Privacy Policy

Status: In force Effective Date: 2026-10-27 Jurisdiction: Costa Rica Compliance: PRODHAB (Ley 8968 -- Protection of Persons regarding the Processing of their Personal Data) The Spanish version of this policy governs in case of any conflict.

---

1. Overview

IkiHomes ("we", "us", "the Platform") operates a real estate platform connecting buyers with real estate agents in Costa Rica. This Privacy Policy explains how we collect, use, store, and protect personal data in compliance with Costa Rica's data protection law (Ley 8968 and its regulation, administered by PRODHAB).

Data Controller: IkiHomes Registered Address: La Unión, Cartago, Costa Rica Privacy Contact: soporte@ikihomescr.com

Where registration is required under the applicable legal analysis, IkiHomes will register the corresponding databases with PRODHAB, as determined by Ley 8968 and its regulation.

---

2. Legal Basis (Ley 8968)

Under Ley 8968, the informed consent of the data subject is the primary basis for processing their data. Consent must be express, free, unequivocal, informed, and individualized.

We process personal data with the informed consent of the data subject and, where applicable, to perform the contractual relationship, comply with legal obligations, protect platform security, and prevent abuse or fraud in accordance with our terms of use and applicable law.

Where the basis is consent, the data subject may withdraw it at any time without retroactive effect (see Section 7).

---

3. Data We Collect

3.1 Agent Data

Agent verification: the "Verified by IkiHomes" badge is a manual decision made by the administrative team. We record the verification status, the date, the administrator who granted it, and an internal decision note. At this stage, IkiHomes does not collect or store copies of identity documents or agent verification documents. If we enable uploading such documents in the future, we will update this Policy before collecting them.

3.2 Buyer Data

3.3 Visitor Data

This data does not include your name, email or phone. Even so, the advertising data is not anonymous to Meta: if you accept it and are signed in to Facebook or Instagram in the same browser, Meta can link it to your account (see Section 6.5).

3.4 Third-Party Data You Keep as an Agent

As an Agent, you can keep, on each listing you created, a private note and the contact details of the property's owner who engaged you to sell or rent it (their name, phone and email), and, in your Agenda, the details of the people you work with. These people are not IkiHomes users.

• Who sees them. Only you. They do not appear on the listing, in search, in shared links, in emails or in exports, and buyers and other agents do not see them. The IkiHomes team has no screen to view them and consults them only to handle a rights request from the person they belong to.
• What we do with them. Only store them on your behalf. We do not use them to contact anyone, we do not send them to artificial intelligence or to analytics tools, and we do not share them, except with the infrastructure and hosting provider in Section 6.1, which stores them encrypted outside Costa Rica (see Section 11). If you tap the WhatsApp button, your phone opens WhatsApp with that number.
• Whose responsibility they are. Yours. You obtained them from those people to manage your work with them and you use them only for that. IkiHomes stores them on your behalf and answers for storing them as this section describes, not for how you obtained them or how you use them.
• How long they last. Until you remove them, delete the listing, or your account is deleted; at that point they are permanently deleted. They do not carry over to a copy of the listing. Backups are deleted within at most 30 days.
• Those people's rights. Anyone who believes an Agent has stored their data on IkiHomes can write to soporte@ikihomescr.com to exercise the rights in Section 7. To verify the request, we ask for the phone number or email in question and confirm that it is theirs.

We do not collect sensitive data (as defined by Ley 8968) or data from minors intentionally (see Section 10).

---

4. How We Use Data

4.1 Core Platform Functions

• Lead Management: Connect buyers with agents via inquiries, buyer requests, contact forms, and visit requests.
• Trust Badges: Compute and display response times, verification status, and activity indicators.
• Billing: Process subscriptions, enforce entitlements, issue receipts.
• Communication: Email notifications for inquiries, responses, and billing events.

4.2 Platform Integrity

• Fraud Prevention: Detect self-referral, fake signups, and abuse patterns.
• Quality Assurance: Monitor response rates and agent responsiveness.
• Security: Protect accounts from unauthorized access.

