Privacy Policy
Last updated: July 15, 2026
1. Introduction
ESTORBOS.COM ("we", "our", or "the platform") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our website and services. This policy applies to all users of the site, regardless of geographic location, and complies with the applicable privacy laws of Puerto Rico, the United States (including the California Consumer Privacy Act, "CCPA/CPRA", and other state privacy laws), the European Union (General Data Protection Regulation, "GDPR"), the United Kingdom (UK GDPR), and any other applicable privacy legislation.
2. Data Controller
For the purposes of the GDPR and similar laws, the data controller of your personal data is: BORIKEN CIVIC TECHNOLOGY CORPORATION, a for-profit corporation incorporated in Puerto Rico (Registration No. 577987), operating as ESTORBOS.COM. Address: 1654 Calle Tulipan, Ste 100, San Juan, PR 00927. Email: contacto@estorbos.com. For any privacy-related inquiries or to exercise your rights, you may contact us directly at contacto@estorbos.com.
3. Information We Collect
We collect the following categories of information: (a) Report Information: Property address, description, photos, GPS location, and reported conditions; (b) Personal Contact Information: Name, email, phone (when you submit a report or subscribe to notifications); (c) Account Information: Your sign-in email (we do not use passwords: access is through a link or code sent to your email) and your notification preferences; (d) Technical and Device Information: IP address, browser type and version, operating system, device identifiers, access time, pages visited, referring URL; (e) Geolocation Data: Approximate geographic location based on IP address; (f) Cookies and Similar Technologies: Session cookies, persistent cookies, advertising cookies, and similar technologies, as detailed in section 5; (g) Analytics and Behavioral Data: Data collected by Google Analytics, Microsoft Clarity, PostHog, and other analytics tools, including clicks, cursor movements, scrolling patterns, pages visited, time on site, device used, and browsing patterns; (h) Advertising Data: When advertisements are displayed, data collected by Google AdSense and its partners for ad personalization and measurement; (i) Communication Data: Content of messages you send us through the site or by email; (j) Push Notification Data: If you enable push notifications, we store the push subscription for your device (endpoint identifier and encryption keys), your browser or device type, language, and activity timestamps, so we can deliver alerts and keep the subscription current. We also record, associated with your device, whether you tap (open) a notification we send, to measure how many people interact with each alert; these statistics are retained as part of our send history. You can disable notifications at any time from your account settings, your browser, or your device; (k) Device Identifier (Browser Fingerprint): For visitors who are not signed in, and only if you accept analytics cookies, we generate a device identifier derived from technical characteristics of your browser and hardware (a probabilistic "fingerprint" created with the ThumbmarkJS library), stored in your browser local storage (localStorage). This identifier lets our analytics tools recognize repeat visits from the same device, even if cookies are cleared. It stops being used once you sign in, and you can remove it by clearing your browser data; (l) Other Similar Technologies and Data: We may use other collection technologies, tools, or service providers substantially similar to those described in this policy to operate, protect, analyze, or improve the platform; when a change is significant, we will update this policy as described in section 18.
4. Legal Basis for Processing (GDPR/UK GDPR)
For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data under the following legal bases: (a) Consent, Art. 6(1)(a) GDPR: For non-essential cookies, personalized advertising, analytical tracking, and marketing communications. You may withdraw your consent at any time; (b) Performance of a contract, Art. 6(1)(b) GDPR: To process reports you submit and manage your account; (c) Legitimate interest, Art. 6(1)(f) GDPR: To improve our service, ensure platform security, prevent fraud, and perform aggregate statistical analysis. Our legitimate interests do not override your fundamental rights and freedoms; (d) Legal obligation, Art. 6(1)(c) GDPR: When we are required by law to process or retain data.
