Privacy Policy
- Version:
- 1.3
- Effective date:
- 2026-08-01
Status: DRAFT -- pending founder approval Effective Date: 2026-08-01 (to be confirmed) Jurisdiction: Costa Rica Compliance: PRODHAB (Ley 8968 -- Protection of Persons regarding the Processing of their Personal Data) The Spanish version of this policy governs in case of any conflict.
1. Overview
IkiHomes ("we", "us", "the Platform") operates a real estate platform connecting buyers with real estate agents in Costa Rica. This Privacy Policy explains how we collect, use, store, and protect personal data in compliance with Costa Rica's data protection law (Ley 8968 and its regulation, administered by PRODHAB).
Data Controller: Inversiones Salgado Matamoros S.A. Registered Address: San José, Costa Rica (registered address to be confirmed) Privacy Contact: soporte@ikihomescr.com
Where registration is required under the applicable legal analysis, IkiHomes will register the corresponding databases with PRODHAB, as determined by Ley 8968 and its regulation. (Pre-launch action owned by the company.)
2. Legal Basis (Ley 8968)
Under Ley 8968, the informed consent of the data subject is the primary basis for processing their data. Consent must be express, free, unequivocal, informed, and individualized.
We process personal data with the informed consent of the data subject and, where applicable, to perform the contractual relationship, comply with legal obligations, protect platform security, and prevent abuse or fraud in accordance with our terms of use and applicable law.
Where the basis is consent, the data subject may withdraw it at any time without retroactive effect (see Section 7).
3. Data We Collect
3.1 Agent Data
| Data Type | Purpose | Retention |
|---|---|---|
| Name, email, phone | Account identification, communication | Account lifetime (until deletion) plus 30 days. Exceptions: see "Deleting your account" |
| WhatsApp notification channel (verified number, channel state, consent history) | Sending the notifications you authorized and proving you authorized them | While the channel is active, plus 24 months after it stops being used; erased with the account. A stop-messaging request is kept as an unreadable record (see "Deleting your account") |
| Notification delivery log (what was sent and whether it arrived; no message content, no number) | Showing which notifications were sent and resolving delivery disputes | 24 months; erased with the account |
| Profile information (bio, photo, license or associate number) | Public profile, trust signal | Account lifetime (until deletion) |
| Subscription and billing data | Billing, entitlement enforcement | 7 years (tax/legal) |
| Response times, activity logs | Trust badges, platform integrity | 24 months |
| IP address, device info | Security, fraud detection | 12 months |
| Promotional-image generation record (listing and photographs used, timestamp, digital fingerprints, terms version, and your sealed identity) | Being able to answer who generated an image that is still circulating off-platform, if someone asserts rights over a photograph appearing in it | 10 years from generation; survives account deletion (see Section 5) |
Agent verification: the "Verified by IkiHomes" badge is a manual decision made by the administrative team. We record the verification status, the date, the administrator who granted it, and an internal decision note. At this stage, IkiHomes does not collect or store copies of identity documents or agent verification documents. If we enable uploading such documents in the future, we will update this Policy before collecting them.
3.2 Buyer Data
| Data Type | Purpose | Retention |
|---|---|---|
| Name, email, phone | Lead creation, agent communication | 24 months |
| Property preferences (budget, location, type) | Buyer request matching | 24 months |
| Inquiry messages | Agent-buyer communication | 12 months |
| Visit scheduling data (proposed slots, visit thread) | Coordinating property visits | 12 months (see Section 14) |
| IP address | Rate limiting, spam prevention | 30 days |
3.3 Visitor Data (Anonymous)
| Data Type | Purpose | Retention |
|---|---|---|
| Page views, search queries | Analytics, search improvement | Aggregated only |
| Browser/device type | Compatibility, UX optimization | Session only |
We do not collect sensitive data (as defined by Ley 8968) or data from minors intentionally (see Section 10).
4. How We Use Data
4.1 Core Platform Functions
- Lead Management: Connect buyers with agents via inquiries, buyer requests, contact forms, and visit requests.
