ENES
Join the waitlist

Privacy Policy

Last updated October 1, 2026

Who we are

CIRO AI (“CIRO,” “we,” “our,” or “us”) provides the CIRO platform: our website at ciroai.us, the CIRO application at app.ciroai.us, the CIRO AI mobile apps for iOS and Android, and related APIs, chatbots and integrations (together, the “Services”).

CIRO AI is operated by the company below. If the operator changes, for example when CIRO is formalized as a company in the United States, we will update this section and tell you as described in section 16.

  • Operator: CIRO Technology Labs, S.A. de C.V.
  • Address: Av. Washington, Colonia Libertad #85, Distrito San Salvador Centro, Departamento de San Salvador, El Salvador
  • Privacy requests: privacy@ciroai.us
  • Support: support@ciroai.us
  • Billing: billing@ciroai.us

For the personal information we decide how to use, such as your account, billing, website and support information, CIRO Technology Labs, S.A. de C.V. is the party responsible for it (the “controller” or “responsable del tratamiento”).

Scope of this policy

This policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have. It applies when you visit our website, create or use a CIRO account, use our mobile apps, contact us, or use a chatbot or other feature that a CIRO customer has built on the Services.

Our customers are mainly businesses. The data a customer organization puts into CIRO, such as data from the systems it connects, uploaded files, conversations with CIRO's AI assistant, dashboards, meeting recordings and the conversations of its chatbots (“Customer Content”), is processed on behalf of that organization and under its instructions, as described in our Terms of Service. If you use CIRO through your employer or another organization, or you talk to a chatbot run by a CIRO customer, that organization is responsible for how it uses your information, and requests about that information should normally go to it first. We help our customers respond to those requests.

Where the law requires your consent, we ask for it when we collect the information, for example through the cookie banner on our website, or when you create an account and accept our Terms of Service and this policy.

Information we collect

Information you give us

  • Account information. Your name, email address, password (we store only a bcrypt hash, never the password itself), profile photo if you add one, and your language and display preferences.
  • Organization information. Your organization's name and logo, and your answers to optional sign-up questions: the areas you are interested in, team size, whether you have field staff, the kinds of data sources you use, your industry and how you heard about us.
  • Teammates. The email address and role of the people you invite to your organization.
  • Billing information. Your plan, subscription status, billing contact, invoices and payment history. Card and wallet details (including Link, Apple Pay and Google Pay) are entered into and processed by Stripe; CIRO does not receive or store full card numbers.
  • Customer Content. Questions and messages you send to CIRO's AI assistant and the answers it produces; files you upload, such as spreadsheets, PDFs, Word documents and images; dashboards, notebooks, reports, analyses and apps you build in CIRO Studio; and data from the sources you connect (see section 07).
  • Meetings and voice. If your organization uses the meeting assistant: the recordings, transcripts, speaker names, summaries and action items of the meetings it joins or that you upload. If you use voice features: your voice audio and its transcription.
  • Personalization. Facts and documents you add to your profile's knowledge, and the memories CIRO creates from your conversations (see section 04).
  • Messages to us. What you send us by email, through the forms on our website or through in-app support requests, including attachments.
  • Website forms. When you request a demo or contact us on ciroai.us: your name, work email, phone number, company, job title, company size, use case, timeline and message, together with the campaign information described below.

Information collected automatically

  • Sign-in and security records. For each sign-in attempt, successful or not: the sign-in method, date and time, IP address, browser and device (user agent), and an approximate location (city, region, country and approximate coordinates) derived from the IP address. We derive this location with an offline geolocation database (DB-IP) that runs on our own servers, so your IP address is not sent to a third party for this purpose. We also keep the IP address and device of each active sign-in session.
  • Activity records. Actions taken in the Services, such as administrative changes, sharing and file access, with the IP address and user agent where available. File-access records store a hashed form of the IP address.
  • Usage records. Which features and AI models were used, and how much, so we can bill, apply plan limits and credits, and control costs.
  • Technical and error information. Browser and device type, error reports and performance measurements (see Sentry in section 06).
  • Product analytics in the web app. The web app at app.ciroai.us loads Google Tag Manager to measure how the product is used. It receives the pages you view and the features you use, together with your CIRO user ID and organization ID, and passes them to Google Analytics. It does not receive your name or email address.
  • Campaign information. If you arrive through an ad or a tracked link, we record the campaign tags (UTM parameters), ad click identifiers (such as Google's gclid, Meta's fbclid and LinkedIn's li_fat_id), the referring website and the landing page. Our website sends this with the forms you submit; the web app keeps it in a first-party cookie and in local storage for up to one year and saves it with your organization when you sign up.