5. Cookies and Tracking Technologies
We use the following types of cookies and similar technologies: (a) Strictly Necessary Cookies: Essential for site operation, such as session authentication and language preferences. These do not require consent; (b) Analytics Cookies: Google Analytics, Microsoft Clarity, and PostHog use cookies to collect statistical data about site usage. Google Analytics uses cookies such as "_ga" and "_gid" to distinguish users. Microsoft Clarity uses cookies to record sessions. PostHog uses cookies for product analytics and user behavior analysis; (c) Advertising Cookies: When advertisements are displayed, Google AdSense and its advertising partners use cookies to show relevant ads based on your browsing history; these cookies may track your activity across multiple websites; (d) Measurement Pixels: We do not currently use social media or other advertising platform pixels (such as Meta or Google Ads); if we incorporate them in the future, we will update this policy; (e) Local Storage (localStorage): We store site preferences in your browser local storage (such as your cookie consent choice and notices you dismiss) and, if you accept analytics cookies, the device identifier described in section 3(k). You can manage your cookie preferences through your browser settings or, when available, through the site's cookie consent banner. For users in the EEA/UK, non-essential cookies are only activated after you provide your consent. If you decline optional cookies, Google may still receive limited cookieless signals (aggregate pings and URL parameters such as "_gl") under Google Consent Mode; these signals are not stored on your device and are used solely for aggregate measurement.
6. Advertising and Google AdSense
This site may display advertisements through Google AdSense. Google AdSense is an advertising service provided by Google LLC (for users outside the EEA/UK) or Google Ireland Limited (for users in the EEA/UK). Advertising revenue helps us keep the platform accessible and free for citizens. Specifically: (a) Google and its advertising partners use cookies to display ads based on a user's prior visits to this site or other websites; (b) Google's use of advertising cookies enables Google and its partners to serve ads to users based on their visit to this site and/or other sites on the internet; (c) Third-party advertising vendors may also use cookies to serve ads on this site; (d) The presence of an advertisement on the site does not constitute an endorsement or recommendation by us. To control personalized advertising: you may visit Google Ads Settings at https://adssettings.google.com; you may opt out of third-party vendors' use of cookies for personalized advertising by visiting https://www.aboutads.info/choices/ or https://optout.networkadvertising.org/; you may consult Google's privacy policy at https://policies.google.com/privacy.
7. Third-Party Analytics Tools
In addition to Google AdSense, we use the following tools: (a) Google Analytics: Collects site usage data and generates statistics. Data is processed by Google LLC / Google Ireland Limited under their own privacy policy. For users in the EEA/UK, data may be transferred to the United States under the European Commission's Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework; (b) Microsoft Clarity: Records user sessions (including cursor movements, clicks, and scrolling) for user experience analysis. Data is processed by Microsoft Corporation; (c) PostHog: Product analytics tool that collects data about how users interact with the site, including pages visited, clicks, and navigation flows. PostHog only activates after user consent. Data is processed by PostHog, Inc. under its privacy policy available at https://posthog.com/privacy; (d) Measurement Pixels: We do not currently use external advertising platform pixels; any future incorporation will be reflected in this policy; (e) Vercel: Our platform is hosted on Vercel Inc., which processes technical data (such as IP addresses and request logs) to operate the site and stores report photos. We also use Vercel Analytics and Vercel Speed Insights, which collect visit and performance metrics in aggregate form and without cookies; (f) Supabase: We use Supabase, Inc. as our database and authentication provider; your account data (email, profile, preferences, and notification subscriptions) and reports are stored on its infrastructure; (g) Account Linking in Analytics: If you have an account and are signed in, we associate your account identifier, email, and name with your profile in our analytics tools (PostHog and Microsoft Clarity) to link your sessions to your account and better understand platform usage; this association is not shared with advertisers; (h) Other Providers: We may use other substantially similar providers and tools to operate, analyze, or improve the platform. By using this site, and where legally required, by providing your consent, you agree to the use of these tracking technologies.
8. How We Use Your Information
We use your information to: (a) Process and publish reports of public nuisances; (b) Communicate with you about your report or account; (c) Share information with relevant municipalities when you consent; (d) Enrich reports with public cadastral data from CRIM; (e) Improve our service and functionality through usage and behavior analysis; (f) Comply with legal obligations; (g) Generate aggregate statistics and analysis; (h) Optimize user experience and site performance; (i) Display relevant advertisements through Google AdSense and other advertising partners; (j) Send email and push notifications about newly declared estorbos, legislative changes, and platform updates (when you subscribe or enable them); (k) Prevent fraud, abuse, and unauthorized access; (l) Protect our legal rights and those of other users.
