Legal

Privacy policy

Last updated:

This policy describes what personal data McCopado collects, how we use it, which providers process it, and how you can exercise your rights of access, rectification and deletion.

1. Controller and scope

The data controller is McCopado, based in the Republic of Ecuador. This policy applies to mccopado.com and to the McCopado Teams community spaces.

2. Data we collect

  • Account: name, email, phone, identity document, date of birth, country, language and preferred currency.
  • Shipping addresses: recipient, address, references and coordinates if you add them for physical product deliveries.
  • Purchases: order and transaction history (we do not store card numbers; see section 6).
  • Site usage: navigation and analytics events (PostHog) subject to cookie consent, including session recording for usability diagnostics.
  • Errors: Sentry receives technical stack traces without personally identifiable data.

3. How we use your data

  • To operate the platform, process your orders and coordinate shipments.
  • To calculate affiliate commissions and seller payouts.
  • To send transactional emails (verification, recovery, receipts, order updates).
  • To prevent fraud and protect account security.
  • To improve the product through aggregated analytics.

4. Cookies and tracking

We use essential cookies (session, authentication, language, country) and optional analytics cookies (PostHog) that load only after your explicit consent in the banner. You can change your choice at any time from the same banner.

5. Third-party processors

We work with these providers, each limited to its function:

  • PostHog — product analytics and session recording (only with your cookie consent).
  • Sentry — technical error monitoring.
  • Cloudinary — storage and delivery of images and videos uploaded to the platform.
  • Resend — transactional email delivery.
  • Render — server and database hosting.
  • Cloudflare — CDN, security and bot mitigation.
  • PayPhone (Ecuador) and Mercado Pago (Argentina) — payment processing. We do not store card numbers: tokenization is handled by the provider.
  • Google — OAuth sign-in if you choose to log in with Google.

6. Payments and card data

Your card details are entered directly into the payment gateway, which tokenizes and stores them under its own security standards (PCI DSS). McCopado only keeps tokenized references and the transaction history — never your full card number.

7. Your rights

You may request access, rectification, portability or deletion of your data by writing to info@mccopado.com. We respond within 30 days. Account deletion does not extend to transaction records we must keep under legal obligations.

8. Retention

We keep account data for as long as the account remains active, and transaction data for 5 years in accordance with tax and accounting obligations.

9. Minors

McCopado is for users aged 18 and over. We do not knowingly collect data from minors; if we detect an account belonging to a minor, we delete it.

10. Future tools

We currently do not use Google Analytics or Meta Pixel. If we adopt these or other analytics or advertising tools in the future, we will update this policy before activating them, and they will be subject to the same cookie consent.

11. Changes

We may update this policy. Material changes are announced by email or on the platform, and the "last updated" date at the top always reflects the current version.

12. Contact

McCopado · Ecuador · info@mccopado.com