Your privacy

1. Who is responsible

Borsap SpA, RUT 78.537.694-3, with its registered address at Irarrázaval 2401, Oficina 607, Ñuñoa, Santiago, which operates Vitrina (holavitrina.com and its app), is responsible for the data described here, under Ley 19.628 and, once it takes effect on 1 December 2026, Ley 21.719. For any question or request, write to us at [email protected]. The conditions of use are in the terms and conditions.

2. What data we keep

You don't need an account, except if you use Vitrina Live to buy, sell or write in the chat. If you create a Vitrina Live account (live selling shows), we keep what's needed for you to buy or sell:

• Your email, to sign in with a code; your username, your full name and, if you add it, your mobile number.
• The version of the terms you accepted and when you did.
• Your shipping addresses.
• Your interests and reminder preferences, only if you choose them. We use them to order the shows we show you.
• Your bids, purchases, parcels, refunds, complaints and strikes, and what you write or upload in them.
• About your cards: the brand, the last four digits, the expiry date if the processor provides it, their encrypted identifiers and the version of the authorisation you accepted. About each charge: the amount, the result and the codes the processor returns. We don't store card numbers or security codes.
• If you sell: your legal name, your RUT, your start-of-activities status or your declaration that you don't need one, your store details, your inventory with its photos, your category declarations, your commissions and charges, and the connection to your payment processor. We keep that connection's credentials encrypted. The SII's Circular 38 requires us to check sellers' start of activities and to report to the SII each year the sellers who declare they don't need one.
• In live shows: the messages you write in the chat, with your username, and when you joined and left each show (if you watch without an account, only an anonymous connection). Everyone watching the show sees the messages and your username. Stores can hide messages (we keep them anyway) and mute or block people who write them. Video travels through Stream. We record the store's video during a show only to cut a short clip of each item sold, which only that store sees; we delete the full recording as soon as the clips are cut, and each clip once the purchase can no longer be returned or reported.
• What you write to us when you ask for help.
• To limit abuse, a code derived from your IP address (not the IP itself) that changes every day and is deleted within three days. It is used only to count how many requests come from one connection.

3. What we use it for

• To perform our contract with you: your account, shows, bids and purchases, payments, shipping, complaints and notices about all of them.
• To comply with the law: tax and consumer obligations, and requests from an authority.
• For our legitimate interest: preventing fraud and abuse, protecting users and keeping the service secure.
• With your consent: usage measurement, your interests and your reminders. You can withdraw it at any time.

We make no solely automated decisions about you that have legal effects. Strikes for declined payments are recorded automatically, and you can ask a person to review them.

4. Who we share data with

We don't sell your data. We share it only in these cases:

• The store you buy from receives your name, your phone if you added it and your address, to issue its boleta and ship your order. From then on, the store answers for how it uses them and may use them only for that sale. If you sell, the buyer sees your store's name and RUT.
• Other users see your username and chat messages, and stores see who bid.
• Authorities: the SII and other authorities, when the law requires it.
• Providers that process data on our behalf:

• Railway and Cloudflare, which host and deliver the site.
• Resend, to send Vitrina Live emails.
• Stream, which carries Vitrina Live's video and real-time updates.
• Transbank, Mercado Pago and Fintoc, which process payments. They receive your card details directly from you, on their page or form; we send them your email and each charge's details and, if you sell, your store's details.
• Tupana, to issue boletas and credit notes for the stores that turn it on.
• The carriers that take your parcel, with your delivery details.
• PostHog, only if you accept measurement.

Some of these providers are outside Chile, so your data may be processed in other countries, such as the United States.

5. Usage measurement (only if you accept)

With your permission we use PostHog, a service in the United States, to understand how Vitrina is used: page views, clicks and a session recording that doesn't show what you type into forms and fully hides the shipping forms.

• Before you decide, we don't store measurement cookies or record the session; we only count anonymous events.
• If you are in Spain, those anonymous events are sent without your IP address.
• If you reject, we stop measuring. If you accept and later change your mind, we delete what PostHog kept in your browser.
• We keep a record of each decision (what you chose, when, where on the site, your approximate country, the language we asked you in and the version of this policy), without your IP address, so we can prove your consent. If this policy changes, we will ask you again.

Change my measurement choice

6. Cookies

• Your preferred language, in the vitrina_lang cookie, only if you choose one. It is a preference, not measurement.
• A random identifier in the vitrina_guest cookie identifies this browser.
• The vitrina_live_session cookie (server-only, no script on the page can see it) keeps you signed in for 30 days.
• PostHog's measurement cookies, only if you accept.

Our network (Cloudflare) tells us your approximate location so we can adapt the site; we don't look up your IP address with third parties or keep it for that.

7. How long we keep it

We keep it while you have your account and we need it for the purposes above. Help conversations are deleted after 90 days without activity. A show's chat is deleted 12 months after it ends, unless a purchase from that show has an open complaint, return or chargeback; then it is deleted once that closes. The record of who watched a show is deleted after 12 months. Orders, payments, commissions, refunds and tax documents are kept for 6 years from the end of the year they belong to, as tax law requires, and then deleted. When you delete your account we delete your data and your cards, at Vitrina and at the processor, except what tax law requires us to keep and what is needed to finish purchases under way or answer complaints. Your orders are kept without identifying you where the law allows. If you delete an account with a store, we keep its legal name, RUT, address, email and phone for 2 years after its last delivery, for its buyers' legal warranty and to answer complaints, and we don't show them publicly.

8. Your rights

You can ask for access, correction, deletion, blocking or a copy of your data, and object to its use, by writing to [email protected]. It is free and we answer within the legal time limit. If you have a Vitrina Live account, you can also download your data or delete your account from your account page. If you are not satisfied, you can complain to the competent Chilean data protection authority.

9. Security and minors

We protect your data with encryption and restricted access, though no system is completely secure. If a breach affects you, we will tell you as the law requires. Vitrina is only for people over 18 and we don't knowingly collect minors' data.

10. Changes

If we change this policy in an important way, we update the date above and tell you before the change applies.