9. Information Disclosure
We may share your information in the following circumstances: (a) With municipalities and government authorities when you give explicit consent by submitting a report; (b) When required by law, court order, subpoena, or legal process; (c) To protect our legal rights, the safety of others, or investigate fraud; (d) With analytics service providers (Google, Microsoft, PostHog) who process data under their own privacy policies; (e) With advertising platforms (Google AdSense and its partners), when advertisements are displayed, for their personalization and measurement; (f) With technical providers who help us operate the platform (under data processing agreements). We do not directly share your name, email, or phone number with advertisers. The advertising and analytics services integrated into the site may collect technical and browsing data through cookies and similar technologies, as described in sections 5, 6, and 7 of this policy. Aggregated and anonymous data that does not identify any individual may be shared for statistical and service improvement purposes. In the event of a merger, acquisition, reorganization, or sale of corporate assets, your personal data may be transferred as part of that transaction, subject to this policy and applicable laws; we will notify you of any change of data controller.
10. International Data Transfers
Your personal data may be transferred to and processed in countries outside your country of residence, including the United States, where our servers and those of our service providers (Google, Microsoft, PostHog, Vercel, Supabase) are located. For users in the EEA, United Kingdom, and Switzerland: these transfers are conducted under appropriate legal mechanisms, including: (a) European Commission adequacy decisions when available (such as the EU-U.S. Data Privacy Framework); (b) Standard Contractual Clauses approved by the European Commission; (c) Other appropriate safeguards as required by Article 46 of the GDPR. Our third-party service providers (Google, Microsoft, PostHog, Vercel, Supabase) maintain their own data transfer mechanisms. By using this site, you acknowledge that your data may be processed in the United States and other countries that may have different data protection laws than your country.
11. Public Information
IMPORTANT: Public nuisance reports (including property addresses, photos, descriptions, and conditions) are published on our website as information of public interest and may be indexed by search engines. This information will remain public indefinitely. Your personal name and contact details are NOT made public unless you explicitly choose to disclose them. By submitting a report, you acknowledge and accept that information about the reported property will be publicly accessible. The legal basis for this publication is legitimate interest in civic transparency and compliance with the Puerto Rico Municipal Code.
12. Data Retention
We retain your personal information for the following periods: (a) Account and contact data: While you maintain an active account or as necessary to provide the service, plus a 30-day retention period after account deletion; (b) Public reports: Indefinitely as a historical record of public interest; (c) Analytics data: According to each provider's retention policies; (d) Advertising cookies: According to Google's retention policy (generally up to 2 years); (e) Technical and security logs: Up to 12 months; (f) Email communications: As long as necessary for the purpose of the communication plus any legal retention period; (g) Push notification subscriptions and data: Until you disable them, delete your account, or your browser push service reports the subscription as inactive; send and interaction statistics are retained as part of the platform history; (h) Device identifier (localStorage): Until you clear your browser data. When it is no longer necessary to retain your data, we will securely delete or anonymize it.
13. Your Privacy Rights
Depending on your location, you may have the following rights over your personal data:
13.1. Rights for All Users
(a) Access your personal contact information; (b) Correct inaccurate personal data; (c) Request deletion of your contact data (NOTE: Public property reports cannot be deleted as they constitute records of public interest, but your personal contact data can); (d) Withdraw consent for future communications; (e) Unsubscribe from email notifications at any time using the link at the bottom of each email; (f) Disable cookies and tracking by adjusting your browser settings.
13.2. Additional Rights for California Residents (CCPA/CPRA)
If you are a California resident, you have the following additional rights under the CCPA/CPRA: (a) Right to Know: You may request that we inform you of what categories and specific personal data we have collected, the sources of collection, the purpose of collection, and the categories of third parties with whom we share data; (b) Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions; (c) Right to Opt-Out of Sale/Sharing: You may opt out of the "sale" or "sharing" of your personal information as defined by the CCPA. While we do not directly sell personally identifiable information, the use of advertising cookies by third parties such as Google AdSense may constitute "sharing" under the CCPA. You may exercise this right through the site's cookie settings, Global Privacy Control (GPC) signals in your browser, or by contacting us directly; (d) Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights; (e) Right to Correct: You may request correction of inaccurate personal information; (f) Right to Limit Use of Sensitive Personal Information: You may limit the use and disclosure of sensitive personal information. Categories of personal information collected in the last 12 months: identifiers (name, email, phone, IP address), internet activity information (browsing history on the site, interactions), geolocation data (approximate location by IP), and inferred data (preferences based on activity). Categories of third parties with whom we share data: analytics providers (Google, Microsoft), advertising platforms (Google AdSense), and municipalities (when you consent). We honor Global Privacy Control (GPC) signals as valid opt-out requests. To exercise any of these rights, contact us at contacto@estorbos.com. We will verify your identity before processing your request and respond within the 45 days required by law.
