Privacy Policy

Who we are

The site is operated by CORITO LABS, S.A.S. DE C.V., which is the data controller for everything described on this page. Questions and data requests go to info@surfcity.sv and are handled by a person, not a form.

Information you give us

You can read the directory without an account. These are the moments where you choose to hand something over, and each one collects only what the task needs.

• Account: your email address and name. If you sign in with Google, we receive the basic profile Google shares: name, email and profile photo. Accounts and sign-in sessions are kept by a managed accounts service. We use them to know who you are when you return, and to tie a business page to its owner.
• Request to take over a business page: your name, your email, the business WhatsApp number, your role at the business, a free-text note describing how you are connected to it, the language you were reading in, and the account you were signed in with. We use it to review the request and to reach you about it.
• Submitting an event: your name and your WhatsApp number, so we can confirm details or ask a question before the event is published.
• Newsletter: your email address and where you joined: a newsletter form, or your SurfCity account. Creating an account adds you to the newsletter unless you untick the box on the sign-up form (an account made with Google joins it too, as the sign-up page says). Accounts that existed before 2026-10-11 were added as well. Every newsletter carries an unsubscribe link, and you can also write to info@surfcity.sv and we will remove you.
• Writing to us: whatever you put in the message. Mail to info@surfcity.sv is read by a person and kept as long as the conversation is useful.

Payments and billing records

There is no card form on this site and no payment gateway behind it. Paid plans are arranged out of band, by bank transfer or WhatsApp, and an administrator records the period afterwards.

What we store for each paid period is the amount, the currency, how it was paid, an external reference such as a transfer number, an optional note, the dates the period covers, and the email address of the administrator who entered it. We never see or store card numbers, because they never pass through the site. These records are how we know a business page is paid up, and they are also accounting records we are required to keep.

Photos and business page content

Photos uploaded to a business page are kept in private storage. They reach a visitor's browser only through this site, never from a public storage address.

Anything published on a business page (description, hours, photos, links) is public by design. That is the point of a directory. Do not put anything on your business page that you would not want a stranger reading on the beach.

Cookies and Google Analytics

This site uses Google Analytics 4, and Google Analytics sets cookies in your browser. We are not going to tell you the site is cookie-free, because that would not be true. We use it to understand which pages and which zones of the coast people actually read, in aggregate.

Business pages can show an embedded Google Map, and some an embedded YouTube video. Both load from Google only when you open them, and when they do, Google may set its own cookies.

Signing in also requires a session, so the site knows you are still signed in as you move between pages. That one is strictly necessary for an account to work at all.

Your browser's own settings can block or clear cookies, and Google publishes an opt-out for Analytics. Blocking them does not stop the directory from working.

The analytics we show business owners

Owners who have taken over their business page can see how it is performing. We built that measurement to be cookieless by construction, and it is worth saying exactly how, because it is unusual.

No cookie is set for it. We do not store your IP address, and the value we do store cannot be turned back into an IP address by reading it. Values for different days, and for different pages, do not match one another, so the data does not add up to a browsing history. It is there to answer how many people looked at a page today.

• A visit is counted under a one-way hash of your IP address, your browser's user-agent string, the page being viewed, and a secret salt that changes every day. Because the salt changes, yesterday's value does not match today's. Unique counts work within a day and are not carried across days.
• Alongside it, each event stores the type of event, a coarse device class (mobile, tablet or desktop), the language of the page and the coast zone. Nothing finer.
• If you arrived from another site, we record only the host you came from, for example a search engine's domain. Never the full address. A full referring URL can carry the exact words somebody typed into a search box, and we would rather not hold that.
• The raw event rows are deleted after 90 days. What survives is a daily total per page, which is not about any individual.

Technical data from simply loading a page

Like any website, this one is served by a host, and serving a page means handling your IP address and the request your browser sends. Our hosting provider processes that as part of delivering the site and keeps short-lived operational logs used for security and debugging. We do not build profiles from them.

The sign-in, registration and event submission forms are protected by an anti-spam check that separates people from bots. It inspects signals from your browser for that one purpose.

Who processes data for us

We are a small operation and we do not run our own servers. Established service providers do these jobs for us, and only these jobs. Write to info@surfcity.sv if you want to know who they are.

• Database, accounts and photo storage: a managed provider in the United States.
• Hosting: serving the site itself, with short-lived logs kept for security and debugging.
• Email: messages sent from hello@surfcity.sv about requests to take over a business page and paid-plan renewals, and the newsletter once it starts. Replies and requests go to info@surfcity.sv.
• Google: Google Analytics 4 for site measurement, and Sign in with Google for anyone who chooses that way of signing in. Also the embedded Google Map on business pages and the embedded YouTube video on some of them, both loaded from Google only when you open them; they may set Google cookies.
• Anti-spam: the bot check on the sign-in, registration and event submission forms.

Where your data is stored

Our database, our accounts service and our photo storage are all in the United States. Our hosting, email and analytics providers are likewise operated from outside El Salvador. If you use this site from El Salvador, your data is processed abroad; we chose established providers and we hold them to the purposes described above.

How long we keep things

The rule is that we keep something for as long as it is doing a job, and no longer.

• Raw page-analytics rows: deleted after 90 days. Only the aggregate daily totals per page are kept beyond that.
• Newsletter subscription: until you unsubscribe or ask us to remove you. After you unsubscribe we keep your address marked as unsubscribed, so we never add you again by mistake.
• Account and sessions: for as long as the account exists. Write to info@surfcity.sv and we will close and delete it.
• Requests to take over a business page: while the request is under review, and afterwards as the record of who was given control of a business page.
• Payment records: kept as accounting records for as long as Salvadoran law requires.
• Event submissions: while the event is pending, and after it runs, as part of the calendar's history.

Your rights, and how to use them

You can ask for a copy of what we hold about you, ask us to correct something that is wrong, ask us to delete it, or withdraw your consent for the newsletter. Write to info@surfcity.sv from the email address concerned, tell us what you want, and a person will handle it.

There is no self-serve delete button on this site, and we are not going to pretend otherwise. It is a human process. We aim to answer within 30 days, and we may ask a question back if we need to be sure the request is really coming from you.

Closing an account does not erase accounting records for periods already paid, and it does not remove a business from the directory. A business page can exist with no owner attached, as most do.

Changes to this policy, and how to reach us

If what we collect changes, this page changes with it and the date at the top moves. We do not backdate it.

This policy is governed by the laws of El Salvador. For anything on this page (a question, a correction, a copy of your data, a deletion), write to info@surfcity.sv. CORITO LABS, S.A.S. DE C.V., El Salvador.