Sign in Sign up

Privacy policy

Last updated: Friday 23 October 2026

1. Summary

Citauno respects your privacy. This policy explains what personal data we collect, for what purposes, who we share it with, how long we retain it, what your rights are and how to exercise them. Applies to the use of citauno.com and any related service.

2. Data controller

The controller of your personal data is Citauno, with domicile in the Republic of Paraguay. Contact: hola@citauno.com.

3. What data we collect

a) Data you give us

  • Account: first name, last name, email, password (hash), phone, WhatsApp.
  • Google profile (if you choose OAuth): verified email, name, public photo.
  • Bookings: chosen services, professional, location, date and time, notes for the business.
  • Payments: booking deposits and payments are processed by tpago (Bancard) and paid into the Business's own account; the plans Businesses buy are charged through Bancard or Stripe, depending on the Business's billing country. Citauno keeps the amount, currency, status, transaction ID and, when the processor reports them, the last 4 card digits. If a Business saves its card with Stripe to pay for its plan, we also keep the card's brand, last 4 digits, expiry month and year and Stripe's reference to the card, to show it and charge the following months. We never store the full card number or the CVV.
  • Reviews: rating, comment, optional attributes (service, professionalism, cleanliness, punctuality).
  • Business (for Businesses): legal name, billing details, locations, hours, team, services, photos.
  • Sales and receipts: when a Business charges you in Citauno, it keeps the name or legal name and the RUC, ID card or passport it invoices you under, so it doesn't have to ask again next time. That data belongs to the Business and only goes on its receipts and invoices. To complete a RUC's legal name and check digit we use DNIT's public RUC listing.
  • Our ad forms: if you fill in one of our Instant Forms on Facebook or Instagram, we receive your name, your phone or WhatsApp number and your answers to two questions about your business: what type of business it is and your role in it. Meta pre-fills the contact details from your profile, and you can correct them before sending. Meta also tells us which ad you filled it in from and when. If we then continue on WhatsApp, we also note what you tell us there about your business (section 6).

b) Data we collect automatically

  • Technical logs: IP, user-agent, timestamps, pages visited, errors.
  • Cookies and data stored in your browser (details in section 10).
  • Approximate geolocation when using "Near me" search (only with your explicit permission and only at search time; we don't store it).
  • Visit statistics for Business pages: which page you opened, which steps of the booking form you completed (never what you typed), whether there was an error and of what kind, where you arrived from (for example, Instagram or Google), your device type and your language. They are tied to a random identifier that lives only in that browser tab; we don't store your IP, your name or your account with this data.
  • Browsing and usage data collected by Google Analytics and the Meta Pixel (details in sections 6 and 10).
  • If you sign up a Business: the campaign parameters of the link that brought you to our pages (utm_*, and the click identifier, Google's gclid or Meta's fbclid), the page you landed on and, if you came from another site, which one. We keep them with the Business to know which ad or link brought it.

4. What we use your data for

  • Create and maintain your account, authenticate you and protect the Platform from fraud.
  • Process bookings and communicate them to the chosen Business.
  • Send automatic reminders by email and, when you've enabled it, by WhatsApp; and, when the Business turns on automatic sending, send you the receipt for your payment by WhatsApp.
  • Process online payments: booking deposits and payments through tpago, and Business plans through Bancard or Stripe.
  • Show your review to the Business and, once reviews are visible on Citauno, publish it on its profile (only first name + rating + comment).
  • Understand how the Platform is used and improve it: usage statistics, error prevention, monitoring and debugging.
  • Comply with legal obligations or competent authority requests.
  • Show each Business aggregate statistics about visits to its page, with no data from any individual visit.
  • Measure our advertising campaigns on Google and Meta (Facebook and Instagram); for example, how many Businesses sign up or buy a plan.
  • Contact you, if you filled in one of our ad forms, to tell you how Citauno works and help you try it.
  • Choose who sees our ads for Businesses on Facebook and Instagram, and who doesn't, with Custom Audiences (remarketing; details in section 6).

5. Legal basis

We process your data based on (i) contract execution when you book or contract a plan; (ii) your consent when you enable optional features (Near me, WhatsApp reminders) or fill in one of our ad forms; (iii) legitimate interests in security, usage statistics, service improvement, measuring our advertising and choosing who sees it; and (iv) compliance with legal obligations.

