Transparency & data protection

Last updated: August 8, 2026

We think trust is earned through transparency. This page explains, with no fine print, what data we process, how we protect it, who we share it with, and what control you have — in line with Panama's Personal Data Protection Law (Ley 81 of 2019, regulated by Executive Decree 285 of 2021 and overseen by ANTAI). For the full legal notice, see our Privacy Policy.

Our principles

We collect the minimum needed to run the marketplace.
We never sell or rent your personal data.
We use no third-party trackers and no tracking-based advertising.
We encrypt sensitive credentials and use HTTPS across the whole site.
You decide what's visible and what's personalized — and you can turn personalization off.

What data we process

Account: display name and email (we use one-time sign-in links — no passwords stored); optional phone.
Content: the listings you post and the messages you send in chat.
Activity (signed-in only, and only if you don't turn it off): what you view, search and save, to order your "For you" feed.
Leads: when you contact a seller or company, your name and contact become a "lead" for that seller.
Sessions: which devices you're signed in on, so you can review and revoke them.

How we protect it

Passwordless access: single-use links that expire in 15 minutes, plus Google sign-in (OAuth with PKCE).
Encryption at rest (AES-256-GCM) for the integration credentials you connect.
Enforced HTTPS (HSTS), a strict Content-Security-Policy, and security headers on every response.
Rate limiting against abuse and a tamper-evident audit log.
A seller's phone and email never appear in public HTML; they're revealed only to signed-in buyers.

Who we share it with

We don't sell your data. To operate, we rely on a small set of providers (data processors). Separately, when a company enables an integration, lead data flows to the tool that company chose — in that case the company acts as the controller for that data, and you deal with them directly.

Provider	What they do
Cloudflare	Hosting, database, file storage, CDN and security.
Resend	Transactional email delivery (sign-in links and notifications).
Google	Sign-in, only if you use "Continue with Google".
HubSpot · Zoho · Pipedrive	CRM — only when a company connects one; receives that company's leads.
Shopify · WooCommerce · Wasi	Product/property import — only when a company connects its store or inventory.

Your rights (Ley 81 of 2019)

You have the right to access, rectify, port and delete your data, and to object to processing — and we've made each one a click away:

Access & portability: download all your data from Settings → "Your data".
Rectification: edit your profile and preferences in Settings anytime.
Deletion: request account deletion from Settings.
Objection / limit personalization: turn off activity tracking and choose the chronological "Most recent" feed.
If you believe we haven't honored your rights, you can escalate to ANTAI (Panama's National Authority for Transparency and Access to Information).

Cookies

We use only a handful of functional cookies — session, language, feed preference and the privacy notice — to make the site work and remember your choices. None are used to track you or for advertising. More detail on our Cookies page.

How long we keep it

Sign-in links and expired sessions are deleted automatically.
Your account content is kept while your account exists; when you delete it, it's removed.
We only ask age (18+) as a dated confirmation — never your date of birth.

Security incidents

If a breach affecting your personal data were to occur, we'll move quickly to contain it and will notify affected people and ANTAI as required by Ley 81 and its regulation.

Contact

Questions or a data request? Write to privacidad@miraeso.app.