- Trust Badges: Compute and display response times, verification status, and activity indicators.
- Billing: Process subscriptions, enforce entitlements, issue receipts.
- Communication: Email notifications for inquiries, responses, and billing events.
4.2 Platform Integrity
- Fraud Prevention: Detect self-referral, fake signups, and abuse patterns.
- Quality Assurance: Monitor response rates and agent responsiveness.
- Security: Protect accounts from unauthorized access.
4.3 Buyer Request Visibility (Privacy by Design)
At IkiHomes, buyer request visibility is tiered to protect buyer privacy:
| Agent Tier | Buyer Data Visible |
|---|---|
| Free | Anonymized only: canton, budget range, property type, timestamp, response count |
| Pro | Full details: name, email, phone, detailed notes |
Anonymization definition: Anonymized data does not include names, email addresses, phone numbers, or free-text notes.
Rationale: Buyers did not consent to full details being visible to non-paying agents.
5. Data Retention
IkiHomes retains personal data according to the following periods:
| Data Type | Retention Period | Post-Expiry Action |
|---|---|---|
| Listings | On cancellation: demote at end of paid period; archive after 30 days | Hidden from search, read-only |
| Leads and inquiries | 24 months | Soft delete; metadata retained for audit |
| Messages | 12 months | Content deleted; timestamps and sender IDs retained for audit |
| Visit data | 12 months | Thread content deleted; metadata retained for audit |
| Suspended listings | 30 days in suspended state | Archived if unresolved |
| Billing records | 7 years | Required for tax/legal compliance |
| Promotional-image generation records | 10 years from generation | The sealed identity is permanently destroyed; the rest of the record can no longer be linked to a person |
Data Export
- Pro agents: Can export leads and listings as CSV.
- Free agents: Manual export available on request until automated export is built.
Portability / export: an operational right offered by IkiHomes when technically available, not a substitute for the legal rights of access, rectification, or erasure.
Records of the Promotional Images You Generate
If you generate a promotional image of one of your listings -- the IkiHomes-branded image you download to share -- we keep a record of that generation. We do this on every plan, and every time a new image is generated. Re-downloading an image you already generated does not create a new record.
We are telling you here, rather than when you ask us to delete your account, because the law requires us to erase data once it stops being necessary for the purpose it was collected for, and that purpose does not end while the image is still circulating.
Why we keep it. The image carries our brand and is downloaded for you to share wherever you want. Once it leaves the platform we cannot recall it or switch it off: it keeps circulating even after you delete the listing, change the photos, or close your account. If someone later asserts rights over a photograph appearing in that image, the claim comes to us, because ours is the brand on it. This record is the only thing that lets us answer who generated it, and from which photographs.
What it contains. Which listing and which photographs were used, with each file's address and a digital fingerprint of each photograph, copied at the moment of generation so the record still works even if you later delete those photos; the date and time; a digital fingerprint of the generated image; and the version of the terms in force at that moment. This record does not contain the generated image -- only its fingerprint -- nor the plan you were on.
Your identity is sealed. Your name, your account email, and your profile phone, as they stood at the moment of generation, are stored encrypted, with the key held in custody separate from the database. They cannot be read in the platform's ordinary operation and are not cross-referenced with any other data. They are opened only in the face of a specific claim or a request from a competent authority, with a written reason, and every opening is itself recorded.
How long it lasts. 10 years from generation. At the end of that period the sealed identity is permanently destroyed, and what remains -- listing references, fingerprints, and dates -- can no longer be linked to you. We can shorten that period; we cannot extend it.
This record survives the deletion of your account, because the image that produced it keeps circulating once your account is gone, and without the record there would be no way to answer for it.
Account Deletion
When you delete your account, we erase your personal data from our active systems.
Backup copies are deleted automatically within 30 days, and we never use them to restore a deleted account.
Three kinds of record survive the deletion of your account. These three, and no others:
- A request to stop messaging you. If you ever asked us to stop messaging you, we keep an unreadable record of that request, from which your number cannot be recovered. We keep it so we can continue to honour your decision if that number is reused or if you open a new account. Deleting it would be worse for your privacy, not better.
