Privacy Policy

1. Introduction

BAXCAJAY VENTURES LLC, a Florida (United States) limited liability company operating as Paquetería Ya ("we", "us", or "our"), operates https://paqueteriaya.com, the Paquetería Ya Staff mobile app for businesses and their teams, and the Paquetería Ya mobile app for their customers (together, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

Una versión en español de esta política está disponible en https://paqueteriaya.com/es/privacy.

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site or use our services.

2. Information We Collect

We may collect the following types of information:

• Personal Information: Name, email address, username, and similar identifiers
• Contact Information: Phone number, physical address, and other contact details
• Payment Information: Billing details and transaction history. Card payments are processed by Stripe; we never store full card numbers.
• Location Data: GPS coordinates captured with proof-of-delivery photos, and approximate location derived from IP address
• Device Information: Browser type, operating system, device type, and unique device identifiers
• Usage Data: Pages visited, time spent on pages, links clicked, and browsing patterns
• User-Generated Content: Delivery photos, customer records, and other content uploaded to the Service
• Cookies and Tracking: Information collected through cookies and similar technologies

3. Information Our Business Customers Provide About Their Customers

Businesses that use Paquetería Ya may upload personal information about their own customers — such as sender and recipient names, phone numbers, and delivery addresses — in order to manage packages and deliveries. We process this information on behalf of the business that uploaded it, and that business is responsible for having the right to share it with us.

If your information was added to Paquetería Ya by a business you shipped with, please direct privacy questions or requests to that business. You may also contact us at privacy@paqueteriaya.com, and we will forward your request to the relevant business and assist in fulfilling it.

Proof-of-Delivery Photos

When a courier delivers a package, they may photograph it at the point of handover as proof of delivery. Where a business has enabled this, that photo is shown on the package's tracking page, which is reachable by anyone holding the package's tracking link. The GPS coordinates recorded with the delivery are never shown on a tracking page or shared with recipients; they are visible only to staff of the business that made the delivery.

Each business controls whether proof-of-delivery photos appear on their public tracking pages. To request that a specific photo be removed, contact the business you shipped with, or us at privacy@paqueteriaya.com.

Proof-of-delivery photos are not kept indefinitely. They are deleted 90 days after the delivery, as described in Section 7, after which the tracking page shows the delivery confirmation without the photograph.

The Paquetería Ya App and Pickup Requests

The Paquetería Ya app lets anyone find a business that has a public page on Paquetería Ya, ask it for a pickup, and track a package with the code from their receipt. It has no account and no sign-in.

What stays on your phone: The name, phone number, email address and addresses you enter in the app, the businesses you save or search for, the packages you look up, and the status of pickup requests you sent are stored only on your phone. We do not receive your name, phone number, email address or addresses unless you send a pickup request. You can erase all of it at any time from Me → Delete everything on this phone, or by uninstalling the app.

What a pickup request sends: When you send a pickup request, the app sends the business you chose your name, phone number, optional email address, preferred way to be contacted, pickup address, an estimate of how many packages and when, an optional note, and your language. We store the request on behalf of that business and notify its staff who handle pickup requests. Only that business sees it; it is never shown to other businesses or to the public. The business may contact you about the pickup using the details you gave.

Status and cancellation: The app receives a random status code for each request, kept only on your phone, which it uses to show you whether the business confirmed, declined or collected the pickup. You can cancel a request until the business answers it.

When a business confirms a request: Your name, phone number and address are added to that business's customer records, as if you had given them at its counter. From then on, Section 3 applies: the business is responsible for that information, and you can ask it, or us at privacy@paqueteriaya.com, to correct or delete it.

Searches and lookups: To find a business or check a package, the app sends the words you search for or the tracking code to our servers so they can answer. We use them only to answer that search or lookup: we do not save them or link them to you, and the list of what you searched and looked up stays on your phone. A tracking code shows only the public details of that package described in this policy.

Camera: If you choose to scan the QR code on your receipt, the camera is used only to read that code on your phone. No image is stored or sent.

