How QueCargan collects, uses, shares, and protects personal data, and the rights you can exercise under Costa Rican law.
QueCargan is the operator and the data controller responsible for the processing described in this policy. Contact: hola@quecargan.com.
This Privacy Policy applies to the quecargan.com marketplace, accounts and dashboards, vehicle reviews, community and blog participation, communications, and related services (the "Service"), and to every person whose personal data we process.
QueCargan operates the Service from Costa Rica and is the responsible party (responsable del tratamiento) for the personal data in its databases. Contact for any privacy matter: hola@quecargan.com.
We process personal data under the constitutional protection of privacy and informational self-determination, Ley N.° 8968 for the Protection of the Person against the Processing of Personal Data and its Regulation (Decreto Ejecutivo N.° 37554-JP and its reforms), and other applicable laws. Where a visitor is subject to foreign data-protection law, we apply this policy in good faith and honor, to the extent reasonably possible, rights that such law grants in a manner not less protective than those described here.
Processing is limited to what each feature requires. Depending on what you use, we may treat:
An email address and authentication data are indispensable to create and secure an account; social sign-in additionally requires the provider identifier and the basic profile data the provider releases for the requested scopes. Without them we cannot create the account or provide signed-in features; public browsing remains available.
A display name, profile image, visibility preferences, marketing choices, vehicle details, and community contributions are optional unless a form clearly marks a field as required. Refusing optional data only limits the related feature or personalization.
When enabled, our first-party counter measures accepted public page views without cookies or browser storage. It excludes private/admin pages, bots and prefetch. It stores only counts and daily aggregate occupancy bitmaps, never visitor IPs, user agents, account IDs, referrers, query strings or visitor hashes.
For an approximate daily unique count, a verified proxy address and coarse browser/OS family are processed in server memory with a random daily salt. The result immediately sets a bit in a shared aggregate; neither the input nor the result is retained as an identifier. If trusted inputs are unavailable, views still count and the unique estimate is unavailable. Shared networks can undercount, address/browser changes can overcount, and one person may count on several days.
Daily aggregates are retained for 400 Costa Rica calendar days, minute counts for three days, and salts until two hours after the day closes. Independent maintenance removes expired data. This counter does not change the existing consent controls for optional PostHog analytics.
We treat personal data on the basis of your informed consent and, as applicable, for the execution of the service you request, the legitimate management, security, and integrity of the Service, and compliance with legal obligations. Treatment is limited to the purposes informed in this policy (principle of purpose), and you may revoke consent at any time by the means described below, without affecting the lawfulness of processing carried out before revocation.
We use personal data only to:
QueCargan does not request, and its features do not require, sensitive personal data as defined by Ley N.° 8968 — for example, racial or ethnic origin, political or religious convictions, health data, sexual life, or biometric or genetic data. Please do not submit sensitive data in reviews, community posts, or free-text fields.
If we ever receive sensitive data inadvertently, we will treat it only as strictly necessary to suppress it and will not use it for any other purpose. Write to hola@quecargan.com to report it and request its immediate elimination.
QueCargan's chat helps you find a published electric car and send requests to the team. It is optional, and its flows are available in Spanish only. You may look without an account. To answer, continue a run, or send a submission you need an account with a confirmed email address.
The chat stores four kinds of data. It stores the answers you give in each run, such as Ideal car and the chat forms. It stores each run: the session in progress, the latest result, and completed runs. It stores the submissions you send from the chat, with the summary, the contact details you provide, the files you attach, and that submission's history. It stores follow-up conversations: the messages you write and the chat's replies.
Submissions may also reach the team's mailbox, hola@quecargan.com, by email through Resend, with the summary and the contact details you provide, without the files. The team replies from that mailbox. Those copies and the email replies are not deleted with the account: they are kept in the team's mailbox until you ask hola@quecargan.com to delete them.
When follow-up replies are enabled, external artificial intelligence providers prepare them, and they may process the data outside Costa Rica. First, an automatic moderation service checks each message. For each reply, the provider receives your message, the earlier messages in that conversation, and the car whose page you opened the chat from, if any. If the conversation starts from a run, it may also receive that run's context: the answers you gave in it and, in Ideal car, the result. It does not receive the run's free-text notes or the files you attach. The provider receives a pseudonymous account identifier, which is not your email address or your name.
Before a message is stored or sent, QueCargan automatically replaces email addresses, phone numbers, cédula or DIMEX numbers, and card numbers. This protection is not perfect: do not write personal or sensitive data in the chat. To limit abuse, your IP address is turned into an irreversible code that is not stored. The chat's replies are informational and based on the data published on QueCargan. Confirm price, availability, and terms directly with the seller.
Ideal car has two artificial intelligence features. External artificial intelligence providers prepare them too, and they may process the data outside Costa Rica. They work only when you are signed in and the feature is enabled, and their text is labeled as automatic. The provider may receive a pseudonymous account identifier, never your email address or your name.
"Read my note" sends your note about your current car only when you tap the button, after personal data is automatically replaced; the provider returns suggestions, and none joins your answers until you tap it. QueCargan does not keep the note: it uses it only for those suggestions.
