Privacy Policy
Last updated: 4 October 2026
This Privacy Policy explains what personal data Exploras collects when you use exploras.do (including www.exploras.do and its subdomains — the “Service”), why we collect it, who we share it with, how long we keep it and what rights you have. It applies to visitors, to travellers who contact a host through the Service, to account holders and to the hosts listed on the Service.
The Service is operated under the trade name Exploras from the Dominican Republic, and the operator is the party responsible for your data (the “data controller”). We process personal data in accordance with Dominican Law 172-13 on the protection of personal data and, where it applies to visitors from the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR) and its equivalents. You can reach us for anything in this policy at contacto@exploras.do or through the contact form.
1. In short
- Exploras is a directory. We never see or process a payment, so we never hold card, bank or payment data.
- You can browse everything and contact a host without an account.
- When you contact a host, the conversation happens on WhatsApp between you and the host. We do not read it. We only record the enquiry details you type into our form.
- We do not sell personal data. If you accept cookies, the Meta pixel tells Meta which of our ads on Facebook and Instagram led to a visit or an enquiry (section 2.6).
- Analytics and advertising measurement (Google Analytics, Microsoft Clarity and the Meta pixel) only load if you accept cookies. Before you choose, no such request is made and no such cookie is set.
- Our servers and database are in the United States. See section 7 on international transfers.
2. What we collect, and when
2.1 When you browse. Our hosting provider records standard server logs for each request: your IP address, browser and device type, the page requested, the referring page and the time. We use them for security, debugging and abuse prevention. The Service also counts how many times a listing, article or guide page is opened; that counter stores only the page and the day, nothing about you. Your language choice is kept in a cookie and, if you have answered the cookie banner, your answer is stored in your browser.
2.2 When you contact a host. The WhatsApp button on a listing or host profile opens a short form. Depending on the kind of listing it may ask for your first name (optional), the number of people, a preferred date and time of day, a transfer route, a vehicle type and a number of rental days. When you tap the button we record those answers together with the listing or host concerned, the language you were browsing in, the time, and a random reference code that is also placed inside the WhatsApp message. We do not collect your phone number: the message is sent from your own WhatsApp to the host’s, and only you and the host hold that conversation. If you later return to the listing from that conversation, the reference code lets the page ask whether the host replied; answering is optional, and your answer is kept in your browser so you are not asked twice. If you are signed in to an account, the enquiry is also linked to your account and your name is pre-filled from your profile.
2.3 When you use the contact form. We collect your name, e-mail address, the subject you choose and your message. We send you an automatic confirmation and forward the message to our team.
2.4 When you create an account. We collect your name, e-mail address and password (stored only as a cryptographic hash by our authentication provider), your chosen role (traveller or host) and, for hosts, the business WhatsApp number, which we use to check whether the business is already listed. Account holders can save listings as favourites; we store which listings you saved. We send transactional e-mails only: e-mail confirmation, password reset, and replies to your messages. We do not send newsletters.
2.5 If you are a host. A host page shows, by design, the business’s public details: business name, description, town and service areas, WhatsApp number, spoken languages, cover photo, listings with photos, prices and conditions, and the rating and number of reviews that Google publishes about the business. To create or improve a page we may collect that information from you directly (by WhatsApp, phone, e-mail or the host dashboard) and from public sources: the business’s own website and its Google Business Profile, retrieved through Google’s Places API and through an automated crawler. Internally we also keep: notes on our contact with you and on verification of your page; the state of any follow-up we are waiting on; your answers to short surveys about the Service; the enquiries your listings received (section 2.2); and a log of edits made to your page, including which member of our team made them and when.
2.6 Analytics, only with your consent. If you accept cookies, we load Google Analytics 4 and Microsoft Clarity. They use cookies and similar identifiers to measure visits, pages, events (such as opening a listing, filtering, searching or tapping a WhatsApp button), approximate location derived from your IP address, and device and browser information. Clarity also records how a page is used (scrolling, clicks, mouse movement) and can replay a session; text you type into forms is masked. The Meta pixel, from Meta Platforms, records that you opened a page or a listing, searched, or started an enquiry, with the listing’s or host’s id and category, so that we can measure our advertising on Facebook and Instagram and show it to people likely to be interested; Meta may link these events to a Meta account you hold, under Meta’s own privacy policy. We never send the pixel your name, phone number or e-mail, and we switch off its automatic reading of forms and buttons. Like any request from a web page, it does see the address of the page you are on, which includes any words you typed into our search box. If you reject cookies, none of this runs and no analytics or advertising request leaves your browser.
2.7 Rate limiting. To stop abuse of the contact form and enquiry endpoints we keep a short-lived counter keyed to your IP address; it expires within minutes.
We do not knowingly collect special categories of data (health, religion, etc.). Please do not include such information in a message or enquiry unless it is necessary for the host to serve you safely — in that case give it to the host directly on WhatsApp, not to us.
3. Why we use your data, and on what basis
- To operate the Service and show you listings, in the language you chose — our legitimate interest in running the Service, and where you have an account, our contract with you.
- To pass your enquiry to the host and to let the host recognise it — steps taken at your request before any agreement with the host, and our legitimate interest in showing hosts that Exploras works.
