ahora.page Privacy Policy
Last updated: November 12, 2026
1. Controller
This Privacy Policy explains how we collect, use and share personal data when you use ahora.page (the "service") and which rights you have.
The controller of your personal data is SmartReach LLC, 2880 W Oakland Park Blvd Suite 225C, Oakland Park, FL 33311, USA. For any privacy question, email support@ahora.page.
SmartReach LLC is a United States company. We apply this policy to everyone who uses ahora.page, wherever they are. If you live in Costa Rica, you also have the rights that Costa Rica's Law No. 8968 on the Protection of Individuals with regard to the Processing of their Personal Data (Ley 8968) gives you (see section 10).
2. Who this policy applies to
- Customers: people who create, claim, edit or pay for a site on ahora.page.
- Visitors: people who visit ahora.page or a site built with ahora.page.
- People who appear in Google data: for example, the authors of the Google Maps reviews and photos we show on sites.
3. What data we process and why
| Data | Where it comes from | What we use it for |
|---|---|---|
| Email address, language and, if you give it, your name | You, when you pay, claim a site or request a login link | Creating your account, confirming your email address, sending login links (including the one after payment) and service emails (for example, that a duplicate payment was refunded) |
| Login and claim links | We create them | Logging in without a password and confirming your email address. We store only a hashed version, which expires after 30 minutes, 24 hours or 72 hours |
| Site content: texts, menu, prices, colours, phone, WhatsApp, booking link and photos you upload; also the name, phone and hours from Google once you confirm or change them | You, in the editor or during setup | Showing your site. Every uploaded photo is shrunk and saved as a new JPEG, without the metadata of the original photo (such as its location). Files we can't process are rejected. We also compare the phone and WhatsApp numbers with the number in the business's Google listing; if they differ, the site goes into our review queue (protection against people pretending to be the business) |
| Payment data: customer ID at the payment provider, plan, subscription status, amount paid and currency, refund status, the language of the payment page and, if the provider sends it, the card type and its last 4 digits | Our payment processor, Stripe | Charging your plan, showing your billing and refunding duplicate payments (with a refund email in your language). The payment provider handles the full card number; we never see it |
| Own domains: domain name, the verification code for the TXT record, and DNS and certificate status | You, in the editor, and public DNS lookups | Checking that the domain is yours, connecting it and monitoring it |
| Reports about a site: reason, message, optional email address, the page the report came from, and a keyed hash (HMAC) of the IP address instead of the IP address itself | People who use the "Report this site" form | Reviewing the report, taking a site offline if needed, and spotting repeated or abusive reports |
| Technical data: IP address, browser (user agent), date and time | Your browser | Keeping your session, usage limits against abuse (per IP and per email address) and security (server logs) |
| Public business data from Google Maps: name, address, phone, hours, location, photos, rating and reviews (with the author's name, profile photo and link) | Google Places API | Building and showing the business's site. Google photos are shown only in the preview, the editor and during setup; we load them from Google each time and don't store them (only the photo's reference and its author credit, for at most 30 days) |
We don't use your data for advertising, we don't sell it and we don't build profiles. We currently send no newsletters or marketing emails.
4. Legal basis
- Your consent, which you give when you create a preview, claim a site, request a login link or pay, after reading this policy.
- The contract: we need this data to provide the service you paid for.
- Legal obligations, for example keeping billing records.
- The Google Maps data is publicly accessible information that Google makes available through its API.
5. Who we share data with (processors)
We use these providers, which process data on our behalf:
| Provider | What it does | Data |
|---|---|---|
| Payment processor: Stripe | Card payments and renewals, invoices and the billing portal | Email, payment data, subscription, billing country and address |
| Google (Places API and Maps Embed API) | Business data and the map on sites | The place ID, the search text and photo requests sent to Google. On sites, the Google map loads in the visitor's browser |
| Laravel Cloud | Servers and database | All data in the table above |
| File storage | Site photos | Photos you upload |
| Cloudflare | DNS, secure connection (HTTPS) and own domains | Visitors' IP address and technical data, domain names |
| Email provider | Sending login links and notices | Email address and message content |
We may also hand over data when the law or a competent authority requires it.
6. Where your data is processed
We are based in the United States, and we and several of our providers store and process data on servers in the United States and possibly other countries. If you use ahora.page from another country (for example, Costa Rica), your data is transferred to these countries. By using the service, you consent to this transfer, which we make only to provide the service and only with providers that commit to protecting the data.