Information from other sources

  • Sign-in providers. If you sign in with Google, Microsoft, GitHub, LinkedIn or Apple, we receive basic profile information from that provider, such as your name, email address, profile photo and account identifier.
  • Connected systems. When you or your organization connect a data source or app, we receive the data and metadata that the connection's permissions allow (see section 07).
  • Stripe. Payment and subscription events, such as successful or failed payments and invoices.
  • Chatbots built on CIRO. CIRO customers can publish chatbots on their websites, in Slack, in Microsoft Teams or by email. When people use those chatbots, we receive their messages. For chatbots on a website we also receive usage events (such as pages viewed and campaign parameters), any user identifier the customer supplies, and a hashed form of the IP address that changes every month. In Slack and Teams we receive the sender's user identifier and display name and, in Slack, their email address if the workspace allows it.
  • Public demo chat. If you try a public CIRO demo chat without an account, we store your messages, a random identifier saved in your browser and your IP address, to enforce usage limits.

How we use information

  • Provide the Services. Create and secure accounts; answer questions and run analyses; build dashboards, reports, forecasts and apps; sync, copy and index the data you connect; store your files; join and transcribe meetings when asked; deliver chatbot replies; and provide support.
  • Personalize the Services. CIRO uses the knowledge you add, and the memories it creates from your conversations (short facts and session summaries), to give more relevant answers. You can review and delete these memories in your profile. A deleted memory stops being used, and you can undo the deletion for 7 days.
  • Keep the Services secure. Record sign-ins and flag a first sign-in from a new country, limit request rates, block malicious traffic and investigate abuse.
  • Manage billing and accounts. Trials, subscriptions, credits, invoices, plan limits, and the read-only mode that applies when a trial ends without a paid plan.
  • Communicate with you. Service emails (verification codes, password resets, invitations, alerts, billing notices and support replies) and emails about your trial and account, such as welcome messages and trial reminders. You can opt out of non-essential emails at any time.
  • Sales and marketing. Respond to demo requests, understand which campaigns bring people to CIRO, and measure website use when you allow analytics cookies.
  • Improve the Services. Use usage and error information to fix problems, improve reliability and plan new features.
  • Comply with the law and protect rights. Meet legal, tax and accounting obligations, respond to lawful requests and enforce our Terms of Service.

We do not sell your personal information. We do not use AI to make decisions about you that produce legal or similarly significant effects.

AI features and model training

CIRO's AI features are powered by AI model providers. When you ask a question or use an AI feature, we send the provider that powers that feature only the content needed to answer that request, such as your message, the recent conversation, relevant excerpts from your files and connected data, and descriptions of how your data sources are structured, and the provider returns the result to CIRO. The providers in use as of the date of this policy are:

  • xAI (Grok). Our default model for chat, analysis, agent tasks and CIRO Studio. It is also used for web searches you request in chat, image generation and editing, voice conversations, running analysis code in xAI's code-execution tool, creating memories from conversations, and reading PDF documents (the file is uploaded to xAI temporarily and deleted once its content has been extracted).
  • Anthropic (Claude). Some planning and troubleshooting steps in CIRO Studio, questions about connected Power BI data, and some chat features.
  • OpenAI. A backup when the primary provider is unavailable, some voice and speech-to-text features where enabled, and embeddings in some configurations.
  • Google (Gemini API). Reading text and tables from scanned pages and images in documents (OCR), and as an alternative model in some configurations.
  • Cohere. Creating embeddings, which are numeric representations of text used for search, from your documents, meeting transcripts, data descriptions and memories, and ranking search results.
  • ElevenLabs. Reading answers aloud, where text-to-speech is enabled.
  • Gamma. Producing presentation-style reports when you ask CIRO to generate one.