6. Who we share your data with

  • The Business you chose: receives your first name, last name, email, phone, WhatsApp, booked services, date and time, and your notes. It is the natural recipient of your booking. About visits to its page, the Business only sees totals and percentages.
  • Payment processors: tpago (Bancard), when you pay a deposit or a booking online, and Bancard or Stripe, depending on the billing country, when a Business pays for its plan; Stripe keeps the card used to pay so it can charge the following months. The full card number stays on their platforms: Citauno receives the result of each transaction and, for a card saved with Stripe, its brand, last 4 digits, expiry and Stripe's reference (see section 3).
  • Infrastructure and service providers: Amazon Web Services (hosting, database, storage and email delivery), Google Workspace (our team's email and the spreadsheet where we follow up with people who fill in our ad forms), Meta (WhatsApp Business API, for WhatsApp messages and reminders), Sentry and New Relic (error and performance monitoring) and OpenAI (machine translation of the content Businesses publish). They operate as data processors under our instructions.
  • Google: if you sign in with Google, Google gives Citauno your verified email, your name and your public photo. We also use Google Analytics (below) and Google Maps, which fills in addresses on Business forms.
  • ViaCEP: when a Business types a CEP (a Brazilian postal code) into its address, Citauno looks it up at ViaCEP to fill in the street, neighborhood and city. ViaCEP receives only that CEP, from our servers: not your IP address or any other data.
  • Competent authorities: only when there is a binding legal order.
  • Google Analytics: runs on the site and on the Business and professional dashboards. It receives the full address of the pages you visit, without the access codes some links carry (those of your bookings, invitations and password resets), which we strip before sending it, technical data about your browser and device, how you use the pages (scrolling, clicks on external links, searches, form use, videos and downloads), events such as viewing a Business page, tapping a contact button, signing up or confirming a booking (with its amount and currency), which section of the site each page belongs to and which Business it is about, if you are signed in, an internal account identifier, and what kind of visitor you are: on the team of Citauno or of a Business, a customer who booked, someone interested in using Citauno for their Business (and how far you got: seeing our pages for Businesses, the prices, contacting us or starting sign-up) or a visitor. We also mark visits from people who work at the Business they are looking at, so they are not counted as its audience. We use this data for usage statistics and to measure our advertising campaigns.
  • Google Ads: when you arrive from one of our Google ads, Google adds an identifier for that click (gclid) to the page address, and we add campaign parameters such as the campaign and the ad's keyword; Google Analytics receives them with the rest of the address. We link Google Analytics to our Google Ads account to import some of the events above as conversions, such as signing up a Business or moving through sign-up, so we know which ad, keyword or campaign brought them. Google Ads does not receive your name, your email or your phone number.
  • Meta (Facebook and Instagram): we use the Meta Pixel on the site and dashboards, and Meta's Conversions API from our server, to measure our advertising campaigns and, through the Custom Audiences described further down, choose who sees them. The Pixel receives the full address of the pages you visit, also without the access codes, and technical data about your browser; it also stores Meta cookies in your browser. If you tap Citauno's WhatsApp button on our pages for Businesses, on the contact page, in the Business sign-up or in the documentation, the Pixel also receives that tap as a contact event. When a Business signs up or pays for a plan, we send Meta that event with its amount and currency, the page address, the IP address, the user agent, the identifiers in Meta's cookies and the account email as a hash (SHA-256), never in plain text. Meta also processes this data under its own privacy policy and may link it to a Facebook or Instagram account.
  • Custom Audiences on Meta (remarketing): with the data from the Pixel and the Conversions API we build audiences inside our Meta account to show or hide our ads for Businesses. To show them we only use visits to our pages for Businesses (pricing, features, the pages for each type of business and Business sign-up) and audiences Meta builds from people who interacted with our Facebook and Instagram accounts, watched our videos or opened our form without sending it. The rest are only used to exclude people: those who already use Citauno (visits to the dashboards, Business sign-ups and plan payments), those who already sent the form and those who book or look for appointments (the booking pages, /explorar and your client account). We don't use visits to Businesses' pages or your bookings to build audiences that receive our ads. Meta does not tell us who is in an audience, and we do not upload lists of emails or phone numbers to it: not of our customers, nor of the Businesses' clients.
  • Our ad forms on Facebook and Instagram: what you fill in on an Instant Form goes first to Meta and is kept in Meta's Leads Center. Our team downloads it every day to a spreadsheet in Google Workspace that only the people on our team who follow up and Citauno's management can open. There we also note how far the contact got and what you tell us on WhatsApp about your business, such as how many professionals work there and when you'd like to start. We use this data to message you on WhatsApp, from Citauno's number, about trying Citauno, to decide whom we contact first based on your answers, and to learn which ads bring in Businesses: we compare your phone number with the Businesses that sign up on Citauno. We don't sell it or pass it on to Businesses.
  • Status of those contacts (possible, in the future): to learn which campaigns bring Businesses that actually try or buy Citauno, we may send Meta, through the Conversions API, how far each contact got (for example, whether we reached them, created a trial account or bought a plan), along with the identifier Meta gave your form and, when Meta needs it to match them, your phone number as a hash (SHA-256), never in plain text. We don't do this yet.
  • OpenStreetMap: the maps on the site (those on Business pages and the one on our contact page) are loaded from OpenStreetMap's servers, which see your IP address as with any website visit.
  • Electronic invoicing providers: if the Business you buy from connects its electronic invoicing provider (Sifende), we send it, on the Business's behalf, the sale details the invoice needs: your name or company name, your RUC or ID document, your address if you gave it, the services and products, the amounts and the payment method. The provider issues the invoice and sends it to SIFEN (DNIT).

Citauno does not sell your personal data to third parties. What Google and Meta receive is limited to what is described above.

