Privacy Policy

Spanish (Honduras) is the official version · Last updated: October 7, 2026

A.1 Data controller and contact

The service Trouvé ("Trouvé", "the platform", "we", "us") is operated by PRIVE S DE RL, with RTN 05019018067812 and address at Colonia Moderna, Calle 1, Avenida 20, San Pedro Sula, Cortés, Honduras. Trouvé connects purchase requests with quotes from sellers.

For any matter regarding your personal data, you can write to us at:

• Email: roque@priveperfumeshn.com
• WhatsApp/phone: +504 9539-3244

A.2 Scope

This policy explains what personal data we collect, for what purpose, with whom we share it, how long we keep it, and what rights you have. It applies to buyers and sellers who use the Trouvé and Trouvé Partner apps, WhatsApp, the seller portal, and our public pages.

A.3 Data we collect

That you provide to us:

• Identification and contact: name, city, and phone number, including a WhatsApp number when you use that channel.
• Messages and files: content you send to Trouvé in the apps, on our public pages, or over WhatsApp, including photos, files, and notes.
• Identity verification (sellers): a photograph of the front and back of your identity document (DNI) and facial verification / liveness data to confirm that you are a real person and the holder of the document.
• Tax data (sellers who issue invoices): legal name (razón social) and RTN.
• Commercial content (sellers): inventory, quotes, prices, product photos, and item condition.
• Purchase activity (buyers): requests, quote selections, and orders.

That are generated through use of the service:

• Payment, shipping, and settlement data: amounts, method (bank transfer, cash on delivery/COD, card), the name on the paying account, order status, buyers' Trouvé credit and outstanding debts, and sellers' deposits, charges, balances, and payouts.
• Buyer verification: where an outstanding debt exists or on higher-risk transactions, we may ask for your DNI.
• Technical and security data: device identifiers and logs needed to operate the service and prevent abuse.
• Moderation evidence and blocklist signals: text or images related to fraud attempts, off-platform contact leakage, or rule violations.

We do not deliberately request categories of sensitive data other than those needed for the identity verification described above. Do not share or send health, religious, or political-opinion data through Trouvé.

A.4 Why we use your data and on what basis

A.5 Identity verification and biometric data

Sellers' facial verification and liveness checks involve the processing of biometric data. We process it only with your explicit consent, given when you begin verification, and for a limited purpose: to confirm that the person is real and matches the document presented, in order to protect buyers and sellers against impersonation and fraud.

• We do not use this data for advertising purposes, nor do we sell it.
• You may withdraw your consent, in which case you will not be able to complete or maintain your registration as a verified seller (verification is a service requirement).
• We retain this data for the periods stated in section A.8.

A.6 With whom we share your data (processors and third parties)

We share data only with providers that perform services on our behalf under our instructions, and only as necessary:

• Meta Platforms / WhatsApp Cloud API — messaging: processes your number and the content of messages and files to deliver the conversation.
• Anthropic (Claude API) — artificial-intelligence processing of conversation and image content to match requests, review images, and improve the service.
• Facial verification / KYC provider — processes sellers' facial and liveness verification.
• Object storage provider (S3-compatible) — securely stores images and evidence.
• Fly.io — application hosting and runtime.
• Sentry — error monitoring and service stability.
• Litestream — backup replication of the database.

We may also share data with payment and courier/delivery partners when needed to complete an order, and with authorities where there is a legal obligation or a legitimate request. We do not sell your personal data.

A.7 International transfers

Some of our providers process or store data outside Honduras (for example, in the United States or the European Union). When this occurs, we require those providers to maintain appropriate security and confidentiality safeguards, and we handle the data in accordance with this policy.

A.8 Data retention

We keep data only for as long as necessary for the purposes described or as required by law.

While your account is active, we keep the data we need to provide the service. Requests for products we do not offer, and notices you asked for, are kept for up to 6 months. If you delete your account before then, they are handled as described below.

