Privacy policy

This is an English translation for reference. The Spanish version is the one that governs.

Effective October 18, 2026 · Version 2026-10-18

1. Who is the controller

Pilas! is a management service (sales, inventory, finances and digital catalog) for entrepreneurs. The controller of the data described in this policy is:

Controllers

Juan Changoluisa & José Changoluisa

RUC

1723288070001 / 1721496212001

Address

Quito, Ecuador

Email for privacy matters

pilasemprendedores@gmail.com

Support WhatsApp

+593 984 034 782

Pilas! has not appointed a data protection officer. Any privacy question is handled at the email above.

This policy is governed by Ecuador's Organic Law on Personal Data Protection (LOPDP) and its General Regulations.

2. Who it applies to

• Store owners: the people who create a store in Pilas! (hereinafter, "you").
• Team: the sellers and staff the owner registers in their store.
• Customers of each store: the people who buy from or place orders with a store that uses Pilas!.
• Pilas Network buyers: the people who post what they're looking for to receive offers from stores.
• Visitors to this page and to stores' digital catalogs.

3. What data we process

From the store owner

• Google account: name, email, profile photo and account ID. We receive them from Google when you tap "Continue with Google". We don't receive your Google password.
• Registration: business name, category, phone or WhatsApp, administrator's name, ID number or RUC, email, address, country, province, city, parish and, if you allow it, the business's GPS location.
• Business operations: products, inventory, costs, sales, expenses, purchases, suppliers, debts, loans, cash, banks, goals and other information you record in the app.
• Plan and payments: subscribed plan, dates and payment references. Your card details are processed directly by Payphone; Pilas! does not receive or store them.
• Technical data: IP address when you sign up (to prevent abuse and to record that you accepted this policy), audit logs of actions within your store, preferences (theme, language) and, if you turn them on, browser notification subscriptions.
• Communications: messages you send to support and answers to satisfaction surveys.

From the store's team

• Name, access PIN (Firebase Authentication stores it encrypted; on the device where it's used, the session keeps it protected so it isn't asked for all the time), goals and the sales or transactions they record.

From each store's customers

• Name, WhatsApp or phone, ID number or RUC (when the store issues a receipt with details), birthday if the store records it, purchases, points, orders, debts, payments and notes the store writes.

From catalog visitors

• Name and WhatsApp when they place an order or ask to be notified about restocking.
• Messages written to Pili, the catalog's virtual salesperson.
• Counts of visits, taps and searches with no results, stored without name or contact.
• Favorites, viewed products and cart, which are stored only on the visitor's own device.

From Pilas Network buyers

• What they're looking for, their city (or their GPS location if they allow it), their WhatsApp, how they prefer to be contacted and their ratings of stores.

4. What we use it for and on what legal basis

We don't use your data or your customers' data for advertising, we don't sell it and we don't build profiles for third parties.

5. Your store's customers' data

You decide about your customers' and your team's data: your store is the controller of that data and Pilas! acts as the data processor, in accordance with article 34 of the LOPDP. This means that:

• We only use it to provide you the service and according to your instructions (what you do in the app).
• We don't use it for our own purposes or disclose it to other stores, not even within the Pilas Network. Your customers' debts and credit sales are visible only to your store and are never sent to credit bureaus.
• We help you respond to your customers' requests (access, correction, deletion).
• If a security incident affects that data, we notify you within 2 days of becoming aware of it.
• When you delete your account, that data is erased at the end of the grace period (see section 9).

As the controller, your store is responsible for informing its customers how it uses their data and for having a legal basis to record it. Avoid writing sensitive data in notes (health, religion, ethnic origin, etc.).

If you are a customer of a store and want to exercise your rights, write to that store first. If you get no answer, you can write to us and we will pass it on.

6. Data that is shown publicly

Some of your store's data is public because that's how the digital catalog and the Pilas Network work:

• In your catalog: business name, phone or WhatsApp, shop address, hours, social media, products with their price and the bank accounts for transfers that you decide to show.
• On the Pilas Network: the store's name, category, city and province.
• In the Challenge ranking of the Flujo Pilas game: your store's name and its score.
• If you are a Pilas Network buyer, stores in that category and area see what you're looking for and your city. They see your WhatsApp only if you choose public contact.