"Why these cars" explains your results: the provider receives your interview's places, at canton or destination level only, how often you travel, home charging, your priorities and your tastes, together with the top cars in your results and the catalog data that explains their order. It does not receive seller or contact data. QueCargan checks that text against each car's data and shows a standard text if it does not match. The checked text is kept for up to 30 days, not linked to your account, so it is not requested again for the same answers, and then it is deleted. If you accepted the Ideal car clause in the Terms, QueCargan keeps each "Why these cars" request sent to the provider, its reply, and the results in your account until you delete the account.
Chat sessions that stay idle for 90 days are deleted. A completed run is kept until you delete your account. Submissions, their history, and their files are also kept until you delete your account.
Follow-up conversations are kept until 90 days pass without activity, and then they are deleted. You can delete a follow-up conversation with "Delete the conversation": the conversation and its messages are deleted immediately. Only technical metrics for each message remain, without its text, so the daily message limit keeps working; they are deleted 90 days after they were created. Authorized QueCargan staff may read a follow-up conversation for safety or quality, and every read is recorded.
If you delete your account, the sessions, runs, submissions, their events and files, the follow-up conversations with their metrics, and the record of Ideal car's artificial intelligence features are deleted with it. The copies sent to the team's mailbox follow the rule above. Aggregate chat counts identify no account. Your answers and messages are not included in page addresses, analytics, or technical logs. The catalog link the chat offers carries only the catalog's own search filters.
QueCargan uses essential and optional service providers for the functions described in this policy: Supabase (authentication, database, and file storage), Google and Meta (social sign-in you choose), PostHog (browser analytics when configured and permitted), Resend (operational or subscription email when enabled), and artificial intelligence providers, which may process data outside Costa Rica. Depending on the specific flow and applicable law, a provider may act as a processor, an independent controller, or another legally recognized recipient; its role, terms, location, and retention rules are not identical across providers. Each disclosure is limited to data reasonably connected to the provider's function.
We may also disclose personal data: to a seller or service provider when you deliberately request contact through the Service; to advisers bound by professional confidentiality; and to a competent authority where reasonably required by law or a lawful order. QueCargan does not sell, rent, trade, or otherwise commercialize personal data.
Some providers may process or store data outside Costa Rica. QueCargan does not carry out international transfers for the commercialization or distribution of personal data; it limits the data shared with providers to what their function requires and relies on contractual and technical security measures with them. Where the applicable regime requires your express, informed consent for a specific cross-border flow, we will request it.
Provider locations, contractual roles, and the legal classification of particular international flows are kept under review; this policy deliberately does not claim that a single finalized classification covers every flow.
Account and private dashboard data are kept while the account is active. An account-deletion request has a seven-day cancellation period before final processing begins; after that period, QueCargan prepares the Community tombstone, removes authored Community text and account-owned attachment objects, and attempts to remove the authentication user and linked private data. Temporary failures retry automatically; if the retry budget is exhausted, support can recover the request. Chat sessions, runs, submissions, and follow-up conversations follow the rules in the "Chat and Ideal car" section.
Security logs, analytics records, delivery records, moderation evidence, deletion audit records, and rotating backups may remain for the limited period needed for security, reliability, dispute handling, legal obligations, or recovery, after which they are deleted or de-identified. We do not keep personal data in identifiable form once its purpose has ended, except where a legitimate or legal duty justifies it.
We apply technical and organizational measures appropriate to the risk, including encrypted transport, access controls, restricted administrative credentials, database row-level protections, private storage for account files, logging, and provider security controls. No online system is absolutely secure: protect your password and provider account, and report suspected misuse to hola@quecargan.com.
If a security irregularity affects your personal data, we will inform you within the five-business-day window set by the applicable Regulation and will begin a review of the nature of the incident, the data compromised, and the corrective measures applied.
You may exercise at any time the rights recognized by Ley N.° 8968 and its Regulation: access to the personal data we hold about you, rectification of inaccurate or incomplete data, updating, cancellation or suppression where applicable, revocation of your consent for future processing, and opposition. You may also ask what data we treat, for what purposes, and to whom it may be disclosed.
Send requests to hola@quecargan.com, preferably from your account email; we may verify your identity proportionately before acting. We handle each valid request within the period applicable to the right and will explain any lawful exception, complex verification, or justified constraint. For rectification requests, and for security-irregularity notifications where the applicable Regulation requires it, the applicable five-business-day period is the target.
You may also file a complaint (denuncia) with the Agencia de Protección de Datos de los Habitantes (PRODHAB) if you consider that your data-protection rights have been violated; the applicable rules generally require that you first raise the matter with us.
A signed-in user can request deletion from Dashboard Settings after a recent sign-in and confirmation with the word DELETE. The request produces a global sign-out and starts a seven-day cancellation window; after it, QueCargan removes private account data and replaces authored Community text with a deleted-thread tombstone while removing account-owned attachment objects. Do not consider deletion complete until its status or support confirms it; repeated processing failures can require support recovery. The full steps, limitations, and email fallback are on the Data Deletion page.
The Service is not directed to persons under eighteen (18), and we do not knowingly request or collect personal data from them. If you believe a minor has provided personal data, contact hola@quecargan.com so we can review and remove it as appropriate.
We may update this policy as the Service, providers, or legal requirements evolve. Material changes will be dated here and, when appropriate, communicated on the Service or by email. This policy states our current operating position in good faith; it is not a claim of external legal approval or perfect compliance. Questions and requests: hola@quecargan.com.