13.3. Additional Rights for Residents of Other U.S. States
If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Jersey, New Hampshire, Kentucky, Nebraska, Maryland, Minnesota, Rhode Island, Indiana, Tennessee, or another state with applicable privacy laws, you may have rights similar to those described in section 13.2, including rights to access, correct, delete, data portability, and opt out of targeted advertising and data sales. To exercise these rights, contact us at contacto@estorbos.com. If your request is denied, you may appeal by contacting us with the subject line "Privacy Appeal" and we will respond within the timeframe required by applicable law.
13.4. Additional Rights for Users in the EEA, United Kingdom, and Switzerland (GDPR/UK GDPR)
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following additional rights: (a) Right of Access (Art. 15 GDPR): Request a copy of the personal data we hold about you; (b) Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete data; (c) Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Request deletion of your personal data when it is no longer necessary, subject to public interest exceptions; (d) Right to Restriction of Processing (Art. 18 GDPR): Request restriction of processing of your data in certain circumstances; (e) Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, commonly used, and machine-readable format; (f) Right to Object (Art. 21 GDPR): Object to processing of your data based on legitimate interests or for direct marketing purposes; (g) Right Not to Be Subject to Automated Decision-Making (Art. 22 GDPR): Not be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you; (h) Right to Withdraw Consent: Withdraw your consent at any time without affecting the lawfulness of prior processing based on consent; (i) Right to Lodge a Complaint: Lodge a complaint with your local data protection authority. For users in the EEA, you can find your supervisory authority at https://edpb.europa.eu/about-edpb/about-edpb/members_en. For users in the UK, you may contact the Information Commissioner's Office (ICO) at https://ico.org.uk. We will process your requests within 30 days, with the possibility of a 60-day extension for complex requests, upon prior notification.
14. "Do Not Track" Signals and Global Privacy Control
We honor Global Privacy Control (GPC) signals transmitted by your browser. When we detect a GPC signal, we treat it as a valid opt-out request for the sale and sharing of personal information as required by applicable laws. Regarding "Do Not Track" (DNT) signals, there is currently no uniform industry standard for their implementation, so our site may not respond to DNT signals in the same manner. However, you can always control your tracking preferences through your browser's cookie settings, the site's consent controls (when available), and the opt-out tools described in this policy.
15. Security
We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction, including: data encryption in transit (HTTPS/TLS), access controls, and security monitoring. However, no internet transmission or electronic storage method is 100% secure, and we cannot guarantee absolute security. Third-party analytics and advertising providers implement their own security measures according to their policies. In the event of a data breach affecting your personal data, we will notify you as required by applicable laws.
16. Third-Party Links and Advertisements
Our site may contain links to third-party websites, including links in advertisements served by Google AdSense. We are not responsible for the privacy practices of these sites. We recommend reviewing their privacy policies before providing personal information. Third-party analytics and advertising tools (Google Analytics, Google AdSense, Microsoft Clarity, PostHog) operate under their own privacy policies and terms of service.
17. Children's Privacy
This service is not directed to individuals under 13 years of age (or 16 years in jurisdictions where the GDPR so requires). We do not intentionally collect information from minors. If we discover we have collected information from a minor without required parental consent, we will delete it immediately. If you are a parent or guardian and believe your child has provided personal information through this site, contact us at contacto@estorbos.com.
18. Changes to this Policy
We may update this Privacy Policy periodically to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. We will notify you of significant changes by posting the new policy on this page with a revised update date and, when possible, by email notification to registered users. Your continued use of the service after changes constitutes your acceptance. We recommend reviewing this policy periodically.
19. Applicable Law
This policy is governed by the privacy laws of Puerto Rico and applicable federal laws of the United States. For users in the EEA, United Kingdom, and Switzerland, this policy also complies with the GDPR and UK GDPR respectively. For users in California, this policy complies with the CCPA/CPRA. In the event of conflict between the provisions of this policy and the applicable privacy laws in your jurisdiction, the provisions of the applicable laws shall prevail.
20. Contact
For questions, rights exercise requests, or concerns about this Privacy Policy, the advertisements displayed on the site, or the handling of your personal data, contact us at: contacto@estorbos.com. We will make our best effort to respond to all requests within 30 days (or within the timeframe required by applicable law in your jurisdiction).