No advertising or third-party analytics: The Paquetería Ya app contains no advertising, no third-party analytics and no tracking across other apps or websites. It does count, without identifying you, when a business's page is opened, shown in your search results or opened from a tracking screen, as described under Showcase Results in Section 4. To prevent abuse, we limit how many pickup requests can be sent, including per phone number.

4. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve our services
• To respond to your inquiries and provide customer support
• To analyze usage patterns and improve user experience
• To comply with legal obligations and enforce our terms
• To detect, prevent, and address security issues and fraud

Product Analytics

Inside the Service, we record how the product is used: which screens are visited, which features are opened, and when. This information is tied to your account, because knowing that a feature is used by many accounts once and by a few accounts constantly is the difference between building the right thing and the wrong thing.

This is first-party data. It is collected by our own software, stored on our own backend alongside the rest of your account data, and used for one purpose: understanding how the Service is used so we can improve it. We do not sell it, we do not share it with advertisers, and it is not used to build advertising audiences. We keep it for 12 months and then delete it.

Showcase Results

Businesses with Showcase can see how often their public page is found and visited. When someone opens a business's public page on our website or in the Paquetería Ya app, sees the business in the app's search results, or opens its page from the "Shipped with" card on a package tracking page, we add one to that business's count for the day. Visits by the business's own team are not counted. These counts are totals per business and per day: we do not record who you are, your device or your IP address with them, and they contain no personal information. So that each visit counts only once a day, your browser or phone keeps a list of the businesses it has already counted that day, as described in Section 6. That list contains nothing about you and is replaced each day.

5. Third-Party Services

We may share your information with the following third-party service providers:

• Convex: Database and application backend
• Clerk: Authentication and account management
• Stripe: Secure payment processing
• Resend: Transactional email delivery
• Sentry: Error monitoring and diagnostics
• Vercel: Website hosting
• Mapbox: Maps display
• LocationIQ: Address geocoding
• OpenRouteService: Route optimization
• Expo (650 Industries): Delivering app updates to our mobile apps and push notifications to the Paquetería Ya Staff app
• Apple Push Notification service and Google Firebase Cloud Messaging: Delivering push notifications to the Paquetería Ya Staff app
• Google Maps Platform: Maps in the Android version of the Paquetería Ya Staff app (the iPhone version uses Apple Maps)
• Meta Platforms (Facebook): Advertising measurement on our public marketing pages only, as described below

These third parties have their own privacy policies governing how they use your information. We share only the information each provider needs to perform its function — for example, delivery addresses are shared with our geocoding and mapping providers in order to display maps and plan routes.

Payment Processing

Paid subscriptions are billed through Stripe, Inc., which acts as our payment processor. When a business subscribes, we share its business name, billing contact details, and billing address with Stripe so that it can create a customer record, calculate applicable taxes, and process payments. Card details are entered on Stripe's own hosted checkout and billing pages and are handled by Stripe; we never receive or store full card numbers. Stripe's handling of that information is governed by its own privacy policy, available at https://stripe.com/privacy.

Marketing Website Measurement

Our public marketing pages — the home page, the Spanish home page, the demo, pricing, "how it works", and the feature pages — carry measurement tools that the Service itself does not. These tools run only on those pages. They are not present in the app, in the driver app, during sign-up or onboarding, on a business's public storefront page, on a package tracking page, or on this policy and our Terms of Service.

On the marketing pages we use:

• Umami: A cookieless website analytics tool that we host ourselves, on our own server. It counts page visits, referring sites, and approximate country, and it sets no cookies. It also records a sampled session replay of some marketing-page visits — about 15% of them — so we can see where the page confuses people. Replays are masked: text you type is never captured, and each recording stops after five minutes.
• Meta Pixel: A tag from Meta Platforms, Inc. (Facebook and Instagram) that reports which marketing pages were visited and which marketing links were clicked. We use it to measure whether our advertising works and to build audiences for future advertising. Unlike Umami, the Meta Pixel may set advertising cookies in your browser, and the information it collects is shared with Meta and governed by Meta's own privacy policy.

Custom audiences: We may also provide Meta with contact information — email addresses or phone numbers — in hashed form, so that Meta can build an audience of people similar to our existing customers. Meta uses the hashed values only to match and then discards them; we never send Meta the underlying addresses or numbers in readable form. If you would rather we did not include your contact information, email us at privacy@paqueteriaya.com and we will remove it.

