Privacy Policy

Ciudad Viva is an independently operated project and, as of the date of this policy, is not incorporated as a company and has no legal name or tax ID (RUT) of its own. Until that changes, the point of contact for any matter related to the processing of your data is contacto@ciudad-viva.cl. If Ciudad Viva becomes a formal entity in the future, this section will be updated with its legal name, tax ID and registered address.

• Visitors: anyone who browses the site or uses the app without creating an account.
• Registered users: people who create an account to publish events, plan outings or manage an organization.
• Organizations: people or entities that create and manage an organization profile.
• People invited to a plan: people whose email a user entered to invite them, whether or not they have a Ciudad Viva account (see section 3.5).
• Newsletter subscribers: people who provide their email to receive news, with or without an account.
• People who write to us: anyone who uses the contact form or exercises their rights.

3.1 If you only visit the site or the app

The analytics providers we use (see section 7) may automatically process certain technical information —such as device and browser type, pages or screens visited, time of use and general interaction data— as part of their own services. Ciudad Viva does not store your IP address, your geolocation, your browsing history or session recordings. Our technical access logs do not store emails or access tokens: they are masked before being logged.

3.2 If you create an account

We ask for your name, email and password. Your name and email are stored encrypted and your password is stored with an irreversible hashing algorithm: it is neither visible nor recoverable by our team. You can optionally add a profile picture. We use this data to authenticate you, let you publish and manage events, plans or organizations, recover your password (single-use link with limited validity) and send you notifications about your activity on the platform.

You can download a copy of your data or delete your account at any time from My data (in the app: Account → My data). Details on what is deleted and what is kept are in Data deletion.

3.3 If you create or manage an organization

We distinguish two types of information: your personal account (name, email) is linked as an administrator or member with an access role; and the organization's public information —name, logo, description, links, social media and a contact email you define— is shown publicly because its purpose is for the public to know about it and contact it. We don't ask for a tax ID or physical address to create an organization. If you use your personal email as the organization's contact, it will be publicly visible; we recommend using a dedicated email. You can delete the organization at any time from its settings: it is hidden immediately (see section 13 for the permanent deletion period). The credentials of the integrations you set up (for example, access keys to other systems) are stored encrypted.

3.4 If you publish events or content

When creating an event you can enter a title, description, date and time, location (with approximate geolocation for the map), price or free admission, an image, an optional external link and, if applicable, the name of whoever organizes the event. This content is public by design: do not include anything you consider confidential in an event. The only non-public information associated with it is the account that created or edited the event, used internally for traceability and moderation. You can delete your own events at any time; deletion is immediate and permanent.

If you use the AI assistant to create an event, the text you write is sent to Google (Gemini API)to generate a proposed title, description and category that you review before publishing. Do not include third parties' personal data in that text. The assistant does not make any decision about you.

3.5 Plans and invitations

A plan is a private invitation to an event or movie that you put together for your friends. We store its date, time, title and note, and the emails of the people you invite. You provide those emails, not their owners: by inviting, you declare that you know those people and that they agree to receive the invitation. We use them only to send them that invitation and, if they have an account and accept, the reminders you turn on. We store them encrypted, never use them for advertising or add them to any list, and automatically delete them 30 days after the date of the plan (or immediately if the plan is deleted).

If you received an invitation, the email tells you who invited you and includes a link to remove yourself from the plan and delete your email instantly, without needing to create an account. Other invitees cannot see your full email.

3.6 Viva Cine

To show you where to watch a movie, we infer your country on your own device (from its time zone or language), without sending your IP address or location to anyone; you can change it manually. Movie searches are sent to TMDB (The Movie Database) without any data that identifies you. Movie and platform availability data come from TMDB and JustWatch.

3.7 Suggestions board

If you post a suggestion, its title, description, your name and your profile picture are shown publicly on the board. Votes are anonymous to other users. If you delete your account, your suggestions remain but without your name or picture.

3.8 Contact form and rights requests

If you write to us, we process your name, email and message only to reply to you. The message is sent to our contacto@ciudad-viva.cl inbox through our email provider; we don't store it in the platform's database.

3.9 Notifications

We show you notifications within the platform (for example, when someone invites you to a plan or an integration finishes syncing). If you accept push notifications in the app, we store your device's notification identifier to send them to you; you can turn them off at any time from your phone's settings.

Events go through a review status (pending, approved or rejected) before being published, unless they come from an organization marked as “verified”, in which case they are published automatically. Verification is granted manually by the Ciudad Viva team after a review and is shown as a badge on the organization's profile. It indicates that we reviewed its legitimacy at the time it was granted; it is not a permanent guarantee and does not certify the accuracy of every future event. We may hide, correct or delete content that breaches our Terms and Conditions.

If you subscribe to our newsletter we store your email and, optionally, your name —both encrypted— solely to send you news about events and the platform. Emails are sent through Brevo, our email delivery provider, which only receives your address to send them.

Every email includes a one-click unsubscribe link: when you unsubscribe, we delete your email and name from our systems immediately.