- Billing records. Tax and accounting law requires us to keep these for 7 years (see the table above). We cannot erase them sooner, even if you ask us to.
- Records of the promotional images you generated. Kept for 10 years, with your identity sealed. The section above explains why, and what they contain.
Nothing else survives. If we ever had to add something to this list, we would say so here before doing it.
Apart from that, your listing data may remain in anonymized form if needed for platform integrity, without your name or contact details.
The account deletion flow is described in Section 7 (Rights).
6. Data Sharing
6.1 Service Providers
We work with external providers that process personal data on our behalf, solely for the purposes set out below.
Some of these providers are located outside Costa Rica, mainly in the United States and the European Union. When you use IkiHomes, your data may be transferred to those countries for the purposes described.
| Provider type | Purpose | Data shared | Location |
|---|---|---|---|
| Infrastructure and hosting | Running the platform and storing files and images | All platform data, encrypted | Outside Costa Rica |
| Sign-in with external accounts | Letting you sign in with an account you already have | Name, email address and profile photo | Outside Costa Rica |
| Payment processing | Charging subscriptions and issuing receipts | Billing data and subscription status | Costa Rica |
| Property search | Displaying, sorting and filtering listings | Listing data, including the agent's public name and contact details | Outside Costa Rica |
| Email and WhatsApp message delivery | Sending you notifications and verifying your phone number | Name, email address, phone number in international format, and notification content | Outside Costa Rica |
| Usage analytics and error monitoring | Understanding how the platform is used and detecting faults | Account identifier, usage events and technical device data | European Union |
| Artificial intelligence | Analysing listing quality (optional, see Section 6.4) | Listing text and data derived from photos only. No images and no buyer information are sent | Outside Costa Rica |
If you would like details of the providers that process your data, you can request them by writing to soporte@ikihomescr.com.
6.2 Agent-to-Buyer Sharing
When a buyer submits a request or inquiry:
- Relevant agents receive buyer contact information as part of the lead.
- Agents may only use this data to respond to the specific inquiry.
- Agents must not share buyer data with third parties without consent.
6.3 No Sale of Data
We do not sell, rent, or trade personal data to third parties for marketing purposes.
6.4 AI-Based Listing-Quality Analysis (Optional)
To help the Agent improve their listings, IkiHomes offers an optional artificial-intelligence analysis that generates recommendations about listing quality.
- What is sent: only the listing text (the description and the property's technical sheet: type, price, features, zone-level location) and derived photo metadata (for example, the number of images). No images or photographs, and no buyer or lead data, are sent.
- Where it goes: to an artificial-intelligence service provider located outside Costa Rica (currently in the United States). This is an international transfer (see Section 11).
- Legal basis: the informed consent of the Agent, given when accepting this Privacy Policy, and, once formalized, appropriate contractual safeguards with the provider.
- Privacy reminder: when using the AI analysis, we display a brief reminder for the Agent to avoid including third parties' personal or contact data in the description.
- Optional and opt-out: the AI analysis is optional. If the Agent does not accept it, the analysis feature will be unavailable, but they can publish and use the Platform normally.
The AI provider may change over time; in any case, any provider will process only the listing text described above, with the same optional character and the same safeguards.
7. User Rights (Ley 8968)
Under Ley 8968, the data subject has the following informational self-determination rights:
| Right | Description | How to Exercise |
|---|---|---|
| Access | Request a copy of your personal data | Email soporte@ikihomescr.com |
| Rectification | Correct inaccurate or incomplete data | Update in the portal or email us |
| Erasure (deletion) | Request erasure of your personal data | Email us with identity verification |
| Consent to transfer (assignment) | Grant or deny consent for the assignment of your data to third parties | Manage in your preferences or email us |
Response Time: We respond to rights requests within the timeframe legally required by PRODHAB (five business days by default).
To exercise any of these rights, contact us at soporte@ikihomescr.com. A dedicated privacidad@ikihomescr.com mailbox may be enabled in the future; until then, soporte@ikihomescr.com is the active channel.