4.3 Buyer Request Visibility (Privacy by Design)

At IkiHomes, buyer request visibility is tiered to protect buyer privacy:

Anonymization definition: Anonymized data does not include names, email addresses, phone numbers, or free-text notes.

Rationale: Buyers did not consent to full details being visible to non-paying agents.

---

5. Data Retention

IkiHomes retains personal data according to the following periods:

Data Export

• Pro agents: Can export leads and listings as CSV.
• Free agents: Manual export available on request until automated export is built.

Portability / export: an operational right offered by IkiHomes when technically available, not a substitute for the legal rights of access, rectification, or erasure.

Records of the Promotional Images You Generate

If you generate a promotional image of one of your listings -- the IkiHomes-branded image you download to share -- we keep a record of that generation. We do this on every plan, and every time a new image is generated. Re-downloading an image you already generated does not create a new record.

We are telling you here, rather than when you ask us to delete your account, because the law requires us to erase data once it stops being necessary for the purpose it was collected for, and that purpose does not end while the image is still circulating.

Why we keep it. The image carries our brand and is downloaded for you to share wherever you want. Once it leaves the platform we cannot recall it or switch it off: it keeps circulating even after you delete the listing, change the photos, or close your account. If someone later asserts rights over a photograph appearing in that image, the claim comes to us, because ours is the brand on it. This record is the only thing that lets us answer who generated it, and from which photographs.

What it contains. Which listing and which photographs were used, with each file's address and a digital fingerprint of each photograph, copied at the moment of generation so the record still works even if you later delete those photos; the date and time; a digital fingerprint of the generated image; and the version of the terms in force at that moment. This record does not contain the generated image -- only its fingerprint -- nor the plan you were on.

Your identity is sealed. Your name, your account email, and your profile phone, as they stood at the moment of generation, are stored encrypted, with the key held in custody separate from the database. They cannot be read in the platform's ordinary operation and are not cross-referenced with any other data. They are opened only in the face of a specific claim or a request from a competent authority, with a written reason, and every opening is itself recorded.

How long it lasts. 10 years from generation. At the end of that period the sealed identity is permanently destroyed, and what remains -- listing references, fingerprints, and dates -- can no longer be linked to you. We can shorten that period; we cannot extend it.

This record survives the deletion of your account, because the image that produced it keeps circulating once your account is gone, and without the record there would be no way to answer for it.

Account Deletion

When you delete your account, we erase your personal data from our active systems.

Backup copies are deleted automatically within 30 days, and we never use them to restore a deleted account.

Three kinds of record survive the deletion of your account. These three, and no others:

1. A request to stop messaging you. If you ever asked us to stop messaging you, we keep an unreadable record of that request, from which your number cannot be recovered. We keep it so we can continue to honour your decision if that number is reused or if you open a new account. Deleting it would be worse for your privacy, not better.
2. Billing records. Tax and accounting law requires us to keep these for 7 years (see the table above). We cannot erase them sooner, even if you ask us to.
3. Records of the promotional images you generated. Kept for 10 years, with your identity sealed. The section above explains why, and what they contain.

Nothing else survives. If we ever had to add something to this list, we would say so here before doing it.

Apart from that, your listing data may remain in anonymized form if needed for platform integrity, without your name or contact details.

The account deletion flow is described in Section 7 (Rights).

---

6. Data Sharing

6.1 Service Providers

We work with external providers that process personal data on our behalf, solely for the purposes set out below.

Some of these providers are located outside Costa Rica, mainly in the United States and the European Union. When you use IkiHomes, your data may be transferred to those countries for the purposes described.

Maps, fonts, the protection against automated sign-ups and videos load in your browser directly from their providers. The maps and video providers, besides providing the service to us, may use that data for their own purposes under their privacy policies.

If you would like details of the providers that process your data, you can request them by writing to soporte@ikihomescr.com.

