthropic (United States) the text that task needs: your question, the property details or the enquiry message. We do not send it your e-mail, phone number or ID number, and it is used only to generate the answer.

Payments (once they are enabled on the site): your card details go directly to our payment processor (Datafast, Ecuador) in its secure form, together with your name, ID or RUC number, phone, address and IP, which it requires to process the payment; we never see or store the card number or its security code. We keep the payment result and, if you turn on automatic renewal, a card identifier (token) issued by Datafast, which we stop using once you cancel the plan.

If something fails on the site or on our servers, we send a technical error report to Sentry (Functional Software, Inc., United States) so we can fix it: the type of error, the page where it happened and the pages and actions on the site just before it (without parameters or private links), and the browser and operating system. We do not send it your account, email, IP address, cookies or anything you type into forms, and we also remove emails and phone numbers that appear in error messages. A report is only sent when an error happens, and it is kept for at most 90 days.

Maps load from OpenFreeMap: your browser requests the map images from them directly.

Push notifications, if you turn them on: the browser hands the alert to its own push service (Google for Chrome, Edge and Android, Apple for Safari and iPhone, Mozilla for Firefox), which delivers it to your device. What travels is short and encrypted end to end: a title such as “New message from Ana” and a link — never the text of a message, addresses, phone numbers or e-mail addresses.

Authorities, when a law or court order requires it.

5. Cookies and local storage

We only use cookies and storage the site needs to work: the session cookie that keeps you signed in, the language cookie and, in your browser's local storage, your theme (light or dark) and the random identifiers described above.

Recently viewed properties: when you are signed in, your account keeps a history only you can see, with the last 50 properties you opened (an agent cannot see who visited their listing). In addition, to personalise recommendations (“For you”), we keep a counter for each property you open while signed in: how many times, and when you last did. That counter is not limited to 50 properties and is deleted on its own 90 days after the last visit. In your dashboard, under “Recently viewed”, you can remove a property or use “Clear history”: both also delete the counter for those properties.

Signed out, the last 20 properties you opened are kept only in your browser's local storage; they go away with “Clear history” on the list itself or when you clear the site's data, and when you sign in they move into your account. The properties you pick to compare are also kept only in your browser: they are removed with “Clear” on the comparison bar and when you sign out. No cookie is added for any of this.

Visit analytics (Vercel Web Analytics) uses no cookies and does not identify people: it only counts page views in aggregate. We use no advertising cookies.

Usage analytics (PostHog), only with your consent: when you arrive we ask whether you accept it; until you answer, and if you reject it, nothing is loaded or sent. If you accept, we record the pages you visit and specific actions (for example, that you ran a search and with how many filters, viewed or saved a property, sent an enquiry or started a payment), with a random identifier kept in your browser's local storage and, if you are signed in, your account's internal identifier and type. We never send your name, email, phone number, ID number or what you type into forms or the search box; we strip private links (invitations, shared collections, alert unsubscribes, payments) from addresses and do not share your IP address with PostHog. We do not record sessions. Your choice is kept in the “yp_consent” cookie for one year, with the version of this notice you answered and the date; if what analytics does changes, we ask you again.

You can change or withdraw your consent at any time from “Cookie settings” at the foot of every page or in the preferences section of this policy; when you withdraw it we stop sending data and delete PostHog's identifiers from your browser. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a rejection. When you delete your account we also ask PostHog to erase the data linked to it.

6. How long we keep it

For as long as your account is active. If you delete it, we delete or anonymise your personal data immediately; deleted content is purged for good within 30 days. Billing data and payment records are kept for up to seven years, the period Ecuadorian tax rules require.

7. Your rights

You have the right to access, rectify and update, delete, object to, port, and suspend the processing of your data.

From your dashboard (Privacy) you can download a copy of your data and delete your account, and under “Other requests about your data” ask us to correct something, object to a use, suspend processing or withdraw a consent; you see its status and our answer there. You can also write to hello@yellowecuador.com. We answer within 15 days.

“For you” recommendations and anti-fraud signals are computed automatically. If a decision based solely on automated processing significantly affects you (for example, your account being suspended), you can ask for a person to review it, give us your view and contest it by writing to us.

If you believe we did not handle your request properly, you can file a complaint with Ecuador's Superintendency of Personal Data Protection.

8. Security

All traffic is encrypted (HTTPS). We apply role-based access control, audit logging of administrative actions, and regular security reviews. No system is infallible: if we detect a breach affecting your data, we will notify you as the law requires.

9. Minors

The Yellow Page is intended for people over 18. We do not knowingly collect data from minors.

10. Changes

If we change this policy in a significant way, we will tell you on the site or by email before the change takes effect.