Who we are
Expats Ecuador is operated by YapaTree, a small team based in Cuenca, Ecuador. The person responsible for data decisions on this site is Jason Scott, reachable at info@yapatree.com.
This policy explains what personal data we collect, why, how we use it, and what your rights are. It covers this website (expatsecuador.com) and the services behind it (contact forms, property inquiries, newsletter). It aims to comply with Ecuador's Ley Orgánica de Protección de Datos Personales (LOPDP), the EU's GDPR, and California's CCPA.
What we collect
We only collect what you give us, plus standard server logs:
- Contact form + property inquiry submissions. Name, email, optional phone number, the message you typed, and the property slug if you inquired from a listing.
- Newsletter signups. Your email address, and the date you signed up.
- WhatsApp + email messages. If you message our team on WhatsApp (+593 99 257 0693) or via email (info@yapatree.com), we store the conversation history in our internal CRM for continuity.
- Server logs. Firebase Hosting (our static host) and Cloudflare (our CDN/DNS provider) record your IP address, browser user-agent, requested URL, and HTTP status. Used for traffic analysis and abuse prevention. Typically retained 30 days.
We do not currently run advertising trackers (Meta Pixel, Google Ads), analytics scripts (Google Analytics), or any third-party behavioural profiling. If that changes, we'll update this policy and the Cookie Policy first.
Why we collect it (legal basis)
Under GDPR Article 6, our legal bases are:
- Consent, newsletter signups, cookie acceptance.
- Legitimate interests, responding to your contact form or property inquiry, running the site securely, understanding aggregate traffic patterns.
- Contract, if you become a YapaTree client, we need your data to deliver the service you've engaged us for.
Who we share it with
We don't sell your data. We share it with:
- Service providers we need to run the site. Firebase Hosting (Google Cloud), Google Cloud Storage (images), TwicPics (image CDN), Cloudflare (DNS/CDN), Hostinger (email hosting for info@yapatree.com).
- Our sister site, YapaTree. Property inquiries you submit are routed into YapaTree's CRM so the team can respond. YapaTree is operated by the same team and covered by this same policy.
- Referral partners, only when you explicitly ask. If you request a visa-law referral we may forward your contact details to Expat Law Group (Ecuador). If you request an insurance quote we may forward details to a partner broker (e.g. Blue Box Insurance). These referrals only happen on your explicit request and the partner is named at the moment of referral.
- Legal authorities, if required by an Ecuadorian court order or equivalent.
International transfers
Some of our data is stored outside Ecuador. Specifically, our website hosting (Firebase) and image CDN (Google Cloud Storage, TwicPics) run from US data centres. Under GDPR, these transfers are covered by the European Commission's adequacy decision for US providers with SCCs (Standard Contractual Clauses) or by the EU-US Data Privacy Framework.
Your rights
You can ask us, at any time, to:
- Show you what data we hold about you (right of access)
- Fix anything that's wrong (right to rectification)
- Delete your data (right to erasure, aka "right to be forgotten")
- Stop us processing it (right to object / restrict)
- Export your data (right to portability)
- Opt out of marketing, reply STOP to any WhatsApp message, or use the unsubscribe link in our emails
To exercise any of these, email info@yapatree.com with the subject "Privacy request." We'll respond within 30 days, usually much faster. No verification fees, no bureaucracy.
How long we keep it
- Contact + inquiry submissions: 3 years after the last interaction, then auto-deleted from the CRM.
- Newsletter list: until you unsubscribe, then removed.
- WhatsApp / email conversations: retained indefinitely as business records, unless you ask us to delete them.
- Server logs: 30 days (Firebase + Cloudflare default).
Security
We protect your data with HTTPS everywhere, Google-managed encryption at rest in Firebase/GCS, access control on our internal CRM (Google OAuth sign-in, staff only), and regular database backups. Our internal admin is behind a protected domain and uses session cookies that never leave the admin origin. No system is ever perfectly secure, but we treat this as a professional responsibility, not a checkbox.
Cookies
See our Cookie Policy for the details. Short version: we currently only use essential cookies (nothing for tracking). If we add analytics or advertising later, we'll update the Cookie Policy and ask for your consent first.
Children
Expats Ecuador is aimed at adults making relocation decisions. We don't knowingly collect data from anyone under 16. If you believe a minor has submitted personal data to us, email info@yapatree.com and we'll remove it.
Complaints
If you believe we've handled your data improperly, email us first, we want to fix it. If that doesn't resolve it, you have the right to lodge a complaint with:
- Ecuador: Superintendencia de Protección de Datos Personales (SPDP), the national LOPDP authority.
- EU: your local Data Protection Authority.
- California: the California Attorney General's office.
Changes to this policy
When we make material changes (new data uses, new partners, new retention periods) we'll update the "Last updated" date and, for anything significant, email current newsletter subscribers. Continuing to use the site after a change constitutes acceptance.