Each of these providers processes the content it receives under its own API or business terms, which govern how it may use and retain that content. The provider that handles a request can change as models improve, and a feature can fall back to another provider on this list if one is unavailable. We keep this list of providers current and update it when we add or replace a provider.

CIRO does not use Customer Content to train CIRO's own AI models.

AI output can be inaccurate or incomplete. Check important results before you rely on them.

How we share information

We do not sell, rent or trade personal information. We share it only as described below.

Service providers

These companies process information on our behalf to run the Services:

  • Amazon Web Services (AWS): hosting, databases, file storage, encryption keys, secrets management, and the per-organization data lake used to store and query connected data. United States.
  • The AI providers listed in section 05: xAI, Anthropic, OpenAI, Google, Cohere, ElevenLabs and Gamma.
  • Stripe: payments, subscriptions, invoices and receipts. Stripe emails receipts and invoices on our behalf.
  • Twilio SendGrid: delivery of service emails, such as verification codes, password resets, invitations, alerts and support replies.
  • Loops: delivery of welcome, trial and account emails. Loops receives your email address, name and the account details used in those emails.
  • Sentry: error and performance monitoring, when enabled. It is configured not to attach default personal identifiers such as your IP address, and any replay of the page activity around an error masks all text and input and blocks images and media.
  • Google: Google Tag Manager and Google Analytics, for website analytics (with your consent) and for product analytics in the web app (see section 03).
  • Expo: delivery of push notifications to the mobile apps.
  • Maps and geocoding: when you view maps, your browser loads map images from CARTO and MapTiler, which receive your IP address and the map area shown. When you search for an address or choose to place addresses from your data on a map, those addresses are sent to OpenStreetMap's Nominatim service or, where configured, to Google Maps Platform or Mapbox.
  • Meeting assistant: if your organization uses it, a meeting-bot service (Recall.ai or Vexa) joins the meetings you schedule and returns the audio and transcript to CIRO.
  • Calendly: scheduling demo calls booked from our website.
  • Content delivery networks: some pages load images or code libraries from public content delivery networks, which receive your IP address.

Other sharing

  • Within your organization. Owners and administrators of your organization can see its members and their roles, and may see activity and usage information for the organization and the content shared with it. Content you share with teammates is visible to them, and content you publish through a public link is visible to anyone who has the link.
  • Integrations you direct. When you connect CIRO to another service, such as Slack, Microsoft Teams, Power BI, GitHub, a webhook or an MCP server, we send data to it as you instruct. That service's own terms and privacy policy apply.
  • CIRO administrators. Authorized CIRO personnel can see the account information needed for support, billing and security, including sign-in history and onboarding answers. Administrative actions are logged.
  • Legal requirements. When required by law, subpoena or court order, or to protect the rights, property or safety of CIRO, our customers or the public.
  • Business transfers. If the operator of CIRO AI changes, for example when CIRO is formalized as a company in the United States, or in a merger, acquisition, financing or sale of assets, information may transfer to the successor, subject to this policy.
  • With your consent. For any other purpose disclosed when you give it.

Integrations you connect

You can connect CIRO to your own systems. When you do, CIRO accesses the data the connection's permissions allow so it can query it, index it for search and, for many connectors, keep a synchronized copy in your organization's own data lake in AWS. Connection credentials and access tokens are stored encrypted (AES-256-GCM).

  • Available connectors include SAP; databases and data warehouses such as PostgreSQL, MySQL, MongoDB, Snowflake, Google BigQuery, Amazon Redshift and Athena, Databricks, ClickHouse, Supabase and Oracle; business applications such as HubSpot, Salesforce, QuickBooks, Alegra, Shopify, Stripe, Meta Ads, Jotform, Airtable, Notion, Confluence and GitHub; files in Google Drive, Docs and Sheets, Microsoft OneDrive and SharePoint, Dropbox and direct uploads; Google and Microsoft calendars for the meeting assistant; GPS fleet-tracking devices; and Microsoft Power BI. The list changes over time.
  • For Google and Microsoft files and calendars we request read-only access, such as the Google Drive, Docs, Sheets and Calendar read-only scopes and the Microsoft Files.Read.All and Calendars.Read permissions.
  • Fleet tracking processes the locations of your organization's vehicles reported by their GPS devices.
  • You can disconnect or delete a connection at any time to stop future access. To remove data that was already copied into CIRO, delete it in your workspace or contact us.

