Paquetería YaBeta

Privacy Policy

Last updated: August 24, 2026

1. Introduction

BAXCAJAY VENTURES LLC (operating as Paquetería Ya) ("we", "us", or "our") operates https://paqueteriaya.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site or use our services.

2. Information We Collect

We may collect the following types of information:

  • Personal Information: Name, email address, username, and similar identifiers
  • Contact Information: Phone number, physical address, and other contact details
  • Payment Information: Billing details and transaction history. Card payments are processed by Stripe; we never store full card numbers.
  • Location Data: GPS coordinates captured with proof-of-delivery photos, and approximate location derived from IP address
  • Device Information: Browser type, operating system, device type, and unique device identifiers
  • Usage Data: Pages visited, time spent on pages, links clicked, and browsing patterns
  • User-Generated Content: Delivery photos, customer records, and other content uploaded to the Service
  • Cookies and Tracking: Information collected through cookies and similar technologies

3. Information Our Business Customers Provide About Their Customers

Businesses that use Paquetería Ya may upload personal information about their own customers — such as sender and recipient names, phone numbers, and delivery addresses — in order to manage packages and deliveries. We process this information on behalf of the business that uploaded it, and that business is responsible for having the right to share it with us.

If your information was added to Paquetería Ya by a business you shipped with, please direct privacy questions or requests to that business. You may also contact us at privacy@paqueteriaya.com, and we will forward your request to the relevant business and assist in fulfilling it.

Proof-of-Delivery Photos

When a courier delivers a package, they may photograph it at the point of handover as proof of delivery. Where a business has enabled this, that photo is shown on the package's tracking page, which is reachable by anyone holding the package's tracking link. The GPS coordinates recorded with the delivery are never shown on a tracking page or shared with recipients; they are visible only to staff of the business that made the delivery.

Each business controls whether proof-of-delivery photos appear on their public tracking pages. To request that a specific photo be removed, contact the business you shipped with, or us at privacy@paqueteriaya.com.

Proof-of-delivery photos are not kept indefinitely. They are deleted 90 days after the delivery, as described in Section 7, after which the tracking page shows the delivery confirmation without the photograph.

4. How We Use Your Information

We use the information we collect for the following purposes:

  • To provide, maintain, and improve our services
  • To respond to your inquiries and provide customer support
  • To analyze usage patterns and improve user experience
  • To comply with legal obligations and enforce our terms
  • To detect, prevent, and address security issues and fraud

5. Third-Party Services

We may share your information with the following third-party service providers:

  • Convex: Database and application backend
  • Clerk: Authentication and account management
  • Stripe: Secure payment processing
  • Resend: Transactional email delivery
  • Sentry: Error monitoring and diagnostics
  • Vercel: Website hosting
  • Mapbox: Maps display
  • LocationIQ: Address geocoding
  • OpenRouteService: Route optimization

These third parties have their own privacy policies governing how they use your information. We share only the information each provider needs to perform its function — for example, delivery addresses are shared with our geocoding and mapping providers in order to display maps and plan routes.

Payment Processing

Paid subscriptions are billed through Stripe, Inc., which acts as our payment processor. When a business subscribes, we share its business name, billing contact details, and billing address with Stripe so that it can create a customer record, calculate applicable taxes, and process payments. Card details are entered on Stripe's own hosted checkout and billing pages and are handled by Stripe; we never receive or store full card numbers. Stripe's handling of that information is governed by its own privacy policy, available at https://stripe.com/privacy.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Service and hold certain information.

Types of Cookies We Use:

  • Essential Cookies: Required for the website to function properly, including authentication and session cookies
  • Preference Cookies: Remember your settings and preferences

We do not use advertising or marketing cookies. You can manage cookies through your browser settings; disabling essential cookies may prevent you from signing in or using the Service.

7. Data Retention

We will retain your personal information for as long as necessary to fulfill the purposes outlined in this privacy policy, unless a longer retention period is required or permitted by law.

Photographs: Package intake photos and proof-of-delivery photos are retained for 90 days after the package is delivered or returned, and in no case longer than 12 months from the date they are captured. At the end of that window they are automatically and permanently deleted from our systems and cannot be recovered. A business may also delete the photographs of its already-delivered packages sooner, at any time, from its own account. If you need a photograph, download or share it before the retention period ends.