Meta (Facebook and Instagram) is not in this table because it does not process the data solely on our behalf: it also uses it for its own purposes. It receives browsing data only if you accept advertising cookies, as Section 6.5 explains, and, if you are an agent on the Pro plan and connect your Instagram account, the content you decide to publish to it, as Section 6.6 explains.

6.2 Agent-to-Buyer Sharing

When a buyer submits a request or inquiry:

• Relevant agents receive buyer contact information as part of the lead.
• Agents may only use this data to respond to the specific inquiry.
• Agents must not share buyer data with third parties without consent.

6.3 No Sale of Data

We do not sell or rent personal data, and we do not trade it with third parties for marketing purposes. There are two cases in which Meta receives data, and both are up to you. If you accept advertising cookies, Meta receives the browsing data described in Section 6.5 and may also use it for its own advertising purposes; if you do not accept them, Meta receives nothing from our site. If you are an agent and publish a listing to your Instagram account, Meta receives what you decided to publish, as described in Section 6.6. We never upload lists of buyers, agents or property owners to Meta.

6.4 AI-Based Listing-Quality Analysis (Optional)

To help the Agent improve their listings, IkiHomes offers an optional artificial-intelligence analysis that generates recommendations about listing quality.

• What is sent: only the listing text (the description and the property's technical sheet: type, price, features, zone-level location) and derived photo metadata (for example, the number of images). No images or photographs, and no buyer or lead data, are sent.
• Where it goes: to an artificial-intelligence service provider located outside Costa Rica (currently in the United States). This is an international transfer (see Section 11).
• Legal basis: the informed consent of the Agent, given when accepting this Privacy Policy, and, once formalized, appropriate contractual safeguards with the provider.
• Privacy recommendation: we recommend that the Agent not include third parties' personal or contact data in the description.
• Optional and opt-out: the AI analysis is optional. If the Agent does not accept it, the analysis feature will be unavailable, but they can publish and use the Platform normally.

The AI provider may change over time; in any case, any provider will process only the listing text described above, with the same optional character and the same safeguards.

6.5 Advertising and Measurement with Meta (Facebook and Instagram), Only with Your Consent

We advertise the properties that agents publish on IkiHomes on Facebook and Instagram. To learn which ads work, show them to people who may be interested, and show properties again to people who have already visited the site, we use the Meta Pixel, a tool from Meta Platforms, Inc. that loads in your browser.

• Only if you accept it: the pixel does not load until you accept the "Advertising" category in the cookie banner (see Section 9). While you have not chosen, or if you reject it, it does not load, and you can use the site exactly the same way.
• Where it is used: only on public pages of the property search site: the home page, search while you have typed no text into it, public listings, the area pages, the agent directory and public agent profiles, and the legal pages.
• Where it is never used: in the agent portal; on private listings; on pages reached through a personal link or code, such as links an Agent shares, the private Modo Corredor sheet, the tracking page for your request or your visit, and password reset; on your account pages, such as your messages, visits, favorites, comparisons and notifications; or on a search that carries text you typed.
• What Meta receives from your browser: your IP address, technical browser and device data, the address of the public page you visit, the address of the page you came from, and the identifiers in Meta's cookies (see Section 9). It never receives the address of one of the excluded pages.
• What we report to it: that you visited a page; that you viewed a public listing, with that property's identifier; and that you contacted an agent about a property, with the property identifier and the type of contact (contact form, availability question, visit request or WhatsApp). A contact is reported only after our system has recorded it.
• What we never send it: your name, email, phone, the content of your messages, what you type into search, your IkiHomes account identifier, or the property's price. We do not use Meta's "advanced matching" feature, which exists to send that data.
• What Meta can do with this data: if you are signed in to Facebook or Instagram in the same browser, Meta can link this data to your account. Meta uses it to provide measurement and advertising services to us, and also for its own purposes, such as improving and personalizing the ads it shows you. For those purposes of its own, Meta is responsible for the processing, under its Privacy Policy: https://www.facebook.com/privacy/policy
• Agents do not receive this data: pixel data goes to Meta, not to the agent who published the property. An agent receives your data only when you contact them (see Section 6.2).
• International transfer: Meta Platforms, Inc. is located in the United States (see Section 11).
• Legal basis: your express consent, given in the cookie banner. You can withdraw it at any time, without retroactive effect (see Sections 7 and 9).

