Entre Ceibas, Sociedad Anónima ("Entre Ceibas", "we", "us" or "our") operates the Nawal Trails platform (the "Service"). This Privacy Policy explains how we collect, use, share and protect your personal information when you use our Service.
1.Information we collect
1.1Account and authentication data
To create an account we ask for your email address and a password. Authentication is handled by our infrastructure provider (Supabase): your password is stored only in encrypted (hashed) form and we have no access to it in plain text.
If we enable sign-in with external providers in the future (for example, Google), we will receive from them the information you authorize them to share (name, email, profile photo) and we will update this policy before activating it.
1.2Profile data
When you complete your profile or the initial onboarding process, we may collect:
- Display name, bio and profile photo.
- Preferred language and reference node or area.
- Instagram handle and WhatsApp number, if you choose to provide them.
- How you intend to use the platform (participant, organizer, partner business or point-of-interest manager).
1.3Identification and age verification data
To take part in events and outings we need to verify your identity and age at check-in. For that reason we collect:
- Date of birth.
- Identity document: Guatemalan DPI (CUI) or passport number.
- Contact phone number.
- Where applicable, a verification document you upload to prove your identity or your organizer or business role.
This data is stored in a separate, protected table, apart from your public profile. It is not visible to other users.
1.4Emergency and health data
Because the Service organizes outdoor physical activities, during registration we ask you for:
- Name and phone number of an emergency contact (required).
- Relevant medical conditions and allergies (optional).
1.5Location data
Nawal Trails is an outdoor routes platform, so the Service may request access to your device's location in order to:
- Center the map on your position and show you nearby routes and points of interest.
- Place you within a map or route while you browse it.
Access to your location is optional and is requested through your browser or device permissions. You may grant or revoke it at any time from your browser settings. If you do not grant it, the map centers on a default location and the rest of the Service works normally.
Currently your location is processed only on your device to center the map; we do not store it on our servers nor keep a history of your positions. If we add activity tracking (route recording) in the future, we will state so clearly and it will require your express opt-in.
1.6Activity on the platform
We record information about your interaction with the Service, which may include:
- Events you register for, your attendance status and the corresponding history.
- Routes and points of interest you browse or save.
- General usage data within the application.
1.7Technical data
Automatically, our infrastructure providers may log technical data such as:
- IP address.
- Browser and device type.
- Country or region you access from.
- Access and error logs.
1.8Transaction and booking data
When you book or pay for an experience or event through the platform, we will collect the information needed to manage your booking: the activity details, the date, the amount and the associated contact and billing data. Payment data (card number, security code) will be processed directly by Recurrente, our payment provider; we will only receive the transaction identifier, its status and the data needed for invoicing.
1.9People registered without an account (prospects)
At in-person events, the organizing team may record in the system people who show up without having registered beforehand. In that case we collect name, email address and, optionally, phone number, for the sole purpose of keeping attendance records for the event and being able to contact you about it. This information is accessible only to administrative staff. If you are one of these people and want us to delete your data, write to us at soporte@entreceibas.com.
2.How we use your information
| Purpose | Data used |
|---|---|
| Create and manage your account and profile | Email, password, profile data |
| Verify your identity and age to take part in events | Date of birth, identity document |
| Manage your registrations and attendance control | Account, profile and registration data |
| Contact you before, during or after an activity | Email, phone, WhatsApp |
| Assist you in an emergency during an activity | Emergency contact, medical conditions, allergies |
| Show you nearby routes and points | Device location (if you authorize it) |
| Process bookings, payments and invoicing (once enabled) | Transaction and billing data |
| Keep the Service secure and prevent fraud or abuse | Technical and account data |
| Improve the platform | Aggregated usage data |
We do not sell your personal information to third parties nor use it for advertising purposes.
3.Emails
Currently we only send you transactional emails required for your account to work: registration confirmation, password reset and important notices about the Service. These emails cannot be turned off while you keep an active account, as they are part of the Service.
Once we enable event and route reminders, you will receive those emails only based on the registrations and subscriptions you activate yourself, and you will be able to cancel them from the platform at any time.
If you want to stop receiving all email from Nawal Trails, you may request the deletion of your account by writing to soporte@entreceibas.com.
4.Who we share your information with
4.1Service providers
| Provider | Purpose | Privacy policy |
|---|---|---|
| Supabase | Database, authentication, file storage and transactional email delivery | supabase.com/privacy |
| Vercel | Web application hosting and access logs | vercel.com/legal/privacy-policy |
| MapTiler | Base map provision (receives your IP address when maps load) | maptiler.com/privacy-policy |
| Recurrente | Payment processing (once enabled) | recurrente.com/privacidad |
These providers may only use your information to deliver the services we contracted, and are subject to their own privacy policies. Some of them process and store data outside Guatemala; by using the Service you accept this international transfer.
4.2Event organizers
When you register for an event, the person or organization running it can see, only for the people registered to their own events: your name, your contact details, your identity document, your date of birth and your emergency and health information. This is necessary for access control, verification of legal age and emergency response during the activity.
4.3Entre Ceibas administrative staff
Our administrative staff may access account and registration data in order to operate the platform and provide support.
4.4Other users
Publicly visible on the platform are: your display name, your profile photo, your bio and your reference node. Your identity document, date of birth, phone number, emergency contact and medical information are never visible to other users.
4.5Legal requirements
We may disclose your information when required by a competent authority or by an applicable legal obligation.
5.Data retention
We keep your information for as long as you maintain an active account. If you request the deletion of your account, we will delete or anonymize your personal data within a reasonable period, except for data we must retain by legal obligation (for example, accounting and tax records of transactions, kept for the period required by Guatemalan law).
Attendance records for events already held may be kept in dissociated form for statistical purposes.
6.Your rights
You have the right to:
- Access the personal data we hold about you.
- Rectify incorrect or outdated information. You can edit most of your data directly from your profile.
- Delete your account and the associated data.
- Withdraw your consent to the processing of your health data, by clearing those fields in your profile or by writing to us.
- Object to certain processing and request a copy of your data.
To exercise these rights, write to us at soporte@entreceibas.com. These requests are currently processed manually; we will respond within a reasonable period, aiming not to exceed 30 business days.
7.Security
We implement reasonable technical and organizational measures to protect your information, including: encryption in transit (HTTPS), encrypted password storage, row-level access control in the database, and separation of sensitive personal data into restricted-access tables.
No system for transmitting data over the Internet is completely secure, so we cannot guarantee absolute security.
8.Minors
The Service allows registration from the age of 13. Minors should only use the Service with the knowledge and supervision of a parent or legal guardian, and their participation in in-person activities requires the authorization of a responsible adult.
We do not knowingly collect data from people under 13. If you become aware that a child under 13 has provided personal data through the platform, contact us and we will delete it.
9.Cookies and similar technologies
We use cookies and local storage that are strictly necessary for the Service to work: keeping your session signed in and remembering your language preference. We do not use advertising or third-party tracking cookies. If this changes, we will give notice and enable a consent mechanism.
10.Changes to this policy
We may update this Policy from time to time. We will notify you of significant changes through a visible notice on the platform or by email. Continued use of the Service after the notice implies acceptance of the changes.
11.Contact
- Entre Ceibas, Sociedad Anónima
- 31 Av. "C" 7-53, Colonia Centro América, Zona 7, Guatemala City, Guatemala
- Email: soporte@entreceibas.com