Privacy policy
What we hold about you, why, who else sees it, and what we deliberately do not collect.
Contents · 14 sections
Who holds this data
Rent La Ventana is a marketplace for La Ventana and El Sargento, Baja California Sur. We introduce people who have something to let — a house, a lesson, a kite, a truck, a ride from the airport — to people who want it.
Rent La Ventana, 2710 Grand Ave, San Diego, CA 92109, USA, is responsible for the personal data described here (in Mexican law, the “responsable”).
We are not the seller. The agreement is between you and the owner, and the owner is paid their full price.
Questions, corrections or a request to delete your account: hello@rentlaventana.com.
What we hold
An account is an email address and a password. The password is hashed by our authentication provider and is not readable by us or by anyone at Rent La Ventana.
A profile adds your name, a WhatsApp number, and optionally a country and a photo. The number is asked before you pay and is used for two things only: reaching you about your own bookings, and being handed to the other party once a booking is paid. You can change it any time on Your details.
If you list something, we hold what you wrote about it — the description, prices, photos, availability, your own cancellation terms — because that is the listing.
If you book something, we hold the dates, the party size, the amounts, and the messages between you and the other party.
If you write to the help assistant, we keep the conversation, so a person can pick it up if you ask for one.
If you join the weekly newsletter, we keep your email address and language, and send to it only once you confirm. Every issue has an unsubscribe link, and unsubscribing stops it at once.
Why we hold it: to run your account, your listings and your bookings, to take payments and pay sellers, to keep the site safe, and to meet legal and tax duties. We also send a few welcome emails after you join, and may feature a seller’s listing photos on our social media (see the Terms). You can say no to both without losing the service.
What we deliberately do not collect
We never see or store your card number. Payment happens on a page hosted by Stripe.
We do not ask your nationality, and nothing on this site is decided from it. The same small service fee applies to every booking, wherever you are. At booking we note the country of your card and of your connection, for our records.
We do not track you around the internet, and there is no advertising network on this site.
What is public, and what never is
If you sell here, your public profile shows your name, your photo, when you joined, and any business name, description and photos you added. If you only buy, your name is shown only to sellers once you've paid them, and to people whose listings you review.
Your email address, your WhatsApp number and your country are never public.
A listing shows an approximate location rather than an exact one until a booking is confirmed. A shop shows only the town.
What the other party gets, and when
Your name and WhatsApp number are released to the other party when a booking is CONFIRMED, and not before. Before that, once a request is sent, the two of you can message on the booking.
Messages, offers and notes are checked automatically. Before a booking or order is paid, one that contains a phone number, an email address, a social handle or a link is not sent, and you are told what to remove. We keep a copy of it — the words, who sent it, to whom and about which listing — and Rent La Ventana reviews it. Payments and bookings outside the site are against the Terms.
Before you pay, your questions about a listing go to our assistant. It answers from the listing and, when only the Owner can answer, asks them in its own words; your own words are not passed on. Our team reads these conversations. We keep every message and the assistant's replies for as long as your account is open, and afterwards only as long as we need to for disputes or the law.
Owners see what they need to host: your dates and your party size, then your name and number once you've paid. Owners never see your card details.
Who else your data reaches
Stripe processes payments and holds the card details we never see.
Supabase hosts the database and the login system. Cloudflare serves the site. Resend sends the transactional email — your booking confirmations and receipts.
Anthropic provides the AI behind the help assistant, listing translation and listing import. It receives what you type into those features and the listing text being translated, processes it to answer, and under its commercial terms does not use it to train its models.
Axiom holds our error logs, with email addresses masked. Google receives booking times only if a seller connects a Google Calendar (below). Wise sends payouts to owners of houses we manage. Cloudflare also keeps a nightly backup copy of listing photos.
Google and Mapbox turn a typed address into a map pin, and receive only that address. Open-Meteo supplies the wind forecast and receives nothing about you.
Maps are drawn from OpenFreeMap, which receives your internet address and the part of the map you are looking at.
If you turn on phone alerts, each one travels through your browser’s own push service (Apple, Google or Mozilla). It receives your device’s alert address and an encrypted message it cannot read.
That is the list. We do not sell data, and we do not share it with anyone not named here.
If you connect a calendar
Sellers can connect a Google Calendar so that confirmed bookings appear in it automatically, and so that any booking system reading that calendar (Acuity, Calendly, Wix, Airbnb Experiences) blocks the same time. It is optional, and only sellers are asked.
What we ask Google for, and why. Two permissions. “See the list of your calendars” (calendar.calendarlist.readonly), so you can pick which calendar a listing writes into; we keep the chosen calendar’s id and name, and your Google email address so you can see which account is connected. “View and edit events” (calendar.events), so we can add an event when a booking is confirmed and remove it if the booking is cancelled. We never read, copy or store the other events in your calendar.
What we store. A refresh token and a short-lived access token, encrypted, in a table that no browser and no logged-in user can read — only our server, and only to write your own bookings. For each event we wrote, its id, so we can remove it later.
Events we create carry the listing name, a link to the booking and the meeting place. No guest name, no amount.
What we never do with Google data. We do not sell it, use it for advertising, share it with anyone, or use it to train AI or machine-learning models. No person at Rent La Ventana reads it, except where you ask us to help with your account or the law requires it.
Rent La Ventana’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Disconnecting stops it immediately and deletes the stored tokens and every listing’s calendar choice. Events already written stay in your calendar, because they are yours; delete any you do not want. You can also revoke us from your Google account at https://myaccount.google.com/permissions, or write to us to delete everything.
The calendar feed we publish for a listing contains only the times that are taken and the word ‘Reserved’. It never contains a guest’s name, and it never contains an amount.
AI on this site
The help assistant is AI and says so. Its answers come from our help pages and can be wrong; ask for a person at any time. Listing text is translated by AI, and sellers can correct it.
No decision about you — a booking, a payment, a refund, a fee, or your account — is made by AI. We do not use your data to train AI models.
How we protect it
Every connection is encrypted (HTTPS), and the database is encrypted on disk. Database rules decide row by row who can read what, so one person’s account cannot reach another’s private data. Sign-in attempts are limited, and passwords are checked against known leaks. Our own admin accounts use two-factor sign-in. The database is backed up daily.
If a breach ever affects your data, we will tell you promptly, and say what happened and what to do.
Where your data is
Our servers and the providers named above are mainly in the United States, so your data leaves Mexico. We send it only to those providers, only so they can do the job named, and they must protect it.
How long we keep it
Bookings, payments and the messages attached to them are kept while the account exists and afterwards where we are required to.
You can delete your account by writing to us. Listings and profile data go with it. A booking that another person is also a party to is not erased from their side.
Your rights
You can ask what we hold about you, ask for it corrected, ask for a copy, ask for it deleted, or object to a use of it (in Mexico, your ARCO rights), and withdraw any consent you gave. Write to hello@rentlaventana.com with your name, the email on your account, and what you are asking for. We answer within 20 business days.
You can change your name, number and country yourself at any time from your account.
If you think we have not respected your rights, you can complain to the data-protection authority where you live.
Children
This site is not for under-18s, and we do not knowingly hold data about them. Someone under 18 taking a lesson is booked for by an adult, and it is that adult’s account and details we hold.
Something here not making sense, or not matching what happened to you? Tell us.