Privacy Policy
Effective date: October 22, 2026
PuraAutos.com (“PuraAutos”, “we”) is a free English/Spanish website that lists vehicles for sale in Costa Rica. This policy explains what personal data we handle, why, who receives it, how long we keep it, and your rights.
We process personal data under Ley N.° 8968, Ley de Protección de la Persona frente al Tratamiento de sus Datos Personales, and its regulation (Decreto Ejecutivo N.° 37554-JP and its reforms). The supervisory authority is the Agencia de Protección de Datos de los Habitantes (PRODHAB).
1. Contact
For anything about your personal data, email support@puraautos.com.
2. Summary
- You can browse without an account. We do not sell personal data.
- Most listings are copied automatically from crautos.com, including the seller’s name, phone/WhatsApp and province as published there. If one is yours, you can claim it, have it removed and stop it being imported again (§7).
- If you register as a seller, we publish your name, phone/WhatsApp and location with your listings so buyers can contact you. If you choose “Get requests first”, your phone and WhatsApp are not shown on your listings.
- On listings whose seller chose “Get requests first”, you send a contact request with your name and a WhatsApp number confirmed by SMS code. We pass it to the seller and send texts about it (§3.8).
- Google Analytics and Microsoft Clarity (which records how pages are used) run only if you accept them in the cookie banner.
- If you write a seller a question in a different language from theirs, it is translated by AI (Anthropic) when you tap Send (§3.1).
- Stop any alert email with its unsubscribe link, and any text message by replying STOP.
- Pura Ruta, our game, needs no account: we keep your scores under a random device identifier, not your name (§3.9).
3. What we collect and why
3.1 Visitors
| Data | Purpose | Basis |
|---|---|---|
| Pages viewed, clicks, device and browser, approximate location (Google Analytics) | Measure and improve the site | Your consent (cookie banner) |
| Session recordings and heatmaps: clicks, scrolling, mouse movement, with page text masked (Microsoft Clarity) | Find usability problems | Your consent (cookie banner) |
| Comparison feature: a random session ID and the vehicles compared (no IP address) | Comparison statistics | Not linked to you |
| Contact-button clicks: a keyed hash of your IP address, the contact method, the time; on the WhatsApp contact screen and in contact requests (§3.8) also your choice (available / see it / offer / question), the page language and, for offers, the offer as a percentage of the asking price (this log never holds the amount or your question; for requests, the amount is kept with the request, §3.8) | Count and understand interest per listing, detect abuse | Necessary to run and secure the service |
| A hash of your IP address for up to an hour | Limit spam and abuse of forms | Security |
| Address of a missing page (404) and the page that linked to it (no IP address) | Fix broken links | Not linked to you |
| Share and favorite counts (no IP address or account) | Statistics | Not personal data |
| Server and security logs kept by our hosting and network providers | Deliver and protect the site | Security; kept under those providers’ policies |
Clicking a phone button opens your own phone. We only record the click.
WhatsApp contact screen. When you tap a seller’s WhatsApp button, we ask what you want: “Still available?”, “I’d like to see it”, “Make an offer” (you type an amount) or “Ask something else” (you type up to 400 characters). We then open your own WhatsApp with a message written in Spanish and the listing link. You decide whether to send it. PuraAutos does not send it and does not see your WhatsApp conversation; WhatsApp is run by Meta under its own policies. We record the contact as described above; that record does not include your question.
AI translation (when you and the seller use different languages). Sellers receive messages in their language: Spanish, unless a registered seller chose English. Only when your language and the seller’s differ, you type text (in “Ask something else” on the WhatsApp contact screen, or in a contact request, §3.8) and tap Send, our server sends only the text you typed to Anthropic’s API (Claude Haiku model) to translate it: into Spanish if you are on the English site, or into English if you are on the Spanish site and the seller chose English. We don’t send your name, phone, email, account or the seller’s data, and the request comes from our server, not your device. The fixed choices and offer amounts use pre-written wording and are never sent to Anthropic. The seller sees the translation with your original text underneath; if translation fails, your text is used as typed. Machine translation can contain mistakes, so check the message before sending it. No decisions about you are made automatically. Please don’t type personal data in your text: the seller already gets your WhatsApp number when you send the message (or, for a request, when they reply to you on WhatsApp).
| Data | Purpose | Basis |
|---|---|---|
| The text you type in “Ask something else” or in a contact request (§3.8), when you and the seller use different languages | Translate it into the seller’s language, through Anthropic | Your request: you ask us to write the message, or pass on your request, for you, and the text is sent only when you tap Send |
| The translation, stored on our server under a hash of your text | Avoid translating the same text twice | The same; kept 24 hours (§5) |
Under Anthropic’s commercial terms, Anthropic may not train its models on this text, and it deletes API inputs and outputs within 30 days, or keeps them up to 2 years if flagged for a usage-policy violation.