6.6 Publishing Listings to Your Instagram Account (Agents on the Pro Plan)

If you are on the Pro plan, you can publish one of your listings to your own Instagram account, as a post with several images, from the agent portal. To do so, you connect your Instagram account to IkiHomes on Instagram's own page, which asks you to approve the access. It works only with professional Instagram accounts (business or creator). On the Free plan you can see how your post would look, but not publish it.

• Purpose: publishing to your account, when you ask, the listing, photos and text you chose. We publish nothing unless you ask, we do not schedule posts, and we do not publish to any other account.
• What Meta receives: the photos you chose and, if you include it, the listing's promotional image, as images Meta fetches from a temporary address; the text of the post, including the contact details from your profile that appear in it (your name, your phone if your profile shows it, your email if your profile shows it, and your website); and your request to publish. The text never carries the property's exact address.
• What we receive from Meta: your Instagram account's identifier and username, the account type, and an authorization to publish on your behalf, which lasts a limited time; after publishing, the post's identifier and link.
• What we never send: data about buyers or leads, private listings, or anything that is not in the post you composed.
• How we protect the authorization: we store it encrypted, with the key kept outside the database. It is not shown on any screen, it is not sent anywhere else, and we use it only to publish what you ask.
• What Meta does with the post: once published, the post is in your Instagram account and you control it: you can edit or delete it there. Meta handles it under its own terms and its Privacy Policy: https://www.facebook.com/privacy/policy. If you later delete the listing on IkiHomes or the listing stops being published, the post stays on Instagram until you delete it.
• How long we keep it: the connection, while your account is connected; the records of your posts, while your IkiHomes account exists; the images prepared for Instagram, until the post finishes and at most one day (see Section 5).
• How to disconnect: from Mi Perfil, in the agent portal, or by removing IkiHomes' access in your Instagram account settings. In both cases we delete the connection. We also delete it if you ask Meta to delete the data IkiHomes received from your Instagram account; if we held no connection of yours, we confirm that there was nothing to delete. If you move to the Free plan, the connection stays: you cannot publish, and you can disconnect it whenever you want.
• International transfer: Meta Platforms, Inc. is in the United States (see Section 11).
• Legal basis: your consent, which you give when you connect your Instagram account and when you ask for each post. It is optional: if you do not use it, Meta receives nothing this way.

---

7. User Rights (Ley 8968)

Under Ley 8968, the data subject has the following informational self-determination rights:

Data sent to Meta: the data the Meta Pixel sends to Meta (see Section 6.5) does not stay in our systems, and we have no way of linking it to a person. We therefore cannot provide, correct or erase it on your behalf. Withdrawing consent stops further sending from that browser from the next page you open. To review or disconnect the activity Meta has already received, Meta offers the "Your activity off Meta technologies" option in its account settings. If you write to us, we will tell you how.

Response Time: We respond to rights requests within the timeframe legally required by PRODHAB (five business days by default).

To exercise any of these rights, contact us at soporte@ikihomescr.com. A dedicated privacidad@ikihomescr.com mailbox may be enabled in the future; until then, soporte@ikihomescr.com is the active channel.

---

8. Security Measures

Technical Safeguards

• Encryption: TLS 1.3 for data in transit; AES-256 for data at rest.
• Access Control: Role-based access; MFA for admin accounts.
• Audit Logging: Immutable logs for security-relevant events.
• Password Security: Bcrypt hashing with salt; lockout after failed attempts.

Organizational Safeguards

• Access Limitation: Only authorized personnel access personal data.
• Incident Response: We take reasonable measures to detect and contain security incidents and, in the event of an incident affecting personal data, we will act in accordance with applicable legal requirements. We are developing an internal incident-management and notification procedure.
• Vendor Assessment: Third-party services reviewed for data protection compliance.

