Privacy Policy

Who we are

The site is operated by CORITO LABS, S.A.S. DE C.V., which is the data controller for everything described on this page. Questions and data requests go to info@surfcity.sv and are handled by a person, not a form.

Information you give us

You can read the directory without an account. These are the moments where you choose to hand something over, and each one collects only what the task needs.

• Account: your email address and name. If you sign in with Google, we receive the basic profile Google shares — name, email, profile photo. Accounts and sign-in sessions live in the neon_auth schema of our database, run as a managed service. We use them to know who you are when you return, and to tie a business listing to its owner.
• Claiming a listing: your name, your email, the business WhatsApp number, your role at the business, a free-text note describing how you are connected to it, the language you were reading in, and the account you were signed in with. We use it to review the claim and to reach you about it.
• Submitting an event: your name and your WhatsApp number, so we can confirm details or ask a question before the event is published.
• Newsletter: your email address and where on the site you signed up. When we send a newsletter it will carry an unsubscribe link; until then, write to info@surfcity.sv and we will remove you.
• Writing to us: whatever you put in the message. Mail to info@surfcity.sv is read by a person and kept as long as the conversation is useful.

Payments and billing records

There is no card form on this site and no payment gateway behind it. Paid listings are arranged out of band — bank transfer or WhatsApp — and an administrator records the period afterwards.

What we store for each paid period is the amount, the currency, how it was paid, an external reference such as a transfer number, an optional note, the dates the period covers, and the email address of the administrator who entered it. We never see or store card numbers, because they never pass through the site. These records are how we know a listing is paid up, and they are also accounting records we are required to keep.

Photos and listing content

Photos uploaded to a listing are stored in a private object-storage bucket at Neon. The bucket is not public: images reach a visitor's browser only through this site, at addresses beginning /photos/, never from the storage provider's own hostname. Nothing is served by guessing a storage URL.

Anything published on a listing — description, hours, photos, links — is public by design. That is the point of a directory. Do not put anything in a listing that you would not want a stranger reading on the beach.

Cookies and Google Analytics

This site uses Google Analytics 4, and Google Analytics sets cookies in your browser. We are not going to tell you the site is cookie-free, because that would not be true. We use it to understand which pages and which zones of the coast people actually read, in aggregate.

Listing pages can show an embedded Google Map, and some listings an embedded YouTube video. Both load from Google only when you open them, and when they do, Google may set its own cookies.

Signing in also requires a session, so the site knows you are still signed in as you move between pages. That one is strictly necessary for an account to work at all.

Your browser's own settings can block or clear cookies, and Google publishes an opt-out for Analytics. Blocking them does not stop the directory from working.

The analytics we show business owners

Owners of a claimed listing can see how their page is performing. We built that measurement to be cookieless by construction, and it is worth saying exactly how, because it is unusual.

No cookie is set for it. We do not store your IP address, and the value we do store cannot be turned back into an IP address by reading it. Values for different days, and for different listings, do not match one another, so the data does not add up to a browsing history. It is there to answer how many people looked at a listing today.

• A visit is counted under a one-way hash of your IP address, your browser's user-agent string, the listing being viewed, and a secret salt that changes every day. Because the salt changes, yesterday's value does not match today's — unique counts work within a day and are not carried across days.
• Alongside it, each event stores the type of event, a coarse device class (mobile, tablet or desktop), the language of the page and the coast zone. Nothing finer.
• If you arrived from another site, we record only the host you came from, for example a search engine's domain. Never the full address. A full referring URL can carry the exact words somebody typed into a search box, and we would rather not hold that.
• The raw event rows are deleted after 90 days. What survives is a daily total per listing, which is not about any individual.

Technical data from simply loading a page

Like any website, this one is served by a host, and serving a page means handling your IP address and the request your browser sends. Our host, Vercel, processes that as part of delivering the site and keeps short-lived operational logs used for security and debugging. We do not build profiles from them.

The sign-in, registration and event submission forms are protected by Cloudflare Turnstile, an anti-spam check that separates people from bots. It inspects signals from your browser for that one purpose.

The companies that process data for us

We are a small operation and we do not run our own servers. These are every company that touches your data on our behalf, and what for.

• Neon — our database, our managed authentication service, and the private bucket where listing photos are stored. Hosted in the United States, US East region.
• Vercel — hosting and delivery of the site itself.
• Resend — transactional email, sent from hello@surfcity.sv. Today that means messages about listing claims and about paid-plan renewals and expiry. When we send a newsletter it will go through Resend too. Replies and requests should go to info@surfcity.sv.
• Google — Google Analytics 4 for site measurement, and Sign in with Google for anyone who chooses that way of signing in. Also the embedded Google Map on listing pages and the embedded YouTube video on some listings, both loaded from Google only when you open them; they may set Google cookies.
• Cloudflare — the Turnstile anti-spam check on the sign-in, registration and event submission forms.

Where your data is stored

Our database, our accounts service and our photo storage all sit in the United States, in Neon's US East region. Our hosting, email and analytics providers are likewise operated from outside El Salvador. If you use this site from El Salvador, your data is processed abroad; we chose established providers and we hold them to the purposes described above.

How long we keep things

The rule is that we keep something for as long as it is doing a job, and no longer.

• Raw listing-analytics rows: deleted after 90 days. Only the aggregate daily totals per listing are kept beyond that.
• Newsletter subscription: until you ask us to remove you, or unsubscribe once newsletters go out.
• Account and sessions: for as long as the account exists. Write to info@surfcity.sv and we will close and delete it.
• Claim submissions: while the claim is under review, and afterwards as the record of who was given control of a listing.
• Payment records: kept as accounting records for as long as Salvadoran law requires.
• Event submissions: while the event is pending, and after it runs, as part of the calendar's history.

Your rights, and how to use them

You can ask for a copy of what we hold about you, ask us to correct something that is wrong, ask us to delete it, or withdraw your consent for the newsletter. Write to info@surfcity.sv from the email address concerned, tell us what you want, and a person will handle it.

There is no self-serve delete button on this site, and we are not going to pretend otherwise. It is a human process. We aim to answer within 30 days, and we may ask a question back if we need to be sure the request is really coming from you.

Closing an account does not erase accounting records for periods already paid, and it does not remove a business from the directory — a listing can exist with no owner attached, as most do.

Changes to this policy, and how to reach us

If what we collect changes, this page changes with it and the date at the top moves. We do not backdate it.

This policy is governed by the laws of El Salvador. For anything on this page — a question, a correction, a copy of your data, a deletion — write to info@surfcity.sv. CORITO LABS, S.A.S. DE C.V., El Salvador.