Delivery records: The delivery record a photograph belongs to is kept indefinitely. Deleting the photograph does not delete the record: the tracking event and its timestamp, the delivery status, and the recipient name or signature remain as a permanent record. The GPS coordinates recorded at delivery are treated as delivery evidence like the photo itself: they follow the same retention window and are deleted together with it. As described in Section 3, GPS coordinates are never shown on a public tracking page while they exist.

Expense receipts: Photographs of expense receipts — fuel, tolls, customs, payroll and other trip costs — are retained for 2 years from the date they are uploaded. At the end of that window the image is automatically and permanently deleted from our systems and cannot be recovered. The expense record itself is not deleted: the amount, date, type and payee are kept indefinitely, and the entry simply notes that the image was removed. A business can download its receipt images at any time before that window ends, from the Expenses page or in a trip archive.

Trip archives: When a business closes a trip, we automatically save a complete archived copy of that trip's records — its package manifest, expenses, receipts and photographs — so the business keeps a durable copy after the underlying photographs reach the end of their own retention window. Archives are retained according to the business's plan: 3 years on Starter and beta accounts, 5 years on Growth, and indefinitely on Business and Enterprise. If a subscription is cancelled or lapses, archives are kept for a further 90 days before deletion. We notify the business by email before an archive is deleted, and an archive can be downloaded at any time while it exists. A business may also ask us to delete its archives sooner, as described in Section 8.

Billing records: Invoices and payment history are retained by us and by Stripe for as long as required by applicable tax and accounting law.

8. Your Rights

Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

  • Right to Know: Know what personal information is collected and how it is used
  • Right to Delete: Request deletion of your personal information
  • Right to Opt-Out: Opt-out of the sale of your personal information
  • Right to Non-Discrimination: Not be discriminated against for exercising your rights

Rights Under CPRA (California Residents - Enhanced Rights)

If you are a California resident, you have the following enhanced rights under the California Privacy Rights Act (effective January 2023):

  • Right to Know: Know what personal information is collected, used, shared or sold
  • Right to Delete: Request deletion of your personal information
  • Right to Correct: Request correction of inaccurate personal information
  • Right to Opt-Out of Sale/Sharing: Opt-out of the sale or sharing of your personal information
  • Right to Limit Use of Sensitive Personal Information: Limit the use and disclosure of sensitive personal information
  • Right to Non-Discrimination: Not be discriminated against for exercising your privacy rights
  • Right to Data Portability: Obtain a copy of your personal information in a portable format

Sensitive Personal Information: Under CPRA, sensitive personal information includes Social Security numbers, driver's license numbers, account credentials, precise geolocation, racial/ethnic origin, religious beliefs, genetic data, health information, sex life or sexual orientation, and contents of mail/email/text messages.

We do not sell or share your personal information within the meaning of the CCPA/CPRA.

Rights Under Mexican Law (LFPDPPP)

If you are located in Mexico, the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) grants you the "ARCO" rights with respect to your personal data:

  • Access (Acceso): Know what personal data we hold about you and how it is used
  • Rectification (Rectificación): Request correction of inaccurate or incomplete data
  • Cancellation (Cancelación): Request deletion of your personal data when it is no longer needed for the purposes described in this policy
  • Opposition (Oposición): Object to the processing of your personal data for specific purposes

To exercise any ARCO right, contact us at privacy@paqueteriaya.com with your name, a description of the data concerned, and the right you wish to exercise. We will respond within the timeframes established by applicable law. If your data was uploaded by a business you shipped with, we will coordinate with that business to fulfill your request.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. In particular, the Service is hosted and operated in the United States: if you or your customers are located in Mexico or elsewhere, personal data will be transferred to and stored in the United States, which may have different data protection laws than your country.

When we transfer your data internationally, we ensure appropriate safeguards are in place, such as contractual data protection commitments with our service providers or other legally recognized mechanisms for international data transfers.

10. Children's Privacy

Our Service is not intended for children under 13 years of age (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us:

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.