Privacy Notice

We handle account identifiers and profile details; content you submit, such as posts, reviews, listings, photos, and messages; business, rental, classified, booking, and inquiry details; newsletter email and consent records; payment and subscription status; identity-verification status and session references; and technical information such as IP address, device, request, security, and error logs.

Public posts, reviews, listings, profile names, and photos are visible to other people and may be copied or indexed outside our control. Do not publish confidential information.

We use this information to operate accounts and community features, publish and moderate content, connect users with local businesses and rental hosts, process subscriptions, prevent fraud and abuse, support users, diagnose reliability issues, and comply with law.

If you request community updates, we send a confirmation link and do not activate the subscription until you use it. We use the confirmed address only for the updates you requested and related service notices.

When you use an AI feature, the text and relevant context you submit may be sent to our configured AI provider to generate a response. Raw AI conversations are not retained for product learning unless you turn on the product-learning option. We still record pseudonymous service events such as whether a request succeeded, which sources were retrieved, and whether you marked an answer helpful. Do not submit sensitive personal information to an AI feature. AI responses can be incomplete or wrong and should not be treated as professional advice.

We use service providers including Amazon Web Services and Amazon Cognito for hosting and authentication, Stripe for billing, Didit for identity verification, OpenAI or xAI for configured AI features, Mapbox for maps, and transactional email providers. They process information under their own terms and our configuration. Stripe receives payment-card details directly; Playa Potrero does not store full card numbers.

For identity verification, identity documents and biometric processing are handled by Didit. Playa Potrero receives verification results and references needed to apply platform rules. Review the vendor notice and provide any required consent before starting verification.

We may disclose information when legally required, to protect users or the service, in a business transfer, or at your direction. We do not currently sell personal information or share it for cross-context behavioral advertising.

The service is hosted primarily in the United States, so information may be transferred outside Costa Rica or your country. Access is restricted to the people and systems that need it, and supported services use encryption in transit and provider-managed encryption at rest.

We generally keep account and user content while the account or listing is active. Unconfirmed newsletter links expire after 48 hours, and confirmed subscription records remain until you unsubscribe or ask us to delete them. Product-learning records that contain opt-in conversation text carry a 90-day expiration; pseudonymous service telemetry carries a 180-day expiration. A scheduled purge removes expired event records. Aggregated counts and pseudonymous replay records may be retained longer because they exclude raw conversation text. We may retain security logs, transaction records, moderation evidence, backups, and records needed for legal, fraud-prevention, dispute, or safety purposes after deletion. Identity-provider retention is controlled by our vendor configuration and applicable requirements.

The app uses browser session storage for sign-in tokens and browser storage for preferences, drafts, a random pseudonymous session identifier, and your optional product-learning choice. Session tokens are removed when the browser session ends or you sign out. Clearing browser data may sign you out, withdraw the locally stored learning choice, or remove local drafts.

Advertising code is disabled unless a valid publisher configuration is intentionally supplied. If analytics, advertising, or other optional tracking is enabled later, this notice and any required consent controls must be updated before activation.

You can edit many profile and listing fields in the service. You can withdraw product-learning consent at any time by turning the option off; this stops future raw conversation retention. You can withdraw newsletter consent through the unsubscribe control in a newsletter or by contacting us. You may ask to access, correct, or delete personal information, or object to or withdraw consent for processing that relies on consent. Some requests may be limited by identity verification, another person's rights, security needs, or legal retention duties.

Costa Rica's Law No. 8968 provides rights concerning personal data. You may also have rights under the law where you live. We may ask for information needed to verify that a requester is the account holder or authorized representative.

The service is not directed to children under 13, and we do not knowingly collect their personal information. Contact us if you believe a child has provided personal information. No Internet service is completely secure; report suspected account compromise promptly.

We may update this notice as the service changes. The current version and effective date will remain on this page, and we will provide additional notice when required by law.