JOYNATIVO S.A.S., RUC 0691787377001, domiciliada en Riobamba, Ecuador.
Privacy contact: [email protected]
| Category | Data | Purpose |
|---|---|---|
| Identification | Name, email, password | Account creation |
| Contact | Phone (WhatsApp/Telegram) | Booking communication |
| Verification | ID document photo, selfie, liveness check result | Identity verification via third-party service (Didit) |
| Profile | Photos, bio, interests | Public profile |
| Transactional | Booking history, dates, payment references | Record keeping |
| Technical | IP address, cookies, browser | Security, analytics |
To verify the identity of hosts and travelers, Joy Nativo uses the third-party KYC service Didit (didit.me), operated by Didit Technologies, Inc., headquartered in San Francisco, USA.
During the verification process, Didit collects and processes on our behalf:
Didit acts as a data processor under a Data Processing Agreement with Joy Nativo. Didit is certified under SOC 2 Type II and ISO/IEC 27001, and is aligned with GDPR and eIDAS 2.0 standards.
Identity documents and biometric images submitted during verification are processed and stored by Didit, not on Joy Nativo's servers. Joy Nativo receives only the verification result (verified / not verified) and a reference ID.
Didit's Privacy Policy: https://didit.me/terms/privacy-policy/
We retain personal data only as long as necessary for the stated purpose:
| Data type | Retention period | Reason |
|---|---|---|
| Account data (name, email) | Until account deletion + 30 days | Data minimisation under LOPDP |
| Payment records (amounts, transaction references) | 7 years from transaction date | Ecuadorian Tax Code (Código Tributario) |
| Booking history (dates, host, guest) | 2 years from booking date | Disputes, fraud prevention |
| Verification result & reference ID | 2 years after last booking | Fraud prevention, legal disputes |
| Technical logs (IP, browser) | 3 months | Security monitoring |
| Marketing consent | Until consent is withdrawn | Consent-based processing |
| Identity documents & biometric data | Retained by Didit per their retention policy | Didit is the data processor |
| User reviews | Retained indefinitely, even after account deletion | Public record of platform activity |
After the applicable retention period, data is securely deleted or anonymised.
Joy Nativo shares data with the following processors, each bound by data processing agreements:
| Processor | Purpose | Role | Location |
|---|---|---|---|
| Didit (didit.me) | Identity verification (KYC) | Data processor | USA / EU infrastructure |
| Hetzner Online GmbH | Server infrastructure and data storage | Data processor | Germany (EU) |
| Brevo (Sendinblue SAS) | Sending platform emails: address verification, password reset, booking notifications | Data processor | France (EU) |
| Payphone | Payment processing (Ecuador) | Data processor | Ecuador |
| dLocalGo | Payment processing (Latin America) | Data processor | Uruguay |
| PayPal | Payment processing | Independent data controller | USA |
We do not sell your personal data to third parties.
Note on PayPal: When you pay via PayPal, you interact directly with PayPal Holdings, Inc. as an independent data controller. Please review PayPal's Privacy Policy at paypal.com.
Note on Payphone and dLocalGo: Your payment data is processed by these services as sub-processors of Joy Nativo under data processing agreements.
Some of your data is processed outside Ecuador:
Contact: [email protected]. Response time: 15 business days.
Joy Nativo is intended for users aged 18 and over. We do not knowingly collect personal data from minors. If we become aware that a minor has provided personal data, we will delete it promptly.
We use cookies and similar tracking technologies to improve your experience on our platform. For full details on what cookies we use, why, and how to manage them, please see our Cookie Policy.
We implement: password hashing (bcrypt), HTTPS site-wide, CSRF protection, SQL injection prevention.
Server infrastructure is hosted by Hetzner Online GmbH, certified under ISO 27001. Identity document verification is handled entirely by Didit's infrastructure, which is certified under SOC 2 Type II and ISO/IEC 27001.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email at least 14 days before the changes take effect. The updated policy will also be posted on this page with a revised "Last updated" date. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
You may lodge a complaint with Ecuador's Superintendencia de Protección de Datos Personales if you believe your rights have been violated.
This Privacy Policy is published in English, Spanish, and Russian. In the event of any discrepancy between language versions, the Spanish version shall prevail.