Privacy Notice

To provide our services, we collect the following personal data from users who create an account on our platform:

Data marked with an asterisk (*) is considered sensitive personal data under the Law; its processing requires your express and written consent.

The collection and use of your personal data is necessary to provide our services:

In addition to the primary purposes described above, we may use your data for the following secondary purposes, provided you have not objected within the timeframe indicated below:

• Generation of statistics through analysis of user behavior on our platform, for purposes of internal improvement and service development.
• Communication of promotions, relevant updates, or marketing information about AvroHome services.

You have a five (5) calendar day period from the date of receipt of this Privacy Notice to object to your data being used for secondary purposes, using the procedure described in the ARCO Rights section below. Exercising this objection will not affect our ability to provide you with our core services.

We do not sell your personal data. We share it only as needed to operate our platform or as required by law:

• Hosts and guests: when a booking is confirmed, each party receives the other's name and contact information necessary to complete the stay.
• Didit (identity verification): guests' ID documents and biometric data are transmitted to Didit for identity verification. Didit acts as an independent data processor under its own privacy policy. AvroHome stores only the outcome of the verification (approved / declined), not the underlying documents or images.
• Stripe (payment processing): payment card details and host bank account information are processed by Stripe, Inc. under their privacy policy and PCI-DSS compliance. We receive only a token reference.
• Zodomus (channel management): when you connect Airbnb, your listing availability and reservation data are shared with Zodomus to synchronize your calendar. Zodomus acts as a data processor on our behalf.
• Infrastructure providers: Vercel (hosting) and Supabase (database) process data on servers in the United States under applicable data protection agreements.
• Legal authorities: we may disclose data when required by applicable law, court order, or legitimate request from a competent authority; when necessary to protect the public interest or enforce the law; or when necessary to establish, exercise, or defend legal claims.

Outside the circumstances listed above, AvroHome does not transfer your personal data to any third party.

The confidentiality and protection of your personal data is a priority for us. We maintain administrative, technical, and physical security measures to prevent damage, loss, alteration, destruction, unauthorized use, access, or disclosure of your personal data. These measures include encrypted data transmission (TLS), access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we encourage you to use a strong, unique password for your account.

• Account data: retained while your account is active and for 30 days after deletion to handle any pending disputes.
• KYC verification outcome (guests): retained for the minimum period required by applicable anti-money-laundering regulations — typically 5 years from the end of the relationship. The underlying documents and biometric images are held by Didit, not by AvroHome.
• Booking and payment records: retained for 7 years to satisfy tax and accounting obligations.
• Log and session data: retained for up to 12 months.

As the owner of your personal data, you have the right to:

• Access (Acceso): request a copy of the personal data we hold about you and learn how it is being processed.
• Correction (Rectificación): ask us to correct data that is inaccurate, outdated, or incomplete.
• Erasure (Cancelación): request deletion of your data where we have no legal obligation to retain it.
• Objection (Oposición): object to the processing of your data for specific purposes, including secondary purposes such as marketing.

These rights are known collectively as "ARCO Rights" under the Law.

To exercise any ARCO Right, please send a message to privacidad@avrohome.com including the following:

As the owner of your personal data, you may withdraw your consent to its processing at any time by following the same procedure described for ARCO Rights. Once your request is received, we will respond within a maximum of 5 (five) working days.

You may also request the deletion of your account and all associated data through the same procedure. In such a case: (i) we will not retain a copy of your personal data beyond the minimum legally required retention periods; (ii) third parties with whom data was previously shared in connection with confirmed bookings may retain it as required by their own legal obligations; (iii) AvroHome cannot control the deletion of data previously transmitted to third-party processors under their own retention policies.

AvroHome has designated a Personal Data Protection Officer responsible for processing and following up on user requests and promoting data protection within our organization. You may reach our Officer at privacidad@avrohome.com.

If you believe your rights have been violated, you may also file a complaint with the National Institute for Transparency, Access to Information and Personal Data Protection (INAI) at www.inai.org.mx.

You may limit the use or disclosure of your personal data by following the same procedure described for ARCO Rights. Once your request is received, we will respond within a timeframe not exceeding 5 (five) working days.

Additionally, to limit commercial communications, you may register with the Public Registry to Prevent Advertising (REPEP, Registro Público para Evitar Publicidad) managed by the Federal Consumer Protection Bureau (PROFECO).

All procedures described in this Privacy Notice are free of charge. Any costs related to the medium of response or information submission, if applicable, will be agreed upon in advance between you and AvroHome.

AvroHome uses cookies and similar technologies in its online services to collect data automatically and simultaneously, including source IP address, browser type, operating system, time of access, and user behavior on the platform. This information is used exclusively for session management, security, and platform improvement.

We use essential cookies to keep you logged in and maintain your session preferences. We do not use third-party advertising cookies. You may disable cookies at any time through your browser settings; however, disabling session cookies will prevent you from logging in to the platform.

For more information on managing cookies in your browser, see www.aboutcookies.org.

We may modify, update, or amend this Privacy Notice at any time. Changes may be necessary to reflect new legal requirements, changes in our privacy practices, or for other reasons. We will notify users of material changes through publication on our platform and, where possible, by e-mail, at least 15 days before the changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated notice.

To collect and process certain personal data — in particular, guests' government-issued photo ID and biometric selfie for identity verification through Didit — we require your express and written consent. This consent is obtained through the identity verification flow, where you will be presented with a clear disclosure and asked to confirm your agreement before proceeding.

By creating an account on AvroHome and providing your personal data, you expressly acknowledge and agree to the processing of your data as described in this Privacy Notice, in strict compliance with the Law, its Regulations, and other applicable legislation.

The transfer of any personal data or documentation through the AvroHome platform to hosts, guests, or third-party processors occurs only in accordance with this Privacy Notice and with your authorization where required.