When you delete your account, deletion is completed within a maximum of 30 days of your request. If anything is still pending with us, such as an order in progress, a claim, a refund, a balance owed by or to you, or an open moderation case, we resolve it first, and deletion is completed after that. When it is completed, these rules apply:

• Tax records: orders, payments, refunds, commissions and charges, settlements, balances (debts and credits), and seller payouts and withdrawals, including the bank account given for those payouts or withdrawals. These are kept whole, with the data they contain (for example, the delivery name, address, and phone number, order notes, and invoice details), for the period required by the law of the country where the transaction took place. In Honduras, that is 5 years from December 31 of the year of the transaction, because the operator is registered with the National Tax Registry (RTN); if it were not, it would be 7 years.
• Other records the law requires: if another law requires us to keep a record, we keep it for the period that law sets, and then it is deleted.
• Records tied to an open case: anything related to a claim, refund, audit, investigation, or binding legal order in progress is kept until the case is resolved. After that, it follows the rule for its type.
• Fraud records: if we establish that a person committed fraud on an order (for example, paying with a stolen card), we keep their data for that order and their account to prevent further fraud and to handle legal claims, with no deletion date, even if they asked to delete their account. If we review the case and conclude there was no fraud, their data follows the rules above again.
• Marketplace history, without content: your requests (including those for products we do not offer yet and for replicas we declined), conversations, and offers may remain with no text, photos, or messages, keeping the transaction details (for example, category, condition, budget or price, shipping cost, whether an invoice was requested, status, and dates, with no addresses or invoice details), so the marketplace's history of orders and amounts still adds up. For sellers, the Partner profile is left without name, DNI, photos, or contact details, but keeps the account's operating data, such as its score, strikes, plan, shipping preferences, and activity dates. These have no deletion date.
• Your phone number may remain with the tax, open-case, or marketplace history records we keep, for as long as those records are kept, so we can handle a question about them. If the WhatsApp message telling you that deletion is complete cannot be delivered, we keep your number for about 7 days more, only to retry that message. If you asked us not to send you certain WhatsApp messages, your number stays on our opt-out list, only so we keep respecting that choice.
• Everything else is deleted when deletion is completed: DNI images and facial / liveness data, messages and files, profile and contact data, photos, the text of your requests, your waitlist or early-access sign-up, notices we already sent you, and trust, risk, and moderation data, except what stays inside the records above, such as order details or the Partner profile's operating data.

Tax records, records another law requires, and open-case records are kept with restricted access and used only to comply with the law or resolve the case. When their period ends, our team deletes them. Marketplace history, without content, is also kept with restricted access and used only to reconcile orders and amounts, to measure how the marketplace performs, and to answer questions about those records.

A.9 Your rights

You may request at any time:

• Access to the data we hold about you.
• Rectification of inaccurate data.
• Deletion of your data, except data we must keep due to a legal obligation or to defend against claims, and content-free marketplace history with your phone number (see A.8).
• Objection to or restriction of certain processing.
• Withdrawal of consent for biometric data.

To exercise them, write to us through the means in section A.1 or follow the instructions in section C (Data deletion). We respond within a maximum of 30 days. These rights are recognized in accordance with Honduras's constitutional habeas data guarantee and the data-protection best practices of the region (among others, the regimes of Colombia, Mexico, Costa Rica, and Brazil), which we voluntarily adopt.

A.10 Security

We apply reasonable technical and organizational measures: access control, secure storage of evidence and images, separation of information between buyer and seller, and database backup. No system is infallible; we ask you to protect your device and not share your access.

A.11 Minors

Trouvé is intended exclusively for persons over 18 years of age. We do not knowingly collect data from minors. If we detect a minor's account, we close it and delete their data.

A.12 Changes to this policy

We may update this policy. We will publish the current version at this same address with its update date; material changes will be communicated through the usual channels.

A.13 Country annexes

Honduras (active country)

• Controller and address: see section A.1.
• Applicable framework: the Constitution of the Republic (habeas data guarantee) and applicable sectoral regulations; in the absence of a general data-protection law, we voluntarily adopt regional best practices.
• Authority/forum: claims before the competent courts of Honduras.

Other countries (future expansion)

When Trouvé operates in another country, an annex will be added here with the local controller, the applicable legal framework, and the corresponding data-protection authority. Until then, we do not provide service in those countries.