Privacy Notice

1. Data we collect

Identification and contact data (name, email and, if you provide it with your consent, phone/WhatsApp); your account and store data; transaction data (products, amounts, dates); and service usage and analytics data. We do not collect or store your full card data: that is handled by the payment processor.

2. Purposes of processing

We use your data to operate the platform and your account, enable payments, deliver purchased products, provide support, prevent fraud and abuse, comply with legal obligations, measure journeys proportionately, and improve the service. Yuroma limits its own email to identity, security, support, and operational messages. Seller-funded marketing or recovery uses the Seller's own connected account, requires a legal basis and unsubscribe controls, and cannot use Yuroma's sender. You may object at hola@yuroma.com without affecting contracted services.

3. Transfers and processors

We share only the data needed with providers that help us operate: Stripe, PayPal, or Mercado Pago (depending on the selected payment rail); Supabase (database and authentication); Cloudflare (security, hosting, and delivery); Resend (Yuroma's own email and, separately, accounts connected by each Seller); and optional delivery or measurement providers enabled with the applicable legal basis. Some providers may process data outside Mexico under their own terms and safeguards.

4. Cookies and similar technologies

We use cookies necessary for the session and to attribute invitation and campaign links (remembering which link originated a registration, visit, or sale). Yuroma does not load Meta, TikTok, or other third-party pixels by default. A third-party measurement integration may be enabled only when the feature is expressly active, passes all applicable technical and legal gates, and has a valid legal basis; where consent is required, it remains disabled until consent is obtained. The corresponding provider policies also apply. Before expanding to markets subject to the GDPR or equivalent rules, we will implement the required prior-consent controls.

5. Messaging channels

Yuroma does not share its sender or email quota with Seller campaigns. A Seller who enables secondary communications must connect their own sending account, authenticate their domain, honor consent and unsubscribe choices, and bear their costs. External links, communities, and Seller communications are also governed by their controller and channel policies.

6. Your ARCO rights

You have the right to Access, Rectify, Cancel or Object to the processing of your personal data, and to revoke your consent. To exercise these rights, write to us at hola@yuroma.com describing your request and a means to respond to you. We will handle your request within the time frames set by law.

7. Legal basis (visitors from the European Economic Area)

If you visit us from the European Economic Area or the United Kingdom, we process your data on these GDPR legal bases: PERFORMANCE OF A CONTRACT to create and maintain your account, process your purchases and deliver what you bought; COMPLIANCE WITH LEGAL OBLIGATIONS for invoicing, accounting and tax retention; our LEGITIMATE INTEREST to prevent fraud and abuse, keep the platform secure and measure its operation proportionally; and your CONSENT for anything else, which you may withdraw at any time without affecting processing already carried out or services you have contracted.

Where we share data with providers located outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses or on an adequacy decision, depending on the provider.

8. Your rights under the GDPR

Beyond the ARCO rights, if the GDPR applies to you, you have the rights of access, rectification, erasure, restriction of processing, portability of your data in a structured format, and objection to processing based on legitimate interest. You may also withdraw your consent at any time. Write to us at hola@yuroma.com and we will respond within the one-month period the GDPR sets.

You also have the right to lodge a complaint with the supervisory authority in your country without going through us. We would rather resolve it with you first, but that right is yours and does not depend on our permission.

9. Your rights if you live in California

The CCPA and CPRA give you the right to know which categories of personal data we collect and why, to request a copy, to ask for correction or deletion, and not to be treated differently for exercising them. You can exercise them by writing to hola@yuroma.com.

WE DO NOT SELL your personal data and we do not share it for cross-context behavioral advertising. We do not do so because the platform loads no third-party browser tracker at all: that capability is disabled in the code itself. If it were ever enabled, we would ask you first and this notice would be updated before that happens.

10. Data retention

We retain your data while your account is active and for as long as necessary to meet legal, tax and fraud-prevention obligations. Afterwards, we delete or anonymize it.

11. Security and confidentiality

We apply reasonable security measures (encryption in transit and of sensitive secrets, access control) to protect your data. No system is 100% foolproof, but we work to reduce the risks.

Each Seller's income, sales metrics and account data are confidential and are not disclosed to Buyers or third parties without their consent. Public link attribution is shown in aggregate or pseudonymized form when applicable.

12. Changes to this Notice

We may update this Notice. We will post the current version with its date; relevant changes will be communicated through available means.

13. Contact

For any privacy matter, write to us at hola@yuroma.com.