How to opt out: You can control how Meta uses your information for advertising at https://www.facebook.com/adpreferences, and opt out of interest-based advertising across participating companies at https://optout.aboutads.info. Browser settings and tracking-protection extensions that block advertising tags also stop the Meta Pixel, and our marketing pages, the Service, and package tracking all work normally without it.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Service and hold certain information. What is set depends on where you are.

In the Service (the web app, the driver app, public business pages, and package tracking pages):

• Essential Cookies: Required for the website to function properly, including authentication and session cookies
• Preference Cookies: Remember your settings and preferences, such as your language and theme
• Showcase results list: On public business pages and package tracking pages, your browser's local storage keeps the daily list described under Showcase Results in Section 4. It is not a cookie, contains nothing about you, and is replaced each day

The Service sets no advertising or marketing cookies. Nothing you do inside the app, on a storefront page, or on a tracking page is used to target advertising.

On our public marketing pages:

• Essential and preference cookies: The same ones described above
• Advertising cookies: The Meta Pixel described in Section 5 may set cookies used for advertising measurement and audience building. Our self-hosted Umami analytics sets no cookies at all.

Our mobile apps do not use cookies. They store your settings on your phone, and the Paquetería Ya app also stores there the information described in Section 3 and the daily Showcase results list described in Section 4.

You can manage cookies through your browser settings. Disabling essential cookies may prevent you from signing in or using the Service; blocking advertising cookies affects nothing you can see.

7. Data Retention

We will retain your personal information for as long as necessary to fulfill the purposes outlined in this privacy policy, unless a longer retention period is required or permitted by law.

Photographs: Package intake photos and proof-of-delivery photos are retained for 90 days after the package is delivered or returned, and in no case longer than 12 months from the date they are captured. At the end of that window they are automatically and permanently deleted from our systems and cannot be recovered. A business may also delete the photographs of its already-delivered packages sooner, at any time, from its own account. If you need a photograph, download or share it before the retention period ends.

Delivery records: The delivery record a photograph belongs to is kept indefinitely. Deleting the photograph does not delete the record: the tracking event and its timestamp, the delivery status, and the recipient name or signature remain as a permanent record. The GPS coordinates recorded at delivery are treated as delivery evidence like the photo itself: they follow the same retention window and are deleted together with it. As described in Section 3, GPS coordinates are never shown on a public tracking page while they exist.

Expense receipts: Photographs of expense receipts — fuel, tolls, customs, payroll and other trip costs — are retained for 2 years from the date they are uploaded. At the end of that window the image is automatically and permanently deleted from our systems and cannot be recovered. The expense record itself is not deleted: the amount, date, type and payee are kept indefinitely, and the entry simply notes that the image was removed. A business can download its receipt images at any time before that window ends, from the Expenses page or in a trip archive.

Trip archives: When a business closes a trip, we automatically save a complete archived copy of that trip's records — its package manifest, expenses, receipts and photographs — so the business keeps a durable copy after the underlying photographs reach the end of their own retention window. Archives are retained according to the business's plan: 3 years on Starter and beta accounts, 5 years on Growth, and indefinitely on Business and Enterprise. If a subscription is cancelled or lapses, archives are kept for a further 90 days before deletion. We notify the business by email before an archive is deleted, and an archive can be downloaded at any time while it exists. A business may also ask us to delete its archives sooner, as described in Section 8.

Usage and marketing analytics: The in-app product analytics described in Section 4 are kept for 12 months from the date they are recorded and then deleted. Marketing-page analytics and session replays are kept for 12 months as well. Information collected by the Meta Pixel is held by Meta under its own retention policy, not ours.

Pickup requests: A pickup request is kept while it is open. Once it is collected, declined or cancelled, it is automatically and permanently deleted 90 days later. If the business confirmed it, the customer record created from it stays with that business, as described in Section 3.

Billing records: Invoices and payment history are retained by us and by Stripe for as long as required by applicable tax and accounting law.

