Privacy Policy

This Privacy Policy applies to the quecargan.com marketplace, accounts and dashboards, vehicle reviews, community and blog participation, communications, and related services (the "Service"), and to every person whose personal data we process.

QueCargan operates the Service from Costa Rica and is the responsible party (responsable del tratamiento) for the personal data in its databases. Contact for any privacy matter: hola@quecargan.com.

We process personal data under the constitutional protection of privacy and informational self-determination, Ley N.° 8968 for the Protection of the Person against the Processing of Personal Data and its Regulation (Decreto Ejecutivo N.° 37554-JP and its reforms), and other applicable laws. Where a visitor is subject to foreign data-protection law, we apply this policy in good faith and honor, to the extent reasonably possible, rights that such law grants in a manner not less protective than those described here.

Processing is limited to what each feature requires. Depending on what you use, we may treat:

An email address and authentication data are indispensable to create and secure an account; social sign-in additionally requires the provider identifier and the basic profile data the provider releases for the requested scopes. Without them we cannot create the account or provide signed-in features; public browsing remains available.

A display name, profile image, visibility preferences, marketing choices, vehicle details, and community contributions are optional unless a form clearly marks a field as required. Refusing optional data only limits the related feature or personalization.

We treat personal data on the basis of your informed consent and, as applicable, for the execution of the service you request, the legitimate management, security, and integrity of the Service, and compliance with legal obligations. Treatment is limited to the purposes informed in this policy (principle of purpose), and you may revoke consent at any time by the means described below, without affecting the lawfulness of processing carried out before revocation.

We use personal data only to:

QueCargan does not request, and its features do not require, sensitive personal data as defined by Ley N.° 8968 — for example, racial or ethnic origin, political or religious convictions, health data, sexual life, or biometric or genetic data. Please do not submit sensitive data in reviews, community posts, or free-text fields.

If we ever receive sensitive data inadvertently, we will treat it only as strictly necessary to suppress it and will not use it for any other purpose. Write to hola@quecargan.com to report it and request its immediate elimination.

QueCargan uses essential and optional service providers for the functions described in this policy: Supabase (authentication, database, and file storage), Google and Meta (social sign-in you choose), PostHog (browser analytics when configured and permitted), Resend (operational or subscription email when enabled), and OpenAI (limited AI-assisted analysis, summaries, or moderation when enabled). Depending on the specific flow and applicable law, a provider may act as a processor, an independent controller, or another legally recognized recipient; its role, terms, location, and retention rules are not identical across providers. Each disclosure is limited to data reasonably connected to the provider's function.

We may also disclose personal data: to a seller or service provider when you deliberately request contact through the Service; to advisers bound by professional confidentiality; and to a competent authority where reasonably required by law or a lawful order. QueCargan does not sell, rent, trade, or otherwise commercialize personal data.

Some providers may process or store data outside Costa Rica. QueCargan does not carry out international transfers for the commercialization or distribution of personal data; it limits the data shared with providers to what their function requires and relies on contractual and technical security measures with them. Where the applicable regime requires your express, informed consent for a specific cross-border flow, we will request it.

Provider locations, contractual roles, and the legal classification of particular international flows are kept under review; this policy deliberately does not claim that a single finalized classification covers every flow.

Account and private dashboard data are kept while the account is active. An account-deletion request has a seven-day cancellation period before final processing begins; after that period, QueCargan prepares the Community tombstone, removes authored Community text and account-owned attachment objects, and attempts to remove the authentication user and linked private data. Temporary failures retry automatically; if the retry budget is exhausted, support can recover the request.

Security logs, analytics records, delivery records, moderation evidence, deletion audit records, and rotating backups may remain for the limited period needed for security, reliability, dispute handling, legal obligations, or recovery, after which they are deleted or de-identified. We do not keep personal data in identifiable form once its purpose has ended, except where a legitimate or legal duty justifies it.

We apply technical and organizational measures appropriate to the risk, including encrypted transport, access controls, restricted administrative credentials, database row-level protections, private storage for account files, logging, and provider security controls. No online system is absolutely secure: protect your password and provider account, and report suspected misuse to hola@quecargan.com.

If a security irregularity affects your personal data, we will inform you within the five-business-day window set by the applicable Regulation and will begin a review of the nature of the incident, the data compromised, and the corrective measures applied.

You may exercise at any time the rights recognized by Ley N.° 8968 and its Regulation: access to the personal data we hold about you, rectification of inaccurate or incomplete data, updating, cancellation or suppression where applicable, revocation of your consent for future processing, and opposition. You may also ask what data we treat, for what purposes, and to whom it may be disclosed.

Send requests to hola@quecargan.com, preferably from your account email; we may verify your identity proportionately before acting. We handle each valid request within the period applicable to the right and will explain any lawful exception, complex verification, or justified constraint. For rectification requests, and for security-irregularity notifications where the applicable Regulation requires it, the applicable five-business-day period is the target.

You may also file a complaint (denuncia) with the Agencia de Protección de Datos de los Habitantes (PRODHAB) if you consider that your data-protection rights have been violated; the applicable rules generally require that you first raise the matter with us.

A signed-in user can request deletion from Dashboard Settings after a recent sign-in and confirmation with the word DELETE. The request produces a global sign-out and starts a seven-day cancellation window; after it, QueCargan removes private account data and replaces authored Community text with a deleted-thread tombstone while removing account-owned attachment objects. Do not consider deletion complete until its status or support confirms it; repeated processing failures can require support recovery. The full steps, limitations, and email fallback are on the Data Deletion page.

The Service is not directed to persons under eighteen (18), and we do not knowingly request or collect personal data from them. If you believe a minor has provided personal data, contact hola@quecargan.com so we can review and remove it as appropriate.

We may update this policy as the Service, providers, or legal requirements evolve. Material changes will be dated here and, when appropriate, communicated on the Service or by email. This policy states our current operating position in good faith; it is not a claim of external legal approval or perfect compliance. Questions and requests: hola@quecargan.com.