Privacy Policy

1. Who is responsible

The party responsible for this data is Spolfig LLC, a limited liability company formed in the state of Utah, United States, operating this site under the trade name Latino Mall Utah.

For anything in this policy, including requesting your data or its deletion, write to latinomall@comunidadcomercio.com.

2. What we collect

If you create an account

Your name or legal business name, your email address, your password, your country and your account type. Phone is optional. The password itself is not stored: we store an irreversible hash of it (bcrypt), so not even we can read it.

If you sign in with Google, Facebook or Apple

The identifier that provider hands us and the email associated with your account there. We do not receive your password for those services and we do not access your contacts, posts or files.

If you verify your phone

The number, a hash of the code we sent, how many attempts you made, and the timestamps. The code lives 10 minutes and dies after 5 failed attempts.

If you sign in with WhatsApp

Your account is created with your number and the name you give us; no email or password needed. The sign-in code works like the verification one: 10 minutes, 5 attempts. By requesting it you agree to receive that code and this platform's new-message notices over WhatsApp.

If you leave a review

The text, the rating and — worth knowing — your IP address and the browser you used. We keep them for one reason: detecting fake reviews, repeat votes and coordinated campaigns against a business. We do not use them for advertising, we do not sell them, and we do not show them to anyone, not even to the reviewed business.

If you list a business

The name, address, coordinates, phone, contact email, social accounts, opening hours and the photos you upload. All of that is public on purpose: it is your listing and anyone can see it, with or without an account. That is the point of a directory.

For every photo you upload we keep who uploaded it and when, so we can review it and take it down if needed. If we suspend an account, we keep when, who decided and why.

When you publish you sign a commitment. Of that we keep your drawn signature, the offer you stated, the version you accepted, the language, the date and the IP address you signed from. The signature is not public.

If you connect Instagram or Facebook

We store the access token for your page or account, encrypted, and use it only to publish what you write from your panel, when you ask us to. We don't read your messages or comments, we don't post anything on our own, and we don't share the token with anyone. When you disconnect the account we delete it, and tell Meta we no longer have access.

If you request a coupon

The code, the business, when you requested it, which channel you used to contact the business (WhatsApp or a call) and when, and whether the business redeemed it. The business sees your name, phone and email next to the coupon: that is how it knows who wrote and where they came from.

If you confirm a purchase

The photo you upload, your drawn signature, the amount you declare and the date. The photo and the signature are not public: only you, the business you bought from and we can see them. They are stored on our server, outside the site's public folder, and are served only through a route that checks who is asking.

If you write to a business, or a business writes to you

The messages, any files you attach, when they were sent, when each party read them, whether someone blocked the conversation, and any reports made about it. A conversation is seen by the two parties and nobody else, unless one of them reports it: then a person on our team reads it to decide what to do. Attachments are stored like a purchase photo: outside the public folder, served only through a route that checks who is asking.

What we do not collect

We use no analytics and no tracking pixels of any kind. There is no Google Analytics, no Meta pixel, no equivalent tool. We do not profile your behaviour and we make no automated decisions about you.

3. What each piece is used for

• Email: identifying you at sign-in, confirming the address is yours, and giving you a way back in if you forget your password.
• Phone: verifying you control that number and, if you publish it on your listing, letting a buyer reach you.
• Review IP and browser: anti-fraud, nothing else.
• Listing data: showing your business in the directory and in search results.
• Coupon: letting the business honour your discount and know you came from here, and counting how many sales the site produces.
• Purchase photo and signature: one thing only: proving the purchase happened, so we can give you what we promised for confirming it and bill the business what was agreed. They are used for nothing else and shown to no one else.
• Messages and attachments: letting buyer and business talk, and keeping a record of what was agreed. They are read from outside the conversation only if one party reports it, and only to resolve that report. When someone writes to you and you are away, we use your email — or your number, if you signed in with WhatsApp — to notify you, once per conversation until you read it.

We send no marketing email. The only automated messages that go out are the welcome email, the address confirmation, the password reset and your coupon notices.

4. Who it is shared with

We do not sell your data and we do not hand it to advertising brokers. It is shared only with the services that make the site work, and only the minimum each one needs:

We may also hand over data if a valid legal order requires it. If that happens and the law lets us tell you, we will.

5. How long we keep it

• Your account and your listings: as long as the account exists. Ask us to delete it and it is deleted.
• Email confirmation links: expire after 48 hours, single use.
• Password reset links: expire after 1 hour, single use.
• Phone codes: expire after 10 minutes.
• Reviews: as long as the reviewed business stays published.
• Coupons, purchase photos and signatures: as long as your account exists. Ask us to delete it and they go with it.
• Messages and attachments: as long as the conversation exists. There is another person on the other side and what was said is the record of a deal, so deleting your account does not delete the messages: your name and contact details are removed from them. A report and what was decided about it is kept as long as the law requires.

7. Cookies

We use one cookie: your session, which is what keeps you signed in. There are no advertising or tracking cookies. If we ever add analytics, this policy changes first, not after.

8. Minors

The site is for people 18 or older. We do not knowingly create accounts for minors. If we find one, we remove it. If you believe a minor has an account, write to us and we will look into it.

9. Where the data lives

The site and its database run on a server operated by OVH in the United States, and the services in the table above operate from there as well. By using the site you understand your data is processed in the United States.

10. Changes to this policy

If we change something important, we publish the new version here with its date and notify account holders. This document is version 1.3, dated September 25, 2026.