Slack and Microsoft Teams

  • The CIRO Slack app requests only these bot permissions: chat:write, app_mentions:read, users:read and users:read.email. It receives the messages people send to it directly or by @mention, and uses the email address to match the person to their CIRO account so that answers respect their data permissions.
  • We store each message sent to a CIRO bot in Slack or Teams together with the reply and the thread identifiers needed to keep the conversation together. Bot tokens are stored encrypted. When a workspace disconnects the CIRO Slack app in CIRO, we revoke its bot token.

Google user data

CIRO's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide the features you request, we do not use it for advertising, and we do not use it to train CIRO's own AI models.

Mobile apps (iOS / Android)

The CIRO AI mobile app is published with the bundle identifier and package name us.ciroai.app. The app asks for these permissions only when you use the related feature:

  • Microphone: voice questions and recording meetings for transcription.
  • Camera: capturing documents and charts to upload.
  • Photos and files: choosing an image (such as a profile photo) or a document to upload.
  • Face ID, Touch ID or fingerprint: unlocking the app. Biometric data stays on your device; the app only receives a success or failure result from the operating system.
  • Notifications: alerts and updates, if you allow them. We store a push token for your device and send notifications through Expo's push service.

When crash reporting is enabled, the app sends crash reports and performance measurements to Sentry, configured not to attach default personal identifiers. The app does not request your location, contacts or calendar, does not include advertising SDKs, and does not track you across other companies' apps and websites, so it does not show Apple's App Tracking Transparency prompt. Some charts load a charting library from a public content delivery network (jsDelivr), which receives your device's IP address.

You can sign in to the app with your email address, Google or Apple. Uninstalling the app does not delete your account; see section 13 to delete it.

Cookies and similar technologies

Our website (ciroai.us)

  • Your cookie choice is saved in your browser's local storage.
  • We use Google Analytics 4 through the Google tag with Google Consent Mode. Analytics and advertising storage are off by default, and Google cookies such as _ga are set only if you accept them. Before you choose, or if you decline, the Google tag can still send Google limited information without cookies (for example, that a page was viewed, with your browser's IP address and user agent), which Google uses for aggregate measurement.
  • If we use advertising measurement (Google Ads or the Meta pixel), it sets advertising cookies only after you accept them, and the Meta pixel loads only after you accept.
  • Campaign information from the link you arrived on is kept for your browser session and sent with any form you submit.
  • You can change your choice at any time through Cookie settings at the bottom of every page. Our Cookie Policy has more detail.

The CIRO web app (app.ciroai.us)

  • ciro_rt: keeps you signed in. It holds a refresh token, cannot be read by page scripts (HttpOnly), is sent only over HTTPS to our sign-in endpoints, and expires after 7 days unless it is renewed.
  • ciro_oauth_state_google, ciro_oauth_state_microsoft, ciro_oauth_state_github and ciro_oauth_state_linkedin: protect sign-in with that provider. Each expires after 10 minutes.
  • ciro_studio_preview: gives you access to previews of the apps you build in CIRO Studio.
  • ciro.attribution: remembers the campaign that brought you to CIRO. First-party, kept for up to one year.
  • Local storage in your browser holds your current access token, language, theme and interface preferences, and some recent activity, such as voice conversation history.
  • The web app also loads Google Tag Manager and, when enabled, Sentry, described in sections 03 and 06. It does not currently show a cookie banner.

Our website and the web app do not respond to browser “Do Not Track” signals.

Where we store and process information

Our operator is based in El Salvador, and our infrastructure runs in the United States. Our main systems run on AWS in the us-east-1 region (Northern Virginia), and database backups are copied to another AWS region in the United States (us-west-2, Oregon). Customer files are stored encrypted in Amazon S3 and, for some older files, on our application server's disk. Our service providers may process information in the United States and in other countries where they operate.

This means that, wherever you use the Services from, including El Salvador and the rest of Latin America, your information is transferred to and processed in the United States, where data protection laws may differ from those of your country. We transfer it to provide the Services you request, and we apply the protections described in this policy wherever it is processed.

