Privacy Policy
Effective: 2026 · Last updated: 2026
Applies to buzzcentroamerica.com and every interactive tool hosted on the site.
The short version
-You don’t need an account or a login to use this site.
-We don’t sell your personal information for money.
-The travel tools (itinerary generator, currency converter) send what you type to an artificial intelligence service to build your answer. Those requests leave El Salvador and travel to the United States.
-We don’t ask for your name, phone number, address, or payment details to use the free travel tools. Please don’t type them in.
-If you buy a product from our shop, we do need your name, shipping address, and email to make and ship the order u2014 see "Purchases from our store" below.
-You can ask us to show you, correct, or delete your data by writing to info@buzzcentroamerica.com
Who this policy covers
El Salvador: the Personal Data Protection Law, Legislative Decree No. 144 of November 12, 2024. This document serves as the privacy notice its Article 24 requires.
European Economic Area and United Kingdom: the General Data Protection Regulation (GDPR / UK GDPR) and cookie rules.
United States: state consumer privacy laws, including California’s (CCPA/CPRA), and the federal Children’s Online Privacy Protection Act (COPPA).
What we collect
Like any website, our servers and our security provider automatically log:
Your IP address, which can indicate your approximate country or city but never your exact location.
Browser type, operating system, and language setting.
Pages viewed, date and time, and the page you arrived from.
Technical security data, such as automated or abusive access attempts.
What you type into the interactive tools
Itinerary genration, currency exchange converter.
These fields are built so they never need personal information. Please don’t type your name, email, phone number, ID number, health details, or payment information into these tools. If you do so anyway, that text gets processed like the rest of your request.
What you give us on purpose
Email: if you write to us, we keep your message and address so we can reply.
Article comments: name or handle, email address, IP address, and the comment itself.
Newsletter: email address and a record of when you consented.
Purchases from our store
We sell print-on-demand travel merchandise (mugs, apparel, and similar products) through our online shop. When you place an order, we collect your name, shipping address, email address, and the products you ordered.
We share the order and shipping details necessary to produce and ship your item with Printify, our print-on-demand production and fulfillment partner (United States). Payments are processed by PayPal; we never see or store your full card or account number u2014 PayPal handles that directly.
We use this information only to fulfill your order, provide shipping updates, and handle any related customer service, returns, or legal/tax obligations. We don’t use your order information for advertising profiling.
What we don’t collect
We don’t ask for or knowingly process sensitive personal data — religious beliefs, ethnic origin, political or union affiliation, sexual orientation, physical or mental health, biometric or genetic data. We don’t collect precise geolocation. We don’t process payments on this site, so we never see card or account numbers.
Why we use your data
Article 24 of the Salvadoran law requires us to state the legal basis for each use. This table lays it out alongside the equivalent GDPR basis:
| Purpose | Data used | Legal basis (GDPR) | Legal basis (El Salvador) |
| Serving the site and keeping it working | Technical browsing data | Legitimate interest (Art. 6(1)(f)) | Legitimate interest (Art. 5(g)(6)) |
| Generating the answer you asked a tool for | What you type into the form | Consent (Art. 6(1)(a)), given when you submit | Express consent (Arts. 26 and 27) |
| Protecting the site from abuse, spam, and attacks | IP address, technical data, usage frequency | Legitimate interest (Art. 6(1)(f)) | Legitimate interest |
| Understanding which content is useful and improving it | Aggregated usage statistics | Consent for analytics cookies; legitimate interest if anonymous | Consent |
| Replying to your email or comment | Email, name, message content | Legitimate interest (Art. 6(1)(f)) | Relationship arising from your request (Art. 28(f)) |
| Sending the newsletter | Email address | Consent (Art. 6(1)(a)) | Express consent |
| Supporting the site through ads and affiliate links | Advertising cookie identifiers | Consent (Art. 6(1)(a)) | Express consent |
| Fulfilling store orders (Printify print-on-demand products) | Name, shipping address, email, order details | Contract performance (Art. 6(1)(b)) | Contract performance (Art. 26) |
| Meeting legal obligations and responding to authorities | Whatever applies | Legal obligation (Art. 6(1)(c)) | Legal obligation (Art. 5(g)(3)) |
How we use artificial intelligence
We want to be blunt about this, because it’s the point where your data leaves our direct control.
The site’s travel tools generate their answers using a language model from Anthropic PBC (Claude), a company based in the United States. Here’s the path your request takes:
You submit the form from your browser.
Your request reaches our automation server, hosted in USA.
That server builds a prompt and sends it to Anthropic’s application programming interface.
The generated answer comes back to your browser.
What matters here:
The text you type into the form is transmitted to Anthropic as part of the request.
Under Anthropic’s commercial terms in effect when this document was published, content sent through their interface isn’t used to train their models. You can review their terms at anthropic.com/legal/privacy.
AI-generated answers can be wrong. They’re reference suggestions, not travel, financial, immigration, or legal advice. Check prices, entry requirements, and safety conditions with official sources before you make decisions.
We don’t use artificial intelligence to make automated decisions that produce legal effects for you or similarly significant consequences.
Article comments: name or handle, email address, IP address, and the comment itself.
Newsletter: email address and a record of when you consented.