- To reply to your messages and support requests — our legitimate interest in answering you, and where relevant our contract with you.
- To run your account, save your favourites and secure your login — our contract with you.
- To create, verify and keep host pages accurate, and to contact hosts about their listings and the quality of their service — our legitimate interest in running a reliable directory, and the host’s agreement to be listed.
- To measure how the Service is used and improve it — your consent for analytics cookies; our legitimate interest for the cookieless page counter and server logs.
- To measure and target our advertising on Facebook and Instagram — your consent for advertising cookies.
- To prevent fraud, spam and abuse and to keep the Service secure — our legitimate interest and, where applicable, legal obligations.
- To comply with the law, respond to lawful requests and establish, exercise or defend legal claims — legal obligation and legitimate interest.
Where we rely on legitimate interests we have balanced them against your rights; you can object at any time (section 8). Where we rely on consent, you can withdraw it at any time without affecting what was done before.
5. How long we keep it
- Enquiry records (section 2.2): 24 months from the enquiry, then deleted or anonymised. Aggregated counts are kept indefinitely.
- Contact-form messages: 24 months from our last exchange with you.
- Account data: for as long as your account exists, then deleted within 30 days of your request to close it, except for records we must keep by law.
- Favourites: until you remove them or close your account.
- Host pages and internal host notes: for as long as the business is listed, then up to 24 months for records of past enquiries and edits.
- Server logs and rate-limit counters: logs for a short period set by our hosting provider (typically days); rate-limit counters expire within minutes.
- Page-view counters: indefinitely (they contain no personal data).
- Analytics data: as set in Google Analytics (currently 14 months for user-level data), Microsoft Clarity (up to 12 months) and Meta (as set by Meta for pixel events).
- E-mails and messages exchanged with hosts and travellers by our team: as long as needed for the purpose, generally no more than 36 months.
Backups may retain copies for a further short period before they are overwritten. Where a legal claim or an authority’s request requires it, we keep data for as long as necessary.
7. International transfers
Our database, file storage and hosting are located in the United States, and several of the providers in section 4 process data there or in other countries outside the Dominican Republic. If you are in the European Economic Area, the United Kingdom or Switzerland, transfers of your data to those countries rely on the providers’ certification under the EU-U.S. Data Privacy Framework where available, and otherwise on standard contractual clauses approved by the European Commission or equivalent safeguards. You can ask us for details of the safeguards used.
8. Your rights
Under Dominican Law 172-13 you have the right to access the personal data we hold about you, to have it corrected, to have it deleted (“cancelled”) and to object to its processing. If the GDPR or similar law applies to you, you additionally have the right to restrict processing, to receive your data in a portable format, to withdraw consent at any time and to lodge a complaint with the data-protection authority of your country of residence.
- To exercise any right, write to contacto@exploras.do or use the contact form. Tell us which right you are exercising and, so that we can find your records, the e-mail address, name or listing involved.
- We may ask you to confirm your identity before acting, and we will respond within 30 days. We do not charge for a request unless it is manifestly unfounded or excessive.
- Account holders can also update their name from their account settings; to change the e-mail address on an account, write to us.
- Hosts can ask at any time to correct, take control of or remove their page (see section 9).
9. Hosts: public information and public sources
A host page is public by design: its purpose is to let travellers find and contact your business, and the business name, WhatsApp number, description, photos, prices and Google rating on it are published for everyone to see, including search engines. Where we created a page from public sources before you asked us to, we did so on the basis of our legitimate interest in providing a complete directory of the peninsula and of the information you had already made public. You can at any time ask us to correct the page, to take control of it, or to remove it, by writing to host support on WhatsApp (number in the footer), to contacto@exploras.do or through the contact form. We will act within a reasonable time, and search engines and cached copies may take longer to update. Ratings and review counts come from Google; to change or remove a review, contact Google.
If you are a host, we also keep a record of your acceptance of the Host Agreement — the account, the business, the version, the date and time, your IP address and browser — as evidence of the contract, for as long as you are listed and for 5 years afterwards. If you offer boat, sea or transport services, the licence and insurance documents you upload are stored privately, seen only by our team to check that they are current, never published, and kept while you are listed and for up to 24 months afterwards.
10. Security
All traffic to the Service is encrypted (HTTPS). Passwords are stored only as hashes. Our database enforces row-level access rules so that each account can only reach its own data, and our staff’s access to the administration panel is limited to what their role requires and logged. Public forms are rate-limited and protected against bots. No system is perfectly secure, and we cannot guarantee that unauthorised access will never occur; if we learn of a breach affecting your data, we will inform you and, where required, the authorities.
11. Children
The Service is not directed at people under 18, and we do not knowingly collect personal data from them. If you believe a child has given us data, write to us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. If a change materially affects how we use your data we will draw attention to it on the Service or by e-mail where we have your address. The current version always applies.
13. Contact
For any question, request or complaint about your personal data, write to contacto@exploras.do or use the contact form. Hosts can also reach host support on WhatsApp at the number shown in the footer.
This policy is also published in Spanish and French. If the versions differ, the English version prevails.