How long we keep information

  • Account information and workspace content: kept while your account is active.
  • Deletion on request: when you, or the owner of your organization, ask us to delete an account or workspace by writing to privacy@ciroai.us, we delete it from our active systems within 30 days of verifying the request (see section 13). Organization owners can also delete an organization themselves from its settings; its database records, files, search indexes and data lake are then deleted from our active systems and its billing stops.
  • Items you delete: conversations, files, dashboards and other items you delete are removed from our active systems; files are deleted from storage at the same time.
  • Conversations: kept until you delete them or your organization is deleted.
  • Chat exports: download bundles expire automatically after a period that depends on your plan (7 days by default).
  • Meeting audio: deleted after the retention period set for your organization (365 days by default). Transcripts, summaries and action items are kept until they are deleted.
  • Temporary copies sent to an AI provider to read a document are deleted once extraction finishes.
  • Internal processing logs for chat responses: 7 days. File-access records: 180 days by default.
  • Sign-in history, security and audit logs, and sales leads (including website form submissions): kept for up to 24 months.
  • Support messages: as long as needed to respond and to manage our relationship with you.
  • Billing records: as long as tax and accounting laws require.
  • Expired and read-only workspaces: when a trial ends without a paid plan, or a payment remains unpaid after the grace period, the workspace becomes read-only. Nothing is deleted at that point: alerts, scheduled analyses and chatbots are paused, and data syncs continue. We keep the workspace so you can resume, and we delete it when you ask. We may delete a workspace that has been inactive for 12 months, after notifying its owner.
  • Backups: our databases are backed up every night, and backups are overwritten on a rolling schedule. Deleted information disappears from backups as they rotate.

How we protect information

We use technical and organizational measures designed to protect personal information, including:

  • Encryption in transit (HTTPS) between your device and the Services.
  • Encryption at rest: files in Amazon S3 are encrypted with AWS Key Management Service (KMS) keys, and data lake files with S3 server-side encryption (AES-256). Connection credentials, access tokens and two-factor secrets are also encrypted by our application (AES-256-GCM).
  • Account protection: passwords stored only as bcrypt hashes; short-lived access tokens and rotating refresh tokens in secure, HttpOnly cookies; and optional two-factor authentication with an authenticator app, which can be required for administrator access.
  • Tenant isolation: each organization's records are separated with database row-level security, and each organization has its own data lake and its own search (vector) collections.
  • Operations: secrets kept in AWS Secrets Manager; a web application firewall and rate limits in front of the Services; logging of administrative actions; error monitoring; and nightly backups.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and the authorities as required by applicable law.

Your rights and choices

Depending on where you live, you may have the right to:

  • Access the personal information we hold about you and receive a copy, including in a portable, machine-readable format.
  • Correct inaccurate or incomplete information.
  • Delete your information, subject to legal retention obligations.
  • Object to or restrict certain uses, including direct marketing.
  • Withdraw your consent where we rely on it, without affecting processing that took place before.
  • Not be discriminated against for exercising these rights.

We extend these rights to all users, wherever they live, subject to the limits of the law.

Tools in the Services

  • Edit your profile and preferences at any time.
  • Delete conversations, files, dashboards and other items, and review or delete the memories CIRO keeps about you in your profile.
  • Export chat sessions, download query results and reports, and export dashboards and meeting records where those features are offered.
  • Organization owners can permanently delete the whole organization from its settings by confirming its name.
  • Opt out of non-essential emails, and change your cookie choice on our website through Cookie settings.

Deleting your account

To delete your individual CIRO account, email privacy@ciroai.us from the address registered to the account, with the subject “Account deletion request.” In the mobile app, Profile → Security → Delete account opens the same instructions. We verify the request and then delete the account from our active systems within 30 days. To delete a whole organization, its owner can use the organization's settings or write to us the same way.

How to make a request

Email privacy@ciroai.us. We may need to verify your identity, for example by asking you to write from the email address on your account. An authorized agent can make a request for you with your written permission. We respond within 30 days, or sooner where your local law requires it (see section 14). If your information is part of an organization's Customer Content, we may refer your request to that organization. You can also file a complaint with the data protection authority in your country.