Cookies and storage on your device
We use cookies and equivalent technologies, including your browser’s local storage. Here are the categories:
| Vendor | Role | Location |
|---|---|---|
| GoDaddy | Website hosting and domain registration | United States |
| Cloudflare | Security, content delivery, and abusive traffic filtering | Global network |
| DigitalOcean | Server running our automation engine | United States |
| Anthropic PBC | Generating the travel tools’ answers | United States |
| Google Site Analytics | Usage statistics | United States |
| Get Your Guide | Advertising and commissions | Germany |
| Printify | Print-on-demand production and shipping of store products | United States |
| PayPal | Payment processing for store purchases | United States |
International transfers
We operate from El Salvador, but our vendors are mostly in the United States. That means your data crosses borders.
From El Salvador: under Article 44 of the Personal Data Protection Law, we require our vendors to provide protections no weaker than Salvadoran law demands, and by submitting a form you give us your prior consent for that transfer.
From the European Economic Area and the UK: transfers to the United States rely on Standard Contractual Clauses approved by the European Commission, on the EU–U.S. Data Privacy Framework where the vendor is certified, or on your explicit consent to use the tools.
Write to us if you’d like more detail on these safeguards.
How long we keep things
Read the following
| Data | Retention period |
| Server and security logs | Up to 30 days |
| Requests submitted to the tools | Up to 7 days in the automation engine’s execution logs, then deleted automatically |
| Emails you send us | 24 months from our last exchange |
| Article comments | As long as the article stays published, or until you ask us to remove it |
| Newsletter subscription | Until you unsubscribe, plus 12 months of consent records as proof |
| Store orders (shipping address, order details) | As long as needed to fulfill the order plus applicable tax/accounting retention periods (typically up to 5 years) |
Security
We apply reasonable technical and organizational measures to protect information:
TLS encryption in transit across the whole site and every call to our services.
The automation engine isn’t exposed directly to the internet. It’s reachable only through a reverse proxy with a valid certificate.
Third-party service keys are stored as encrypted credentials, never in code visible to your browser.
Abusive traffic filtering and request rate limiting.
We collect as little data as possible, which is the most effective protection there is.
No system is completely secure. We can’t absolutely guarantee the safety of information transmitted over the internet.
Your rights
If you’re in El Salvador — ARCO-POL rights
The Personal Data Protection Law gives you seven rights:
Access: find out what data of yours we hold and why.
Rectification: correct data that’s inaccurate, incomplete, or out of date.
Cancellation or erasure: ask us to delete your data.
Objection: ask us to stop processing it, including building commercial profiles.
Portability: receive your data in a structured, machine-readable format.
Erasure from public view: ask us to remove data published online and to have it dropped from search engine results.
Restriction: ask us to limit processing while a dispute is resolved.
Exercising these rights is free. We’ll respond within twenty business days, extendable by another twenty business days for good cause. You can also withdraw your consent at any time; withdrawal takes effect within five business days and isn’t retroactive.
If you’re in the European Economic Area or the United Kingdom
Under the GDPR you have the right to access, rectify, erase, restrict processing of, object to, and port your data. Where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. We’ll respond within one month, extendable by two additional months for complex requests.
You have the right to lodge a complaint with the supervisory authority in your country of residence.
If you’re in the United States
Depending on your state of residence, you may have the right to know what categories of personal information we collect, request a copy, correct it, delete it, avoid discrimination for exercising these rights, and appeal if we deny your request. We’ll respond within 45 days, extendable by another 45 days.
Over the past twelve months we’ve collected these categories of personal information, for the purposes described in Section 4: online identifiers (IP address and cookie data), internet activity (pages viewed and requests submitted to the tools), coarse geolocation inferred from IP address, and, if you email us or comment, contact details. We don’t collect sensitive personal information as those laws define it.
Sale and sharing. We don’t sell personal information for money. That said, if we have advertising or affiliate programs running, the use of advertising cookies may count as a “sale” or as “sharing for cross-context behavioral advertising” under California law. You can opt out:
By rejecting advertising cookies [in our consent banner / through your browser settings].
By turning on the Global Privacy Control signal in your browser. We treat it as a valid opt-out request.
By emailing us with the subject line “Do Not Sell or Share My Personal Information.”
You may designate an authorized agent to submit requests for you. We’ll ask for proof of that authorization.
Children
This site is meant for adults. We don’t knowingly collect data from children under 13, or under 16 in the European Economic Area. Where minors are involved, we apply the progressive exercise of rights and the best interests of the child that Salvadoran law requires.
If you’re a parent or guardian and believe a child in your care gave us personal information, write to us and we’ll delete it.
Security incidents
If we detect a breach affecting your personal data, we’ll notify the State Cybersecurity Agency, the Attorney General’s Office, and the people affected within 72 hours of becoming aware of it, as Article 25 of the Salvadoran law requires. Under the GDPR we apply the same deadline for notifying the competent supervisory authority.
The notice will describe the nature of the incident, which data was involved, what you can do to protect your interests, and where to get more information.
External links, advertising, and affiliates
Our articles link to third-party sites: hotels, airlines, tour operators, and booking platforms. We don’t control those sites and aren’t responsible for their privacy practices. Read their policies before handing over information.
Affiliate disclosure. Some links are affiliate links. If you book or buy through them, we may earn a commission at no extra cost to you. This doesn’t change what we recommend or what you pay. When you click one of these links, the destination site may set a cookie to credit the commission.
Changes to this policy
We may update this document when our tools, our vendors, or the applicable law change. The last updated date always appears at the top. If a change is substantial, we’ll post a visible notice on the site’s homepage for at least thirty days [and email newsletter subscribers, if applicable].
Contact
Email: info@buzzcentroamerica.com