Back to home

Legal

Privacy policy

Your data is yours. Here we tell you, plainly, what information we collect, what we use it for, who we share it with, how long we keep it and how you can exercise your rights.

Last updated: October 4, 2026

This is a translation for convenience. If there is any difference, the Spanish version prevails.

1. Who is responsible

The controller of your data is Timbre, domiciled in Esmeraldas, Ecuador. This policy applies to the customer app, the rider app, the business web panel and this website.

We process your data under Ecuador's Organic Law on Personal Data Protection (LOPDP) and its regulations.

2. Data we collect

We collect only what is needed for Timbre to work, depending on how you use the platform.

If you are a customer

  • Name, email, phone number and profile photo if you choose to upload one.
  • Saved addresses, with their name (for example, Home or Work), reference and coordinates.
  • Order history, items, amounts, payment method, ratings, reviews and support messages.
  • The ratings riders give you when they deliver an order: stars, tags and comment. You see your average once you have at least 5; only our team sees the details, to review problems.
  • For parcels: description and optional photo of the package, and the pickup and delivery points.

If you are a rider

  • Name, ID number, phone, email and profile photo.
  • Documents: ID card, driver's license, vehicle registration, criminal record certificate and vehicle type.
  • Sign-up selfie and facial verification selfies (see section 3).
  • Location during your shift and your orders, completed deliveries, earnings, balance, goals, ratings and delivery photos.

If you have a business

  • Business data: name, category, address, location, hours, phone, social media, photos, menu and promotions.
  • Owner data: name, both sides of the ID card, photo of the tax ID (RUC) and a selfie holding the ID card.
  • Bank accounts or QR codes to receive transfers, wallet transactions, debt and membership payments.

From everyone

  • Technical device data needed to send notifications and keep your session open.
  • Your preferences in the app, such as light or dark mode and language.
  • Your card details are processed directly by the payment gateway. We do not store your full card number.

3. Biometric and sensitive data

To protect everyone, riders confirm their identity with a selfie when signing up, which we compare with their ID card. Later we may ask for verifications when starting a shift or at random; before enabling them we will let you know and ask for your consent. Facial features are biometric data, which the LOPDP considers sensitive data.

  • We only process them with your express consent, which we ask for separately and clearly before the first verification.
  • We use them only to confirm that the person using the account is you. Never for advertising or other purposes.
  • Images and documents are kept in private storage with restricted access. They are never public.
  • You can withdraw your consent at any time. Since facial verification is needed to deliver safely, without it you will not be able to receive orders as a rider.

The same applies to the selfie with ID card uploaded by business owners: it is used only to verify their identity and is kept private.

The criminal record certificate is used only to evaluate your rider application and is kept private.

4. Location

  • Customers: we use the address you choose to calculate the delivery fee and deliver your order. If you give us permission, we use your phone's location to place you on the map faster.
  • Riders: while you are online or have an order in progress, we record your location to assign you nearby orders and so the customer can see where you are. When you go offline, we stop recording it.
  • Tracking by link: when this feature becomes available, if you share your order link, whoever opens it will be able to see the rider's location on the map only while the order is in progress.
  • Live locations are deleted automatically a few hours after the order ends.

5. What we use your data for

  • Creating and managing your account.
  • Processing orders and parcels, calculating prices, connecting customers, businesses and riders, and coordinating delivery.
  • Verifying the identity of businesses and riders and keeping the platform safe.
  • Processing payments, memberships, commissions, balances, withdrawals and sales reports.
  • Sending you notifications about your orders, your account and your membership.
  • Handling complaints, appeals, emergencies and support requests.
  • Managing ratings, goals, coupons, badges and promotions, and reviewing low ratings with both parties.
  • Preventing fraud, misuse and the shipment of prohibited items.
  • Complying with legal, accounting and tax obligations.
  • Improving the service with general statistics.

If at some point we want to send you promotions, we will ask you and you can stop receiving them whenever you want.

6. Legal bases

We process your data on one of these bases provided by the LOPDP:

  • Performance of the contract: what is needed to provide the service you accepted in the terms and conditions.
  • Consent: for biometric data, phone location and promotional communications. You can withdraw it at any time.
  • Legal obligation: to comply with tax and accounting rules or requests from authorities.
  • Legitimate interest: to prevent fraud and protect users, always respecting your rights.

7. Who we share your data with

We do not sell your data. We only share it when needed for the service to work:

  • With the business: your name, your order, your notes and what is needed to prepare it.
  • With the rider: your name, the delivery address with its reference and what is needed to deliver your order.
  • With the customer: if you are a rider, your name, photo, rating, vehicle and location while you deliver their order.
  • With providers: companies that provide us with data hosting, payments, email and notification delivery and identity verification. They only access what is needed and are required to protect it.
  • With authorities: when the law requires it or a competent authority orders it.

A business's public profile (photos, description, hours, location, menu and reviews) is visible to anyone using the app.

8. International transfers

Some of our providers store information on servers located outside Ecuador. When that happens, we work with providers that offer adequate protection guarantees, under the LOPDP.

9. Retention and deletion

We keep your data only as long as needed:

  • Orders: kept for complaints, wallet, reports and tax obligations. In the app you see those from the last 3 months; older ones are archived.
  • Rider live locations: deleted automatically a few hours after the order ends.
  • Delivery photos: deleted after 60 days, unless the order has an open complaint.
  • Notification log: deleted after 90 days.
  • Verification documents and biometric data: while your account is active and, afterwards, only as long as needed to handle complaints or comply with the law. Then they are deleted.
  • Account: if you ask to delete it, we delete or anonymize your data, except what the law requires us to keep.

10. Security

We protect your information with encrypted connections, access control by user type, private storage for sensitive documents and photos, two-step verification for administration accounts and a log of actions taken from the panel.

No system is infallible. If an incident affecting your data occurs, we will let you know and notify the authority within the deadlines set by law.

11. Your rights

Under the LOPDP, you can ask us at any time for:

  • Information and access: to know what data of yours we hold and how we use it.
  • Rectification and update: to correct incorrect or incomplete data.
  • Deletion: to delete your data when it is no longer needed.
  • Objection: to stop using your data for certain purposes.
  • Portability: to receive your data in a commonly used format.
  • Suspension of processing: to pause its use while a request is resolved.
  • Not being subject to automated decisions: to ask a person to review a decision that affects you.
  • Withdrawing your consent: without affecting what was done before.

Write to our privacy email from your account's email. We may ask you to confirm your identity. We reply within the legal deadlines, which are generally 15 days.

If you are not satisfied with our reply, you can file a complaint with the Superintendency of Personal Data Protection.

How to delete your account

  1. In the Timbre or Timbre Rider app, go to Profile and tap Delete my account.
  2. If you no longer have the app, write to our privacy email from your account's email with the subject “Delete my account”.

We delete or anonymize your name, phone, addresses, photos and documents. We keep only what the law requires, such as the record of paid orders, without your contact details. If you have orders in progress, balances or pending refunds, we close them with you first. We reply within 15 days at most.

12. Minors

Timbre is intended for people over 18. To be a rider or register a business, you must be of legal age. If we detect an account belonging to a minor without authorization from their guardian, we deactivate it.

13. This website

This site does not use tracking or advertising cookies. To display the typography, a font is loaded from an external service, which may receive technical data from your connection, such as your IP address. If you write to us by WhatsApp or email, we use your data only to reply to you.

14. Changes to this policy

If we make important changes, we will let you know in the app or by email before they take effect. You will always see the date of the last update at the top of this page.

15. Contact

For any question about your data, write to our privacy email. You can also write to us on WhatsApp.