Conboxi Privacy Policy

1. Introduction and scope

Conboxi is a multi-tenant SaaS platform that offers virtual lockers in the United States for customers in Latin America. Through the service, customers can shop at U.S. stores using a warehouse address operated by their local agency, receive their packages there, pay for them and have them shipped to their country of residence.

This Privacy Policy describes how Conboxi collects, stores, uses, shares and protects the personal data of the people who use the service (hereinafter, "the User" or "you"), including end customers, agency operators, destination warehouse operators and agency administrators.

The data controller is Celeste Chang Cuarezma LLC, a company with its address at 1065 W Flagler St, Miami, FL 33130, United States, which operates the service under the trade name Conboxi, with contact details in Section 12. This policy applies to the web application available at https://conboxi.com and to all related services.

2. Personal data we collect

We only collect the data strictly necessary to operate the service. Each category is detailed below:

a. Identity data

• Full name
• Email address
• Phone number (optional)
• Password: we store it encrypted with bcrypt (a one-way hashing algorithm). We never store your password in plain text, and nobody at Conboxi can read it, not even support staff.

b. Location data and addresses

• Country of residence
• One or more full delivery addresses: street, apartment/suite, city, department/state, postal code, country and directions to find the place
• Name and phone number of the person who receives at each address

You can have several registered addresses and choose which one is the default for home deliveries.

c. WhatsApp number for notifications

If you choose to turn on WhatsApp notifications, we will ask for your number in international format. Turning on this channel requires explicit consent and a code verification step (we send you a 6-digit code by WhatsApp and you must enter it in the application). This step confirms that the number is really yours. You can turn notifications off at any time from your profile.

d. Messages through Messenger and Instagram

If you write to your agency's Facebook page (Messenger) or Instagram account, Meta delivers that conversation to us so we can answer you. We receive the content of the messages, the files you attach (for example a photo of a product or a screenshot of a purchase), the public name of your profile and an identifier that Meta assigns to your conversation with that page or account. That identifier is limited to the agency you are talking to: it does not let us recognize you on other pages or access your Facebook or Instagram profile beyond what Meta exposes within the conversation.

We use that data to handle your inquiry, to do commercial follow-up (for example, reminding you of a quote you requested) and, if you become a customer, to link the conversation to your account. We do not sell it or hand it over to third parties for advertising purposes. The only exception is the Meta ad measurement we explain in item g, which only works if your agency turned it on and if you came from one of its ads. Starting the contact is always your decision: if you do not write to us through those channels, we receive nothing. You can ask us to stop contacting you by replying in the same conversation, and request deletion of your data as explained in Section 6.

e. Messages through WhatsApp

If you write to your agency's WhatsApp Business number, Meta delivers that conversation to us so we can answer you. We receive the content of the messages, your phone number, your WhatsApp profile name and the files you attach (images and documents). If you arrived by tapping one of the agency's ads that opens WhatsApp, we also receive the identifier of the click on that ad.

We use them for the same purposes as Messenger and Instagram messages: handling your inquiry, commercial follow-up and, if you become a customer, linking the conversation to your account. This is different from the status notifications in item c: here you are the one who starts the conversation.

f. Prospects who arrive through Meta Lead Ads

If you fill in the form of one of your agency's ads on Facebook or Instagram (the so-called "Lead Ads"), Meta delivers that form's answers to us. They are usually your name, your email address and your phone number. The agency chooses the questions when it builds the form, so other answers the form asked you for may also reach us. We use that data to contact you about the quote you requested.

g. Meta ad measurement (Conversions API)

This feature is off by default and only works if your agency turns it on. And even when it is on, it only applies to people who came from one of the agency's ads on Meta: through a Lead Ads form (item f) or through an ad that opens WhatsApp (item e). If that is your case, when you reach a stage with the agency we report it to Meta so the agency can measure and improve its ads:

• when the agency contacts you: the "Contact" event;
• when you become a customer: the "CompleteRegistration" event;
• when you pay for your first shipment: the "Purchase" event, with the amount and currency.

What we send to Meta with each event is:

• if you came through a Lead Ads form: the identifier Meta assigned to your response, and your email and phone number transformed with a hash (SHA-256) before they leave our servers, that is, converted into a code that does not show the original data;
• if you came through an ad that opens WhatsApp: the identifier of the click on the ad and the identifier of the agency's WhatsApp Business account.

We only send events from the last 7 days. We never send the content of your messages. You can object to this measurement without having to delete your data: ask your agency or write to us at info@conboxi.com. The agency records your objection and we stop sending events about you to Meta for that agency (we recognize you by your email or phone number).

h. Payment data

We do not store credit or debit cards on our servers. All transactions are processed through Stripe, a PCI-DSS Level 1 certified provider (the highest standard in the payments industry). In our database we only keep the transaction history: amount, currency, date, status and the Stripe reference that lets us look up the payment details if needed.

i. Data about your packages

• Description of the purchase (what the product is, declared value, store)
• Photos of the packages received at the warehouse and, when applicable, photos of the receipt or invoice
• Shipping data: actual and volumetric weight, dimensions, tracking number
• Proof-of-delivery photo when the package is delivered at destination

j. Virtual locker

When you sign up we automatically assign you a locker number in the format LP-XX-XXXXX, where XX is the ISO code of your country (for example LP-CO-04321 for Colombia). This number identifies your packages from the moment they arrive at the U.S. warehouse until we deliver them to you.