---

9. Cookies and Tracking

Essential Cookies

They are IkiHomes' own and do not depend on the cookie banner.

Why the referral cookies are essential. They are set only when you arrive through an Agent's invitation or referral link (see Section 14). One holds a random code generated in your browser; the other only records that the code has been registered. Neither contains your name, email or phone, and we do not use them to measure your browsing. We store that random code together with the code of the Agent who invited you, and it is linked to you only if you create an account, which is when you accept this Policy.

Analytics Cookies (Consent Required on the Search Site)

• On the property search site, analytics starts only if you accept the "Analytics" category in the banner. Before that it stores nothing in your browser and sends no data. The data it collects is processed by our analytics provider in the European Union, and we never use it for advertising.
• While you have not accepted it, we delete any analytics cookies and data we find in your browser, including any left from before the banner existed.
• The agent portal has no banner: there, analytics cookies are used from the moment you open the portal.

Cookieless Measurement

Visit counting and loading-speed measurement on the search site (see Section 6.1) use no cookies and store no data that identifies you. They receive the page address without its private codes, the page you came from if it is on another site, your approximate location, and technical browser and device data. They run for everyone who visits the site and do not depend on your choice in the banner.

Meta Advertising Cookies (Consent Required)

Used only if you accept the "Advertising" category, and only on the public pages of the search site (see Section 6.5).

The durations of Meta's cookies are those Meta states in its Cookies Policy (https://www.facebook.com/privacy/policies/cookies/), and Meta may change them.

While you have not accepted advertising, we delete any _fbp and _fbc cookies we find on the IkiHomes domain, including any left from before the banner existed.

The Private Modo Corredor Sheet

On the private sheet an Agent shares in Modo Corredor (its address starts with /es/view/ or /en/view/), the banner is not shown and nothing optional runs, whatever you chose: analytics does not start and the Meta Pixel does not load. If you have not accepted a category, we also delete there whatever that category left in your browser; if you have accepted it, we leave it as it is. Cookieless measurement runs on that sheet as on the rest of the site. The sheet has no footer: you change your choice from any other page of the site.

How You Give, Change or Withdraw Consent

• The first time you visit the search site, a banner asks whether you accept optional cookies and tells you that Meta also uses that data for its own purposes. There are two categories, "Analytics" and "Advertising", and three buttons: "Accept" turns both on, "Reject" turns neither on, and "Customize" lets you choose each one separately. Nothing is turned on in advance, and "Reject" is shown with the same weight as "Accept".
• The banner has no close button: it stays in view until you choose, although you can keep using the site in the meantime. Until you choose, analytics and advertising stay off and the Meta Pixel does not load.
• We store your choice in a cookie of our own, iki_consent, on the IkiHomes domain: what you accepted and rejected in each category, the version of this Policy you saw, and the date of your choice. So that it lasts 12 months in every browser, the page also sends it to our server, which returns it to you as a cookie and does not store your choice.
• We ask you again 12 months after your choice. We also ask again if the stored date is more than one day ahead of your device's clock, because such a date cannot be trusted.
• If your browser blocks cookies, your choice holds only until you reload the page or open the site in another tab; after that we ask you again.
• You can change your choice at any time through the "Cookie preferences" link at the foot of the site's pages, which also shows the date of your last choice. The change also applies in any other tabs of the site you have open.
• If you withdraw analytics, we stop recording your use from that moment and delete its cookies and the data it had stored in your browser.
• If you withdraw advertising, the Meta Pixel stops loading from the next page you open and we delete the _fbp and _fbc cookies from your browser. The fr cookie belongs to Meta: you can delete it in your browser settings or manage it from your Meta account.
• Your choice applies to that browser and that device. If you use another one, or clear your cookies, we will ask you again.
• Withdrawing consent has no retroactive effect (see Section 2): it does not undo what has already been sent. Section 7 explains what you can do about the data Meta has already received.
• The agent portal does not show this banner and does not use advertising cookies.