3.2 Email alerts
| Data | Purpose | Basis |
|---|---|---|
| Email, search filters, frequency, confirmation status, send history | Saved-search emails with new matching listings | Your consent, confirmed by clicking a link we email you (valid 24 hours) |
| Email, the vehicle watched, its price when you started watching, language, confirmation status, alerts sent | Price-drop alerts | Your consent, confirmed by clicking a link we email you |
3.3 Registered sellers
| Data | Purpose | Basis |
|---|---|---|
| Name, email, password (stored hashed) | Your account | Consent at sign-up |
| Phone(s) and WhatsApp, each verified by a one-time SMS code | Let buyers contact you | Consent |
| Province, canton, district; dealer status, services offered, website; language | Shown on your listings; language of our messages | Consent |
| How buyers contact you (“Show my WhatsApp” or “Get requests first”) and when you last changed it | Show or hide your number on your listings; send you contact requests (§3.8) | Consent (your choice) |
| Verification status and dates; reminder history (sent, clicked, delivered, stopped) | Verification and reminders (§3.4) | Consent |
| When and to which version of our terms you gave consent | Proof of consent | Legal obligation |
| Vehicle details and photos | Publish your listing | Consent |
Public data. Your name, phone(s), WhatsApp and location appear on your listings to anyone, anywhere, except that with “Get requests first” your phone and WhatsApp are not shown anywhere on your listings (§3.8). Your email is not shown.
Linking imported listings. When you verify a phone number, imported listings showing that number are linked to your account, so they show your details and you can edit or remove them.
3.4 Verification reminders
If you register, ask for reminders, and don’t finish verifying, we send up to four reminders over about 30 days: by SMS if you verified a phone, otherwise by email. Reply STOP to any SMS, or use the “stop reminders” link in the email. Stopping reminders does not delete your account.
3.5 Claiming an imported listing
To prove a listing is yours, we send a one-time SMS code to a phone number shown on that listing. We record each attempt (time, listing, result, and hashes of the phone number and IP address) to prevent abuse. We use that number for nothing else.
3.6 Listing removal requests
If you use our removal form, we keep the listing link, your name, the contact details you give us, your request and comments, to handle the request and as a record of it.
3.7 Data from other sources
Imported listings come from crautos.com (§7). We do not buy data or receive it from data brokers.
3.8 Contact requests
Registered sellers choose how buyers contact them: “Show my WhatsApp” (the number is shown on their listings) or “Get requests first” (preselected for new sellers who post with the quick form; existing sellers keep “Show my WhatsApp” unless they change it). With “Get requests first”, the seller’s phone and WhatsApp are not shown anywhere on their listings.
Sending a request. On those listings you tap “I’m interested”, pick what you want (“Still available?”, “I’d like to see it”, “Make an offer” with an amount, or another question) and may type text (up to 400 characters; for a visit, optionally when and where). You then give your name and a WhatsApp number from Costa Rica (mobiles only), the United States or Canada, or Western Europe (the countries are listed in the form), which we confirm with a one-time SMS code sent through Telnyx, as at seller sign-up. Each code sent and checked is recorded in the same attempts log as claim codes (§3.5), with a hash of the phone number and a hash of your IP address. Once your number is confirmed, this device remembers you for 180 days (cookie pa_buyer, §8), so you aren’t asked again.
| Data | Purpose | Basis |
|---|---|---|
| Your name and WhatsApp number | Pass your request to the seller, let the seller reply to you on WhatsApp, and text you about your request | Your request: you ask us to pass it to the seller and to text you about it |
| The listing and seller; your choice; your offer amount in colones; your text in the seller’s language and, if it was translated, your original (§3.1); your language | The request itself, shown to the seller | Your request |
| Status (new, answered, declined, expired) and times (created, closed, seller notified, reminder sent, warning sent, your follow-up sent); a hash of the seller’s one-time sign-in link | Run the request and the texts below; the seller’s request history | Your request; for the seller, the service of their account |
| A keyed hash of your number | One open request per buyer per car, at most 10 requests per buyer per day | Security, to prevent spam and abuse |
We keep your number in full, not only its hash, because the seller’s WhatsApp reply and our texts to you need it. We also record the contact in the contact-button log (§3.1) with method “request”, your choice, language and, for offers, the offer as a percentage.