7. International transfers

Our infrastructure is hosted on AWS (us-east-1, United States), and several providers in section 6 (Google, Meta, Stripe, Sentry, New Relic and OpenAI) process data in the United States and other countries. Therefore, your data may be processed outside Paraguay. We apply encryption in transit (TLS) and at rest (AES-256) and work with providers that offer data security and protection safeguards.

8. How long we retain your data

  • Account data: while your account is active, plus 24 months for accounting and fraud prevention.
  • Bookings: 5 years, a reasonable term for audits and disputes.
  • Payments (transaction record, not card): 10 years, per accounting and tax rules.
  • Technical logs: up to 90 days.
  • Reviews: while the Business is active, except deletion at your request.
  • Visit statistics: 13 months.
  • Data from our ad forms: we delete it from our spreadsheet 12 months after the last contact, or after 30 days if it isn't from a business or can't be used to reach you. If you set up your Business on Citauno, we keep that row of the spreadsheet while your account is active and delete it once it no longer is. Our conversation with you on Citauno's WhatsApp is deleted together with that row, under the same rules. If you want us to delete it all sooner, write to hola@citauno.com including the phone number you left, or message Citauno's WhatsApp, +595 976 130 015, from that phone number, and we delete it by the next business day at the latest.
  • Custom Audiences on Meta: each person leaves an audience at most 180 days after the last visit or interaction that added them.
  • Data in Google Analytics, Google Ads and Meta: Google and Meta keep it under their own policies and the settings on our accounts, including the copy of the forms that stays in Meta's Leads Center.

9. Your rights

You may exercise the following rights at any time:

  • Access: obtain a copy of your data.
  • Rectification: correct inaccurate data.
  • Deletion: delete your account and your data, except those we must keep by law or by an open contractual obligation.
  • Portability: receive a copy of your bookings, clients and services in a structured, commonly used format. Request it at hola@citauno.com: today the handover is assisted by our team; there is no automatic download from the dashboard.
  • Objection / restriction: to processing based on legitimate interest.
  • Withdraw consent: for optional features (Near me, email marketing, WhatsApp) and for our ad forms.

To exercise them write to hola@citauno.com from the email registered in your account. If you filled in one of our ad forms, message Citauno's WhatsApp, +595 976 130 015, from the phone number you left there, or write to hola@citauno.com including that phone number so we can find your data. We respond within 30 days.

10. Cookies and storage in your browser

We use cookies and your browser's storage for the following:

  • Necessary: keeping your session open (and keeping you signed in, if you choose that option), protecting forms, remembering your language and your time zone, the last Business you managed and, for 30 days, a promo code you opened. We also keep display preferences and the progress of some forms in your browser.
  • Your booking details: if you book without an account, an encrypted cookie keeps your name, WhatsApp, email and your latest bookings in that browser for up to 180 days, so we don't ask for them again, unless you untick "Remember my details on this device". The list of people you save on the booking form stays only in your browser: Citauno does not receive it. You can delete this data from the form itself.
  • Statistics (Google Analytics): Google cookies (_ga) that tell visits apart so we can measure how the Platform is used and how our campaigns perform, Google Ads included. Because Google Analytics is linked to our Google Ads account, the Google tag may also store Google Ads cookies (such as _gcl_au and, if you arrived from one of our ads, _gcl_aw, with that click's identifier) so we know which ad brought each sign-up. You can opt out with Google's Analytics opt-out add-on or by blocking these cookies in your browser; that also keeps your visits out of the measurement of our Google ads. We also keep in your browser, without cookies, how far you got as someone interested in using Citauno for your Business and whether you booked, so Google Analytics knows on your next visits; it goes away when you clear this site's data in your browser.
  • Advertising (Meta Pixel): Meta cookies (_fbp and _fbc) that measure which visits and sign-ups come from our ads on Facebook and Instagram, and that Meta also uses to build the Custom Audiences in section 6. You can block them in your browser. In the ad settings of your Meta account (Accounts Center) you can hide our ads and choose whether Meta uses your activity on other sites, like ours, to show you ads.
  • Visit statistics: to count visits to Business pages we keep a random identifier in your browser that is erased when you close the tab: it is not a cookie, it does not identify you and it never goes to a third party. We also don't count visits from the Businesses' own teams.
  • Where your visit came from: if you reach our pages for Businesses from an ad, a link with campaign parameters or another site, a cookie keeps those parameters (utm_*, gclid, fbclid), the page you landed on and the site you came from for 30 days. Only the Business sign-up reads it, and it stores them with the Business you create; once you have signed up, we delete the cookie.

11. Security

We apply TLS 1.2+ encryption in transit, AES-256 at rest, secrets in AWS Parameter Store, bcrypt-hashed passwords, role-based access control, daily automatic backups and log monitoring. No system is 100% secure: if you spot an issue write to hola@citauno.com.

12. Minors

Citauno is not directed to children under 13. If you are a minor, you must use the Platform under the supervision of a responsible adult.

13. Changes to this policy

We may update this policy. We will publish changes on this page and, if material, we'll notify by email.

14. Contact

Any privacy enquiry, write to hola@citauno.com.