Other Providers' Cookies

Apart from Meta's cookies, which depend on your consent, the Platform uses no advertising cookies and sets no third-party cookies to track you across sites. There is one case in which another provider sets its own: if you play an agent's introduction video, the video loads from the video provider, which uses its own cookies. When a map loads, the map provider stores a random identifier in your browser, which is not a cookie; Section 6.1 explains what data it receives.

Blocking or Deleting Cookies

You can block or delete cookies at any time in your browser settings. If you block essential cookies, you will not be able to stay signed in; if you block analytics or advertising cookies, the Platform keeps working normally.

---

10. Children's Privacy

IkiHomes is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If we learn that we have collected data from a minor, we will delete it promptly.

---

11. International Transfers

Some of our service providers process data outside Costa Rica (for example, infrastructure and hosting, search, maps, transactional email, and, optionally, artificial-intelligence analysis). Depending on the provider, this includes locations in the United States and the European Union.

If you accept advertising cookies, your browser sends the data described in Section 6.5 to Meta Platforms, Inc., in the United States. That transfer rests solely on your express consent, given in the cookie banner, and you can withdraw it at any time (see Section 9). If you do not give it, there is no transfer to Meta. Unlike the providers in Section 6.1, Meta also uses that data for its own purposes, under the terms it sets for businesses that use its tools and under its own privacy policy.

If you are an agent and publish a listing to your Instagram account, we send Meta Platforms, Inc., in the United States, what you decided to publish, and we receive your account data from Meta, as described in Section 6.6. That transfer is made at your express request, when you connect your account and when you ask for each post, and you can stop it at any time by disconnecting your account. As in the previous case, Meta handles the post under its own terms and its own privacy policy.

In particular, the optional AI listing-quality analysis described in Section 6.4 involves an international transfer of the listing text (no images, no buyer data) to an AI provider located outside Costa Rica. That transfer is made on the basis of the Agent's informed consent, given when accepting this Privacy Policy, and is optional (it can be declined).

We seek to protect these transfers through:

• The informed consent of the data subject, where that is the applicable basis.
• Entering into data-processing agreements and appropriate contractual safeguards with providers; where these are not yet formalized, doing so is a pending company commitment before enabling the corresponding processing.
• Encryption in transit and at rest.

We work to ensure that any international transfer of personal data complies with the applicable requirements of Ley 8968 and PRODHAB.

---

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via:

• Email notification to registered users.
• Banner notification in the platform.
• Updated "Effective Date" at the top of this document.

---

13. Contact and Complaints

Data Protection Contact

Controller: IkiHomes Email: soporte@ikihomescr.com Address: La Unión, Cartago, Costa Rica

Regulatory Authority

If you believe your data protection rights have been violated, you may file a complaint with:

PRODHAB (Agencia de Protección de Datos de los Habitantes) Website: https://www.prodhab.go.cr Email: info@prodhab.go.cr

---

14. Platform-Specific Privacy Rules

Lead Creation

At IkiHomes, leads are created only when the buyer takes an explicit contact action:

Privacy Implication: Passive browsing does not expose buyer identity to agents.

Visit Scheduling (Data Flow)

When a buyer proposes or schedules a property visit:

• Their name, email, and phone, plus the proposed time slots, are collected to coordinate the visit with the agent.
• This data is recorded in a contact thread and constitutes a lead per the rule above.
• Submission requires the buyer's explicit consent, recorded at thread creation.
• A link to this Privacy Policy is shown at the point of submission.
• Visit data is retained for 12 months (see Section 5).

Referral Tracking

At IkiHomes, referral attribution uses:

• Two essential 7-day cookies for attribution (see Section 9).
• No personally identifiable information in referral codes.
• Anti-gaming measures to prevent self-referral.

Note: referral cookies are set only when you arrive through an Agent's invitation or referral link.

---

This document is part of the IkiHomes compliance framework. Official domain: ikihomescr.com -- Contact: soporte@ikihomescr.com