Who sees it. The seller sees on their dashboard your name, that your phone was confirmed, your language, your choice or offer (amount and percentage of the price) and your text (with the original, if translated). Your number isn’t shown on the card. If the seller taps “Message them on WhatsApp”, WhatsApp opens to your number with a greeting in your language, so from then on the seller has your number in WhatsApp; that conversation is run by Meta under WhatsApp’s policies. If the seller taps “No, thanks”, the request is declined and we text you that the seller can’t take it this time, with a link to similar cars. PuraAutos administrators can see requests in our database.
Text messages (SMS through Telnyx, sent only between 7:00 and 21:00 Costa Rica time):
- To the seller: when a request arrives; a reminder at 4 hours and a warning at 21 hours if they haven’t answered (saying that in 3 hours we’ll show the buyer other cars). Each includes the buyer’s name, a short summary of the request and a one-time link that signs the seller in to their dashboard (valid 72 hours, single use). Basis: the service the seller chose with “Get requests first”.
- To the buyer, once: if the seller declines your request, or hasn’t answered 24 hours after the request (and at least 3 hours after the seller’s warning), a link to similar cars. Basis: your request; this text is about your request, not advertising.
Requests not answered within 72 hours expire. Reply STOP to any of our texts to stop them (§9).
How long. We keep requests while they are useful for the request and for the seller’s request history. We haven’t set a fixed period yet; when we do, we will update this policy. You can ask us to delete your requests at any time (§6).
3.9 Pura Ruta (game)
Pura Ruta is a free PuraAutos game at puraautos.com/juego. You play without an account, and we don’t ask for your name, email or phone. The colones (₡) you earn in the game are play money: they have no real value, can’t be exchanged for money or anything else, and the game has no prizes.
Device identifier. The first time you play, the game creates a random identifier and keeps it in your browser’s storage (§8). It lets us recognize your rounds and your best score without knowing who you are. Our server stores only a keyed hash of that identifier, never the identifier itself, and doesn’t link it to your name, account, IP address or other site data. If you clear your browser storage or play on another device, the game creates a new identifier, and your earlier rounds can no longer be linked to you.
| Data | Purpose | Basis |
|---|---|---|
| A keyed hash of the device identifier | Recognize your rounds and best score; count players | Your use of the game; not linked to your identity |
| For each round: a random code and the round’s seed; start and finish times; the meters covered and the play-money colones; the status (started, valid, or rejected by the check) | Run the game and verify scores | Your use of the game |
| For each round: how you arrived (the link’s source tag, such as “whatsapp” or “footer”); if you came from a friend’s challenge link, which round that challenge belongs to; the language (Spanish or English); the in-game car you drove | Game statistics | Not linked to your identity |
| For each device: your best score | Show you your best score and how you did against other players | Your use of the game |
| The round’s moves (when you changed lanes) | Verify the score; discarded after the check and not stored | Security, to prevent cheating |
| A hash of your IP address for up to an hour | Limit requests and abuse | Security |
Score check. When a round ends, your browser sends us your moves. Our server replays the round with them to confirm the score, then discards them. If the result doesn’t match, the round is rejected and doesn’t count. This check is automatic, but it only decides whether a score counts; no other decisions are made about you.
Challenge a friend. After a valid round, the “Challenge a friend” button opens your own WhatsApp or your phone’s share menu with a ready-made message and a link; you can also copy the link. You decide whether to send it and to whom. The game doesn’t read your contacts and doesn’t know who you sent it to. WhatsApp is run by Meta under its own policies.
The link carries a signed code for that round. Anyone who has the link sees that round’s score, in the page title and in a preview image (for example, “I made it 3,420 m”). The link and the image contain no name or other data about you. If someone plays from your link, their round records which challenge it came from, so we can count how many challenges are taken up.
What PuraAutos staff see. Overall statistics (players, rounds, scores, where visits came from, languages and cars) and a list of the top 10 scores, in which each player appears only as the first 6 characters of their device hash. We don’t publish any list of players.
Analytics. The game page doesn’t use Google Analytics or Microsoft Clarity. Elsewhere on the site, if you accepted analytics (§8), Google Analytics records which link to the game you tapped (for example, the one on the home page). Links from the game to PuraAutos listings carry a tag showing they came from the game.