8. Security Measures
Technical Safeguards
- Encryption: TLS 1.3 for data in transit; AES-256 for data at rest.
- Access Control: Role-based access; MFA for admin accounts.
- Audit Logging: Immutable logs for security-relevant events.
- Password Security: Bcrypt hashing with salt; lockout after failed attempts.
Organizational Safeguards
- Access Limitation: Only authorized personnel access personal data.
- Incident Response: We take reasonable measures to detect and contain security incidents and, in the event of an incident affecting personal data, we will act in accordance with applicable legal requirements. We are developing an internal incident-management and notification procedure.
- Vendor Assessment: Third-party services reviewed for data protection compliance.
9. Cookies and Tracking
Essential Cookies
| Cookie | Purpose | Duration |
|---|---|---|
| Session token | Authentication | Session |
| CSRF token | Security | Session |
Optional Cookies (Consent Required)
| Cookie | Purpose | Duration |
|---|---|---|
| Analytics | Usage patterns | 12 months |
| Referral attribution | Track agent referrals | 7 days |
Cookie Preference: Users can manage preferences via the cookie banner. Essential cookies cannot be disabled.
10. Children's Privacy
IkiHomes is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If we learn that we have collected data from a minor, we will delete it promptly.
11. International Transfers
Some of our service providers process data outside Costa Rica (for example, infrastructure and hosting, search, transactional email, and, optionally, artificial-intelligence analysis). Depending on the provider, this includes locations in the United States and the European Union.
In particular, the optional AI listing-quality analysis described in Section 6.4 involves an international transfer of the listing text (no images, no buyer data) to an AI provider located outside Costa Rica. That transfer is made on the basis of the Agent's informed consent, given when accepting this Privacy Policy, and is optional (it can be declined).
We seek to protect these transfers through:
- The informed consent of the data subject, where that is the applicable basis.
- Entering into data-processing agreements and appropriate contractual safeguards with providers; where these are not yet formalized, doing so is a pending company commitment before enabling the corresponding processing.
- Encryption in transit and at rest.
We work to ensure that any international transfer of personal data complies with the applicable requirements of Ley 8968 and PRODHAB.
12. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via:
- Email notification to registered users.
- Banner notification in the platform.
- Updated "Effective Date" at the top of this document.
13. Contact and Complaints
Data Protection Contact
Controller: Inversiones Salgado Matamoros S.A. Email: soporte@ikihomescr.com Address: San José, Costa Rica (registered address to be confirmed)
Regulatory Authority
If you believe your data protection rights have been violated, you may file a complaint with:
PRODHAB (Agencia de Proteccion de Datos de los Habitantes) Website: https://www.prodhab.go.cr Email: info@prodhab.go.cr
14. Platform-Specific Privacy Rules
Lead Creation
At IkiHomes, leads are created only when the buyer takes an explicit contact action:
| Action | Creates Lead |
|---|---|
| Contact Agent form | Yes |
| WhatsApp click | Yes |
| Visit Request | Yes |
| Availability Question | Yes |
| View/scroll listing | No |
Privacy Implication: Passive browsing does not expose buyer identity to agents.
Visit Scheduling (Data Flow)
When a buyer proposes or schedules a property visit:
- Their name, email, and phone, plus the proposed time slots, are collected to coordinate the visit with the agent.
- This data is recorded in a contact thread and constitutes a lead per the rule above.
- Submission requires the buyer's explicit consent, recorded at thread creation (consent field; see the associated compliance work).
- A link to this Privacy Policy is shown at the point of submission.
- Visit data is retained for 12 months (see Section 5).
Referral Tracking
At IkiHomes, referral attribution uses:
- A 7-day cookie for attribution.
- No personally identifiable information in referral codes.
- Anti-gaming measures to prevent self-referral.
Note: Referral tracking is enabled only when the referral program is active. During periods when the referral system is disabled or under review, no referral cookies are set.
This document is part of the IkiHomes compliance framework. Official domain: ikihomescr.com -- Contact: soporte@ikihomescr.com