7. How long we keep data
| Data | Period |
|---|---|
| Google Maps data (except the place ID) | 30 days at most. On published sites it is refreshed from Google; on all others it is deleted. Google photos aren't stored. |
| Google place ID | As long as the site exists |
| Unpaid preview | Goes offline after 7 days. 30 days after it was created we delete its content: texts, phone and WhatsApp numbers, menu, uploaded photos, cached Google data and its edit and claim links. We keep the site's address, the Google place ID, the link to the owner's account (if someone claimed it), payment records and reports about it, so the address isn't given to another business and for our records. |
| Account and site content | As long as your account exists. When a plan ends, the site is switched off and its content stays saved until you delete your account. |
| When you delete your account | Deleted right away: your account, login links, sessions and app logins, your sites' texts, menus, phone and WhatsApp numbers and uploaded photos, cached Google data, connected domains and your customer details at Stripe (email, name, address and saved cards). Stripe, our payment processor, keeps the charges, invoices and refunds as payment records for as long as tax law requires. Kept without your name, email address or phone number: payment records (amount, currency, plan, dates, payment provider IDs) for as long as tax law requires; each site's emptied entry (its address and Google place ID), so the address isn't given to another business; visitors' reports about the site; and a record of the deletion (date, how it was requested, counts, payment provider customer IDs) so late payment messages can be ignored. For 48 hours that record also holds a keyed hash of your email address (not the address): if a payment you started before the deletion goes through afterwards, we refund it instead of creating the account again. Then we delete the hash. |
| Billing data | As long as tax and accounting law requires. |
| Session | A session lasts 2 hours without activity. If you stay logged in, the "remember me" cookie lasts up to about 400 days or until you log out. |
| Usage limits per IP and per email address | Up to 1 hour (the daily limit on reports: up to 1 day) |
| Reports about a site | Until we have handled the report, then 12 more months (to spot repeated abuse); after that we delete the report |
| Server logs | For a limited time, as long as needed for security and troubleshooting |
8. Cookies
ahora.page uses only cookies that the service needs to work, so we don't ask for cookie consent:
- Session cookie: keeps your session, your language and access to the editor of your preview (or of a site you just claimed).
- Security cookie (XSRF-TOKEN): protects forms.
- "Remember me" cookie: keeps you logged in on that device.
- Language cookie (
lang): remembers whether you chose Spanish or English, for up to one year.
We use no analytics or advertising cookies. On customer sites, the Google map and Cloudflare may set their own cookies or similar technologies.
9. Our customers' sites
Each customer decides what to publish on their site and is responsible for that content, including any personal data they add (for example, photos of people). The sites have no forms: when a visitor taps "WhatsApp" or "Call", the conversation happens directly between the visitor and the business, outside ahora.page. Every site has a "Report this site" link to a form run by us (see section 3).
10. Your rights
You can ask us for:
- access to the data we hold about you;
- rectification of incorrect data;
- deletion of your data (for example, deleting your account) when it's no longer needed or you withdraw your consent, except data the law requires us to keep;
- and you can withdraw your consent at any time.
If you live in Costa Rica, these are also your rights under Ley 8968.
Email support@ahora.page from your account's email address. We reply as soon as possible and within the time the law requires. You can also delete your account yourself, at any time: logged in, under "My account" → "Delete my account" (ahora.page/account); without logging in, at ahora.page/account/delete (we email you a 6-digit code to confirm). Section 7 says what is deleted and what is kept. Deleting the account also cancels your plan right away, so nothing more is charged; a payment that lands while the account is being deleted is refunded.
If you live in Costa Rica and believe we haven't respected your rights, you can contact the Agencia de Protección de Datos de los Habitantes (PRODHAB).
If a review or photo of yours appears on Google Maps and you don't want it shown on an ahora.page site, email us. You can also ask Google to remove it.
11. Security
We use HTTPS, store login links only in hashed form, use no passwords, and limit access to data to the people who need it to provide the service. No system is 100% secure. If an incident affects your data, we notify you as the law requires.
12. Minors
The service is for businesses and for people aged 18 or older. It isn't aimed at minors and we don't knowingly collect data from minors.
13. Changes to this policy
If we change this policy, we publish the new version with its date. If the change is significant, we email you.
This policy is written in English. If a translation differs from the English version, the English version prevails.
14. Contact
SmartReach LLC · 2880 W Oakland Park Blvd Suite 225C, Oakland Park, FL 33311, USA · support@ahora.page