Privacy Policy

When you create an account or make a booking, we collect your name, email address, and, if you provide them, your phone number and booking notes (for example, a flight number). We also store your booking history, payment status, and, if you leave a review, the rating and comment.

Sign-in and sessions are managed by Supabase Auth. If you use Google when that provider is enabled, we receive the identifier and email the provider shares. Card details are not stored on our servers: Tilopay or PayPal processes them.

We use your data to create and manage your account, process bookings and payments, send confirmations and trip-related notices, answer inquiries, and, when applicable, display publicly approved reviews.

The language you use when booking is stored so we can send the confirmation email in that language. We do not sell your personal information.

If you write a review without having booked on this site, we ask for your name and email address. Your name is published next to the review once we approve it. Your email is never published: we use it only to verify the review or to contact you about it, and never to send you marketing.

Supabase: authentication, database, and storage of site images or video.

Tilopay: card payment processing in Costa Rica.

PayPal: payment processing with a PayPal account or the methods PayPal offers at checkout.

Resend: sending transactional email (account confirmation, password reset, booking confirmation, and internal notices to the operator).

These providers handle data under their own policies and only as needed to provide the service.

This site only uses cookies it needs to work. We do not use analytics, advertising or social media cookies, and we do not load tracking scripts. We also do not store data in your browser's local storage (localStorage). The cookies listed here are first-party: this site sets them, on its own domain.

NEXT_LOCALE (12 months): remembers the language you chose, so the site is shown in Spanish or English.

sb-…-auth-token (Supabase): keeps you signed in. It only exists if you sign in; it is deleted when you sign out and otherwise lasts up to 400 days. It may be split into several parts (.0, .1). Signing in with Google or recovering your password also creates sb-…-auth-token-code-verifier, which is removed when the process finishes.

mapea_oauth_locale (10 minutes): only if you sign in with Google; stores your language so you return to the right page.

mapea_cookie_consent (12 months): remembers that you have seen the cookie notice, so it is not shown again.

mapea_maintenance_bypass (30 days): only for the Mapea Tours team; lets them view the site while it is under maintenance. Visitors never receive it.

Payments and Google sign-in: if you choose to pay with PayPal, the payment step loads PayPal's script from paypal.com, which may use its own cookies to process the payment and prevent fraud. If you pay by card, Tilopay takes you to its own payment page, and if you sign in with Google, that happens on Google's pages. In those cases each provider's cookie policy applies. None of this loads unless you choose that option.

You can see the notice again from "Cookie preferences" at the bottom of every page. You can also delete cookies in your browser settings; if you do, you will be signed out and your language choice will be forgotten.

We keep the account and booking history while the account is active and for any extra time required by accounting, tax, or claims obligations. Cancelled bookings are kept as a historical record; they are not deleted when you cancel.

If you ask us to delete your account, we will review the request and keep only what the law requires us to retain.

You may request access to, correction of, or deletion of your personal data, and object to certain processing, under the rules that apply in Costa Rica. To exercise these rights, write to the contact email in this policy.

You may also update some details from your profile when that feature is available, and sign out at any time.

For privacy questions or requests, write to info@mapeatours.com. Put “Privacy” in the subject line so we can prioritize your request.