Additional information for specific regions

California, United States

California residents have rights under the California Consumer Privacy Act, as amended (CCPA). In the past 12 months we collected these categories of personal information: identifiers (such as name, email address, IP address and account identifiers); customer records (such as billing contact details); commercial information (such as plans and purchases); internet or other electronic network activity (such as usage, sign-in and website activity); approximate geolocation derived from IP addresses; audio information (meeting recordings and voice, if you use those features); professional information (such as job title and company); inferences (such as the preferences CIRO remembers to personalize answers); and sensitive personal information limited to account login credentials. Customer Content may contain other information that our customers choose to put into CIRO; we process it only to provide the Services.

We collect these categories from the sources described in section 03, use them for the purposes in section 04, disclose them for business purposes to the service providers in section 06, and keep them as described in section 11.

We do not sell personal information. On our website, advertising cookies are used only if you accept them in the cookie banner; if you do, the advertising providers we use may receive information about your visit, which the CCPA may treat as “sharing” for cross-context behavioral advertising. You can withdraw that choice at any time through Cookie settings. We use sensitive personal information only to provide and secure your account, and not to infer characteristics about you. We do not disclose personal information to third parties for their own direct marketing purposes.

You have the right to know what personal information we collect and how we use and disclose it, to delete and correct it, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to receive discriminatory treatment for exercising these rights. To exercise them, follow the process in section 13.

Colombia

For residents of Colombia, this policy is our personal data processing policy under Law 1581 of 2012 and its regulations. As the data subject (titular), you have the right to know, update and correct your data; to request proof of the authorization you gave us; to be informed about how your data is used; to file complaints with the Superintendencia de Industria y Comercio (SIC); to revoke your authorization or request deletion when there is no legal or contractual duty to keep the data; and to access your data free of charge. Send queries and claims to privacy@ciroai.us. We answer queries within 10 business days and claims within 15 business days. If we need more time, we will tell you why and when you will receive an answer, within the extensions the law allows.

Mexico

For residents of Mexico, this policy serves as our privacy notice (aviso de privacidad) under the Federal Law on the Protection of Personal Data Held by Private Parties. We use your data mainly to provide the Services (primary purposes). Sending you emails that are not essential to the Services, measuring website use and measuring campaigns are secondary purposes; you can object to them at any time by writing to privacy@ciroai.us, and doing so will not affect your use of the Services. We do not ask you for sensitive personal data. We do not transfer your personal data to third parties for their own purposes, except where the law allows it without your consent, for example to comply with a legal obligation.

You can exercise your rights of access, rectification, cancellation and opposition (ARCO rights), and revoke your consent, by writing to privacy@ciroai.us with your name, a way to send you our answer, a document that proves your identity (or your representative's authority), and a clear description of the data and of the right you want to exercise. We will tell you our decision within 20 business days and, if it is favorable, apply it within 15 business days after that. We will announce changes to this notice on this page and, for material changes, by email or in the Services.

Peru

For residents of Peru, we process personal data in accordance with Law No. 29733, the Personal Data Protection Law, and its regulations. You can exercise your rights of information, access, rectification, cancellation and opposition, and the other rights the law provides, by writing to privacy@ciroai.us. We will respond within the time limits set by the regulations. If you are not satisfied with our response, you can file a claim with the National Authority for Personal Data Protection (Autoridad Nacional de Protección de Datos Personales) of the Ministry of Justice and Human Rights.

El Salvador, Guatemala and other countries

If you live in El Salvador, Guatemala or another country, you can exercise the rights described in section 13, and we will also respect any additional rights your local law gives you.

Children's privacy

The Services are designed for business use by adults. You must be at least 18 years old to create an account or use the Services, and we do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has given us personal information, contact privacy@ciroai.us and we will delete it.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page shows the latest version. For material changes, we will notify users through the Services or by email before the changes take effect.

Contact us

If you have questions about this policy or how we handle your information, contact us:

  • Privacy and data requests: privacy@ciroai.us
  • Support: support@ciroai.us
  • Billing: billing@ciroai.us
  • General inquiries: hello@ciroai.us
  • Postal address: CIRO Technology Labs, S.A. de C.V., Av. Washington, Colonia Libertad #85, Distrito San Salvador Centro, Departamento de San Salvador, El Salvador