Where it’s stored and who receives it. Game data is stored by our website hosting provider in the United States (§4). We don’t share it with anyone else.
How long. We haven’t set a period for rounds and best scores yet; when we do, we’ll update this policy.
Your rights over game data. Because we don’t know who you are, we can only find your rounds through the identifier your browser keeps. If you clear your browser storage, your rounds are no longer linked to you. If you’d like us to delete them, email us (§6) and we’ll explain how.
4. Who receives data
We do not sell data or share it for advertising. Recipients:
- The public: the contact details shown on listings (§3.3, §7).
- Sellers: if you send a contact request, the seller of that listing receives the details in §3.8.
- Service providers acting for us:
Provider Role Location Rocket.net Website hosting United States Cloudflare Content delivery and security Global DreamHost The listing-import system and its database, including imported sellers’ names and phones; sending our email United States Telnyx SMS codes (including buyers’ number confirmation), reminders, contact-request texts and STOP/HELP replies United States Google (Analytics) Analytics, only with your consent United States / global Microsoft (Clarity) Session recordings and heatmaps, only with your consent United States / global Anthropic AI translation into the seller’s language of text typed on the WhatsApp contact screen and in contact requests (only the text; no names, phones or account data, §3.1, §3.8); translating our blog posts United States - Authorities: when a court or the law requires it.
Transfers abroad. Most of our providers are in the United States. Registered sellers consent to this at sign-up. If you send a contact request, it is stored by our hosting provider and your number goes to Telnyx, both in the United States (§3.8). Analytics data goes abroad only if you accept analytics. Text that is translated goes to Anthropic in the United States only when you tap Send (§3.1). Pura Ruta game data is stored by our hosting provider in the United States (§3.9).
5. How long we keep data
| Data | How long |
|---|---|
| Seller account | Until you ask us to delete it. Accounts that never complete verification and have no listings are deleted about 90 days after sign-up. |
| Imported listing pages | Removed about 30 days after the listing disappears from crautos.com, or sooner on request (§7) |
| Imported seller records in the import database | Deleted once the seller has no listing left in it |
| Do-not-import list (a hash of the phone number) | As long as needed to honor your request |
| Numbers that replied STOP | As long as needed to honor the request |
| Claim attempts, buyers’ number-confirmation codes and removal requests | 12 months |
| Contact requests (§3.8) | While useful for the request and the seller’s request history; no fixed period yet. Deleted sooner on request (§6). |
| Comparison events | 90 days |
| Contact-button clicks (including contact-screen choices and offer percentages) | 90 days, and at most the last 100 per listing |
| Translated text | 24 hours in our translation cache; in a contact request, the text and its translation stay with the request (above). At Anthropic: deleted within 30 days, or up to 2 years if flagged for a usage-policy violation (§3.1) |
| 404 log | 90 days |
| Saved searches | Until you unsubscribe or delete them. Unconfirmed searches are deleted after 7 days, unsubscribed ones after 90 days. |
| Price alerts | Until you stop them or the vehicle is removed. Unconfirmed alerts are deleted after 7 days, stopped ones after about 90 days. |
| Import logs | 30 days; they contain no personal data |
| Analytics | Google Analytics: up to 14 months. Microsoft Clarity: recordings about 30 days. |
| Pura Ruta (§3.9) | No fixed period yet; we are preparing automatic deletion of old rounds and best scores. |
6. Your rights
Under Ley 8968 you may access your data, have it rectified, have it deleted (cancelación) when it is inaccurate, unnecessary or processed unlawfully, object to its use, including for messages, and withdraw your consent at any time.
How: email support@puraautos.com with the subject “Privacy request / Solicitud de privacidad”, saying what you want and the email, phone or listing link concerned. To confirm the data is yours we may send a one-time code to that email or phone; we won’t ask for more identification than necessary. Requests are free. We reply within 5 business days. To delete your seller account, email us from the account’s address. Buyers can ask us to delete their contact requests; to make a device forget you, clear its cookies (§8).
If you’re not satisfied, you may complain to PRODHAB (www.prodhab.go.cr).
Visitors in the European Union or United Kingdom: if the GDPR applies to you, you also have rights to restriction and portability, and may complain to your local data protection authority.
7. Imported listings: if your car or phone appears on PuraAutos
Most listings are copied automatically every hour from crautos.com. They may show the seller’s name, phone/WhatsApp and province as published there, and the vehicle’s photos. We republish them so buyers can find vehicles in one place.