• Google Analytics 4 (site and app): we use it to analyze traffic, visits, pages and general events and interactions with Ciudad Viva. It does not receive your name, email or your Ciudad Viva account identifier.
• Microsoft Clarity (site and app): we use it to analyze behavior and interaction, with the highest masking level available by default — content entered by users and sensitive text are not visible in session recordings. It does not receive your name, email or your Ciudad Viva account identifier.
• Firebase Analytics (mobile app only): general app usage metrics and events, such as screens visited or interactions with events. It does not receive your name, email or your Ciudad Viva account identifier.

We use these tools' default data retention settings; we have not customized them. None is used for advertising purposes or to sell you personalized ads within Ciudad Viva.

You can block or delete these cookies from your browser settings; blocking the analytics ones doesn't prevent you from using the platform. We currently don't have a cookie preferences panel on the site.

We do not sell your personal information or share it for advertising purposes. To operate Ciudad Viva we use providers that process data on our behalf, only to the extent necessary to provide their service:

• Hosting of the website and the server/API, including the database where accounts, organizations, events and plans are stored (personal data, encrypted).
• Storage of images you upload to events, organizations and profiles.
• Brevo: email delivery (password recovery, plan invitations and reminders, notifications, newsletter, replies to the contact form and to rights requests, and the copy of your data if you request it by email).
• Expo: delivery of push notifications and mobile app updates.
• Google (Gemini API): only the text you write in the AI assistant to create events.
• TMDB: movie searches, without data that identifies you.
• Google Analytics, Microsoft Clarity, Firebase Analytics: analytics (see section 7).
• OpenStreetMap: conversion of addresses to coordinates; it only receives the text location you enter when creating an event.

We can give you the specific details of each provider if you need them to exercise your rights. We would only hand over information to authorities when required by law or a court order.

Several of these providers have their servers outside Chile (mainly in the United States and the European Union), so your information may be processed there. We choose well-known providers that apply their own security measures and, in addition, the personal data we keep in our database travels and is stored encrypted.

In addition to content published directly by users and organizations, Ciudad Viva automatically incorporates events publicly available on the websites of municipalities and cultural bodies of the Santiago Metropolitan Region. From these sources we only collect data about the event itself (title, date, place, image, description); we do not extract third parties' personal data from them.

• Names and emails of users, subscribers and invited people are stored encrypted (AES-256-GCM); searches are made on an index that doesn't reveal the data.
• Passwords are stored with an irreversible hash; integration credentials, encrypted.
• Connections to the site, the app and the API use HTTPS.
• Technical logs don't store emails or access tokens.
• Access to administrative functions is restricted by role.

No system is infallible. If a security incident affecting your data occurred, we would notify the competent authority and the affected people in the cases and within the time limits set by law. If you find a vulnerability, report it to contacto@ciudad-viva.cl.

• User account: while it is active. When it is deleted (instantly from My data, or upon request within 30 calendar days) we delete or anonymize your identifiable data; technical security logs are kept for up to 6 months.
• Emails of people invited to a plan: up to 30 days after the date of the plan, or until the plan is deleted or the person removes themselves.
• Organization deleted by its administrator: hidden immediately and permanently deleted, together with its events, within the following 30 days.
• Past events: automatically marked as inactive but not deleted; we keep them indexable to avoid broken links in search results and links already shared.
• Internal notifications: up to 180 days.
• Newsletter: while you are subscribed; when you unsubscribe, it is deleted immediately.
• Contact messages and rights requests: in our email inbox, for as long as needed to reply and keep a record of how they were handled.
• Analytics data: according to each tool's default retention settings.

You have the right to:

• Access: know what data of yours we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: have us delete your data.
• Objection: have us stop processing your data for a specific purpose.
• Portability: receive your data in a structured, commonly used format.
• Restriction: have us temporarily suspend processing while a request is resolved.

How to exercise them:

• Instantly, from your account: in My data you can download a copy of your data (access and portability) and delete your account (erasure); you can correct your name and picture in your profile.
• By request: for any right, use the contact form choosing the request type, or write to contacto@ciudad-viva.cl. We'll send you an acknowledgment and reply within 30 calendar days at most. We may ask you for information to verify your identity before replying.
• People invited to a plan: can remove themselves and delete their email instantly with the link included in the invitation.

Exercising these rights is free of charge. If you believe we did not handle your request properly, you can file a complaint with the Personal Data Protection Agency once it begins operating under Law No. 21,719.

We do not make decisions about you based solely on automated processing, nor do we build profiles that affect you. The AI assistant only suggests text that you review and decide to publish.

Ciudad Viva is not specifically aimed at minors and we currently don't verify the age of those who create an account. As the platform shows events open to the general public —many of them family events—, minors may browse the catalog without needing an account. If we become aware that an account was created by a minor without the corresponding authorization, we will delete it at the request of their legal representative.

Events may include links to ticketing sites, social media or other third-party platforms. Those sites have their own privacy policies; we are not responsible for and do not control how they process data.

We may update this policy when our practices or the applicable law change. The last updated date appears at the top of the document. If the changes are substantial, we will try to give visible notice on the platform.

For questions about this policy or to exercise your rights, write to us at contacto@ciudad-viva.cl or use the contact form.