8. Your Rights

Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to Know: Know what personal information is collected and how it is used
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the sale of your personal information
• Right to Non-Discrimination: Not be discriminated against for exercising your rights

Rights Under CPRA (California Residents - Enhanced Rights)

If you are a California resident, you have the following enhanced rights under the California Privacy Rights Act (effective January 2023):

• Right to Know: Know what personal information is collected, used, shared or sold
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: Opt-out of the sale or sharing of your personal information
• Right to Limit Use of Sensitive Personal Information: Limit the use and disclosure of sensitive personal information
• Right to Non-Discrimination: Not be discriminated against for exercising your privacy rights
• Right to Data Portability: Obtain a copy of your personal information in a portable format

Sensitive Personal Information: Under CPRA, sensitive personal information includes Social Security numbers, driver's license numbers, account credentials, precise geolocation, racial/ethnic origin, religious beliefs, genetic data, health information, sex life or sexual orientation, and contents of mail/email/text messages.

We do not sell your personal information, and we have never received money for it. The advertising measurement on our public marketing pages, described in Section 5, may count as "sharing" for cross-context behavioral advertising under the CPRA. Nothing that happens inside the Service — your account data, your packages, your customers, your photographs — is ever used this way. To opt out, use the links in Section 5 or email us at privacy@paqueteriaya.com and we will exclude your information.

Rights Under Mexican Law (LFPDPPP)

If you are located in Mexico, the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) grants you the "ARCO" rights with respect to your personal data:

• Access (Acceso): Know what personal data we hold about you and how it is used
• Rectification (Rectificación): Request correction of inaccurate or incomplete data
• Cancellation (Cancelación): Request deletion of your personal data when it is no longer needed for the purposes described in this policy
• Opposition (Oposición): Object to the processing of your personal data for specific purposes

To exercise any ARCO right, contact us at privacy@paqueteriaya.com with your name, a description of the data concerned, and the right you wish to exercise. We will respond within the timeframes established by applicable law. If your data was uploaded by a business you shipped with, we will coordinate with that business to fulfill your request.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. In particular, the Service is hosted and operated in the United States: if you or your customers are located in Mexico or elsewhere, personal data will be transferred to and stored in the United States, which may have different data protection laws than your country.

When we transfer your data internationally, we ensure appropriate safeguards are in place, such as contractual data protection commitments with our service providers or other legally recognized mechanisms for international data transfers.

10. Children's Privacy

Our Service is not intended for children under 13 years of age (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• Email: privacy@paqueteriaya.com
• Website: https://paqueteriaya.com

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

13. Account Deletion and Business Records

Request deletion in the app from Account and privacy → Request deletion, or use our account deletion page. We require recent authentication. For linked Apple accounts, we revoke the Sign in with Apple authorization as part of deletion. We delete the login/profile, personal product analytics, feedback, stored personal consent entries, push notification registrations/history and memberships. Unnecessary account names and email addresses duplicated in operational audit records are removed. A private device-held receipt allows you to check progress after sign-in ends; completion receipts and temporary safeguards against stale sessions are retained for up to 30 days after completion.

A company retains its delivery and financial history when a member deletes a personal account. Customer/delivery contacts, recipient evidence, legally required payee information, invoices and previously generated trip archives follow Section 7 rather than being destroyed by account deletion. Author references may remain as opaque record identifiers that no longer resolve to a user profile. Existing archives are historical business copies and may contain identity details recorded at the time; contact privacy@paqueteriaya.com to request assessment, redaction or deletion of retained personal information where applicable. Copies already downloaded by a business are outside our control.

A sole owner must transfer ownership or explicitly close the company as part of account deletion. Closure disables company operations and stops future recurring subscription billing while preserving records under the applicable retention policy. Deleting an account is permanent. A processing or review status does not mean deletion has finished.

Public pages and company handles after closure: Deleting a personal account while its company continues operating does not remove the company's public page or handle. Closing the company immediately hides its public page. The handle is reserved for 90 days from company closure, then automatically released for another company to claim without manual review. A later claimant receives only the public address, not the former company's page content or private records. Existing links and QR codes to that handle may then lead to the new company.