Mora — Privacy Policy

2. Argentine privacy-law framework

This Policy is written to be consistent with Argentina's personal data protection framework, principally Ley 25.326 (Ley de Protección de los Datos Personales) and its implementing regulations, as enforced by the Agencia de Acceso a la Información Pública (AAIP). Where Mora processes personal data in connection with users, operators, or activity located outside Argentina, additional local requirements may also apply.

3. Categories of personal data processed

Depending on how Mora is used, the following categories of personal data may be processed: account and contact information (such as name, email, and phone number); operator or business information (such as legal name, tax identifier, and business address); agency or reseller information; passenger or participant information associated with a booking; booking information; technical and security information (such as IP address, device, and access logs); and identifiers or status information related to a distribution channel or integration you connect.

Mora does not intentionally request sensitive personal data (such as health, biometric, or similarly protected categories) unless legitimately required for a specific, supported function. If you do not need to, please do not enter sensitive personal data into Mora.

4. Purposes of processing

Personal data is processed to: provide and operate the Service; process and manage bookings; create and manage accounts; maintain security and prevent fraud; send transactional and, where authorized, marketing communications; improve and maintain the Service; comply with legal obligations; and enable the distribution channel connections an operator chooses to authorize.

5. Legal grounds / authorization for processing

Processing is carried out, as applicable, on the basis of: your consent (for example, for marketing communications); performance of the contract under which the Service is provided (for example, to create bookings); Mora's legitimate interest in operating, securing, and improving the Service; and compliance with legal obligations.

6. Operator/customer/passenger data relationship

When an operator or agency uses Mora to manage its own customers' or passengers' personal data, Mora generally acts as the technological infrastructure processing that data on the operator's or agency's behalf and at their direction, rather than as the party determining why that data is collected. The operator or agency is responsible for ensuring that any passenger or customer personal data it introduces into Mora was collected lawfully and is processed with a valid basis, including any notices or consents owed directly to its own customers.

7. Recipients and service providers

Personal data may be shared with service providers Mora engages to operate the Service, such as hosting and infrastructure providers, database providers, communications and email providers, and monitoring or security tools. Where you connect a payment provider (such as Mercado Pago) or authorize a distribution channel, agency, or reseller connection, relevant data is also shared with that connected third party strictly as needed to carry out the connection you authorized. Service providers are engaged to process data only as needed to provide their service to Mora.

8. International data transfers

Some of the infrastructure and service providers Mora relies on may process or store data outside Argentina. Where this occurs, Mora seeks to rely on providers with appropriate safeguards, consistent with applicable Argentine cross-border data transfer requirements.

9. Data retention

Personal data is retained only for as long as reasonably necessary for the purposes described in this Policy, for the duration of the relevant account or contractual relationship, or as required to comply with applicable legal, tax, or accounting obligations. Mora does not currently apply fixed statutory retention periods beyond what applicable law separately requires.

10. Security and confidentiality

Mora applies reasonable technical and organizational measures intended to protect personal data against unauthorized access, loss, or misuse. No method of storage or transmission can be guaranteed completely secure, and Mora does not represent that it achieves absolute security.

11. Data-subject rights

Consistent with Ley 25.326 and its Habeas Data framework, you may request access to, rectification, updating, or suppression/deletion of your personal data, and may object to certain processing, by writing to studio@andesdevelopers.com. If you believe your rights have not been respected, you may also bring a complaint to the Agencia de Acceso a la Información Pública (AAIP), Argentina's competent data protection authority.

12. Commercial communications

Where you have given marketing consent, Mora may send occasional product or commercial communications. You may withdraw that consent, and stop receiving such communications, at any time by contacting studio@andesdevelopers.com. Transactional communications necessary to operate your account or bookings are not affected by withdrawing marketing consent.

13. Cookies and similar technologies

The Mora Dashboard and widget use only the cookies and similar local storage mechanisms strictly necessary for authentication, session management, and basic security. Mora does not currently use third-party advertising or cross-site tracking cookies. If this changes, this Policy will be updated accordingly.

14. Third-party services/integrations

Where an operator authorizes a connection to a payment provider, agency, reseller, or external distribution channel, relevant data flows to that connected third party strictly to carry out the connection authorized. Those third parties process data under their own applicable terms and privacy notices, which are outside Mora's control.

15. Minors

Mora is intended for business use by adults acting on behalf of an operator, agency, or reseller, and is not directed at or knowingly marketed to minors. Passenger or participant information relating to a minor may be processed as part of booking information at the direction of the operator or agency responsible for that booking, which remains responsible for ensuring a valid basis for processing that data.

16. Security incidents

If Mora becomes aware of a security incident affecting personal data, it will assess the incident and, where required by applicable law, take reasonable steps to notify affected parties and any competent authority. Suspected incidents can be reported to studio@andesdevelopers.com.

17. Changes to the Policy

Mora may update this Policy from time to time. The "Last updated" date at the top of this page reflects the most recent version. Where a change is material, Mora will make reasonable efforts to notify affected accounts.

18. Contact

Questions about this Policy, or requests concerning your personal data, can be sent to studio@andesdevelopers.com.