Your ID number or RUC, your email, your costs, your sales and your customers' data are not public.

7. Who we share it with

To work, Pilas! uses providers that process data on our behalf and only to provide their service:

Also, when you open the app your browser downloads programs and fonts from content delivery services (Google and jsDelivr), which receive your IP address.

We will only hand over data to an authority when a law or a court order requires it.

8. Data outside Ecuador

The providers in the previous section store and process data outside Ecuador, mainly in the United States. That processing is done on behalf of Pilas! and under each provider's data protection terms, which require them to use the data only to provide their service and to protect it.

9. How long we keep it

• While your account is active, we keep your store's data to provide you the service.
• If you delete your account (Settings → Danger zone), you have 30 days to change your mind. After that period, your store, your customers' and your team's data, their users and your trace on the Pilas Network and in the Challenge ranking are permanently deleted.
• If you connect your Google account but don't finish creating the store, that account's record in Pilas! (name, email, photo and ID) may remain stored. You can ask us to delete it at any time.
• Plan payments are also recorded at Payphone, according to its own policies.
• If you posted a search on the Pilas Network, you can ask us at any time to delete it along with your WhatsApp.
• Voice dictation audio is not stored in Pilas!: it's sent to be transcribed and discarded.
• Providers may keep technical or backup copies for the periods set in their own policies.

Before deleting your account, download the information you need for your accounting: the obligation to keep your own tax records is yours.

10. What is stored on your device

The app stores data on your own phone or computer to work fast and without internet: the signed-in session (encrypted), a copy of the catalog, sales waiting to be sent, your preferences and, in the catalog, the cart, favorites and viewed products. We don't use advertising cookies or third-party tracking tools.

If you turn on fingerprint or face sign-in, the recognition is done by your own device: your fingerprint or face never leaves it or reaches Pilas!.

11. How we protect it

• All connections are encrypted (HTTPS).
• Each store can only see its own data: the database rules check this on every query, based on who is signed in and their role (owner or team).
• The owner signs in with their Google account, with Google's security (including 2-Step Verification if turned on). In stores created before this version, the owner's password still works as a backup.
• Sensitive operations (creating stores, payments, catalog orders) are validated on the server.
• Important actions are recorded in an audit history.

No system is infallible. If a breach affects your data, we will notify the Superintendency of Personal Data Protection and, when there is a risk to you, you as well, within the deadlines set by the LOPDP.

12. Your rights and how to exercise them

Under the LOPDP you have the right to:

• Access: know what data of yours we process.
• Rectification and updating: correct inaccurate or incomplete data.
• Deletion: ask us to delete your data.
• Objection: object to a specific processing.
• Portability: receive your data in a format you can use in another service.
• Suspension of processing in the cases provided by law.
• Not to be subject to decisions based solely on automated processing.
• Withdraw your consent when processing is based on it (for example, by turning off notifications).

How to do it: write to pilasemprendedores@gmail.com with the subject "Privacy", stating which right you want to exercise, your store's name and a detail that lets us verify you are the data subject (for example, by writing from your account's email). It's free and we respond within 15 days at most.

You can do many things yourself in the app: correct your store's data in Settings or delete your account in the Danger zone.

If you're not satisfied with our answer, you can file a complaint with the Superintendency of Personal Data Protection: www.spdp.gob.ec.

13. Artificial intelligence and automated decisions

Pili, the Pilas! assistant, gives you suggestions and summaries based on your business figures; in the catalog she answers your customers and recommends products. For some answers and for voice dictation, the text or audio is sent to the Groq service (see section 7).

Pilas! does not make automated decisions that produce legal effects on you or your customers, nor does it build profiles for that purpose. Pili's suggestions are informative: you decide. Always check important figures.

14. Minors

To create a store in Pilas! you must be over 18. If a store records data of customers who are minors, it is responsible for doing so with their legal guardian's authorization when the law requires it.

15. Mandatory data and incorrect data

The data marked as mandatory at sign-up is necessary to create the store and provide you the service: without it we can't open your account. If you provide false or inaccurate data, some features may not work (for example, your location on the Pilas Network or the details on your receipts), and you are responsible for that data.

16. Changes to this policy

If we change this policy, we will publish the new version on this page with its date. If the change is important, we will notify you in the app or by email before it takes effect.