PuraAutos does not contact sellers of imported listings by phone, SMS, WhatsApp or email, except to send a claim code the seller asked for.
If a listing shows your data you can:
- Claim it: use “Is this your car?” on the listing. We send a code by SMS to the phone on the listing; with it you can remove the listing at once or link it to a free seller account to edit it.
- Request removal: use the form at puraautos.com/remove-listing, or email support@puraautos.com with the listing link.
When a listing is removed at the owner’s request, we take down every imported listing with that phone number, delete the seller data we hold for them, and add the number to a do-not-import list so it isn’t imported again. We act on form and email requests within 5 business days of confirming them. To remove the listing from crautos.com itself, contact crautos.com.
8. Cookies and browser storage
Only with your consent:
- Google Analytics (cookies such as
_ga): counts visits and events such as “contact seller” or tapping a link to the Pura Ruta game. We don’t send names, phone numbers or emails to Google. Until you accept, Google Analytics sets no cookies; Google may still receive basic cookieless signals, such as that a page was viewed. - Microsoft Clarity (cookies such as
_clck,_clsk): session recordings and heatmaps. It doesn’t load at all until you accept.
Always on, because the site needs them:
- Cloudflare security cookies (such as
__cf_bm) to block bots. - WordPress login cookies for sellers.
- A temporary cookie (up to one hour) that links a listing you just claimed to your account when you sign in.
pa_buyer(180 days): set only after you confirm your number for a contact request; holds your name and phone number, signed so it can’t be altered and HttpOnly so page scripts can’t read it, so you aren’t asked again on this device (§3.8). Clear your cookies to remove it.
Browser storage set by PuraAutos stays on your device. We don’t receive it unless stated.
| Key | Holds |
|---|---|
pa_consent |
Your cookie choice |
pura_favorites |
Your favorites; we update an anonymous count per vehicle |
pura_recently_viewed |
Vehicles you viewed |
pura_compare, pura_compare_session |
Your comparison, and the random ID sent with comparison events (§3.1) |
pura_saved_searches |
Searches before you confirm an email |
pura_engagement |
Activity on vehicle pages, to show helpful prompts |
pura_exit_intent, pura_notifications, pura_social_proof |
Which messages or prompts you’ve already seen |
pa_huecos_dev |
Random device identifier for Pura Ruta; sent to our server, which keeps only its hash (§3.9) |
pa_huecos_best, pa_huecos_rounds, pa_huecos_sound, pa_huecos_fact |
Your Pura Ruta best score, how many rounds you’ve played, whether sound is on, and which PuraAutos fact to show next |
pa_huecos_intro (session storage) |
That you’ve already seen the how-to screen this visit |
pa_home_game_hidden |
That you closed the game card on the home page |
pa_dash_game_seen |
When the game link was last shown on the seller dashboard (at most once a week) |
pa_qp_draft |
Your listing draft while you post it, so it isn’t lost if the page closes |
pa_qp_phone (session storage) |
The mobile number you typed while posting, for this visit |
Change your choice at any time with “Cookie settings” at the bottom of every page, or clear your browser storage.
9. Emails and text messages
- Sent when relevant: verification and claim codes, confirmations, account notices.
- Contact requests (§3.8): a code to confirm a buyer’s number; to sellers, a text for each new request plus a reminder and a warning if unanswered; to buyers, one text with similar cars if the seller hasn’t answered. Sent only between 7:00 and 21:00 Costa Rica time.
- Only if you asked: saved-search and price-drop alerts, and up to four verification reminders.
Every alert email has an unsubscribe link, normally honored immediately and always within 10 business days. SMS: reply STOP (or SALIR) to stop and HELP (or AYUDA) for help. Message and data rates may apply. Agreeing to messages is never a condition of using the site.
10. Security
We use HTTPS, hashed passwords, signed and time-limited links, one-time codes, rate limiting and restricted administrator access. No system is perfectly secure. If a security incident affects your data, we will inform you and PRODHAB as the regulation requires.
11. Minors
You must be 18 or older to register as a seller, send contact requests or subscribe to alerts. Anyone can play Pura Ruta, which asks for no personal data (§3.9). If a minor has given us data, contact us and we’ll delete it.
12. Changes
We’ll update the effective date above. For significant changes we’ll email registered sellers before they take effect, and ask again where new consent is needed.
13. Language
This policy is published in Spanish and English. If they differ, the Spanish version prevails.