k. Logs and audit data

• Dates and times each record was created and modified
• Login attempts, including failed ones (we need them to protect you against brute-force attacks and to lock the account automatically after several attempts)
• Notifications sent (channel, event, status, error message if any)
• PQRS tickets (Petitions, Complaints, Claims and Suggestions) and their replies

l. If you connect your agency's Meta account

If you work at an agency and connect its Meta account (WhatsApp Business, the Facebook Page or the Instagram account), we store what is needed to send and receive the agency's messages: the access tokens Meta gives us, encrypted, the identifiers and names of the business, the WhatsApp account, the phone number, the Page and the Instagram account, the permissions you accepted and the identifier of your Facebook user for our app, which is what Meta sends us if you remove the app from your Facebook. When you remove the app from your Facebook (Settings → Business integrations), we delete your tokens and your identifier: if the connection was yours alone, we disconnect the account; if another person at the agency also connected it, we keep that person's tokens. When the agency disconnects the account, we delete all the tokens and user identifiers. As a record of the disconnection, the audit log keeps the identifiers of the business, the WhatsApp account, the Page and the Instagram account, and the agency's WhatsApp number stays on record as inactive.

3. How we use your data

We use your personal data only for the following purposes:

• Operating the service: receiving your packages in the U.S., consolidating them, calculating the cost of international shipping, dispatching them to your country and delivering them to you.
• Status notifications: letting you know by WhatsApp when your package arrives at the warehouse, when a payment is confirmed, when it is dispatched and when it is delivered. We only send WhatsApp notifications if you opted in and verified your number.
• Customer service: answering your questions and complaints through the PQRS module inside the application.
• Commercial contact with people who left us their details to ask about or get a quote for our services, even if they are not customers yet.
• AI-assisted replies: the content of the messages that prospects write through WhatsApp, SMS, Messenger or Instagram may be processed by Anthropic (the Claude API) to summarize the request and suggest a reply to the agency's staff. In those conversations a person always reviews and sends the reply: the AI does not answer a prospect on its own. If the agency has automatic follow-up turned on, the text of those reminders, which may be sent by WhatsApp or by SMS, may also be written by Anthropic, using your first name.
• Support assistant (PQRS): if you are a customer and the agency turned the assistant on, when you open a request or reply to it, Anthropic receives the text of the request, your name and your locker number, and the assistant can look up the status of your packages and payments. The assistant may answer you on its own, without a person reviewing the reply first; the agency's staff follow the request and can reply to you at any time.
• Ad measurement: if your agency turned it on and you came from one of its ads on Meta, reporting to Meta some stages of your relationship with the agency, as explained in Section 2, item g. You can object at any time.
• Legal compliance and fraud prevention: meeting accounting, tax and customs obligations, and detecting abusive use of the service.
• Improving the service: understanding how the platform is used in order to improve it. For this purpose we work with aggregated or anonymized data that cannot identify you individually.

4. Data processors (who we share with)

To operate the service we rely on external technology providers. We share with them only the data strictly necessary for the function they perform, under confidentiality agreements and provided they meet security standards equivalent to ours.

We do not sell your personal data. We do not share it with advertisers or with third parties for commercial purposes unrelated to the service. The only exception is the Meta ad measurement in Section 2, item g, which your agency can turn on for its own ads and which you can object to.

5. Retention period

• General operational data: kept while your account is active and, afterwards, for up to 5 years to meet accounting, tax and customs obligations.
• WhatsApp notices and codes: verification codes are deleted after 90 days. For the notices we send you by WhatsApp (for example, your package status), the content and the number they were sent to are deleted after 90 days; a record without content remains (type of notice, channel, status and date), which is our evidence that we respected your choice not to receive them. Conversations with your agency follow the rule in the next item.
• Conversations through Messenger, Instagram and WhatsApp: messages, attached files and the conversation identifier are kept for as long as the business relationship lasts and are deleted together with your account or when you request their deletion. If you did not become a customer, the prospect period below applies.
• Audit logs and login attempts: kept for as long as necessary to protect the account and detect fraud, generally between 6 and 12 months.
• When you request deletion of your account, we delete your identifiable personal data except for data we are legally required to keep (for example, payment receipts for accounting purposes).
• Prospect data (people who left us their contact details and did not become customers): we keep their personal data for up to 12 months from the last contact. This includes data that arrives through WhatsApp, Messenger or Instagram, the answers to a Lead Ads form and the conversations with the agency. Once that period is over we delete their personal data; we may keep a record without identifying data for statistical purposes.

6. User rights

As the owner of the data, you have the following rights:

• Access: knowing what personal data of yours we hold.
• Rectification: correcting inaccurate or outdated data (you can do it yourself from the "My profile" section of the application).
• Deletion: requesting deletion of your account and your personal data, with the legal exceptions described in the previous section.
• Portability: receiving a copy of your data in a structured, commonly used format.
• Objection and withdrawal of consent: withdrawing the consent given for specific uses, such as WhatsApp notifications.
• Objection to Meta ad measurement: asking us to stop reporting your stages with the agency to Meta (Section 2, item g), without having to delete your data. Ask your agency or write to us at info@conboxi.com.

To exercise any of these rights you can:

• Open a ticket in the PQRS module inside the application, or
• Write to us at info@conboxi.com

We will answer your request within the deadlines set by the law applicable in your country of residence (typically between 10 and 30 business days).

If you do not have an account (you only wrote or filled in a form)

If you only wrote to an agency or filled in one of its forms, you have no account and no access to the PQRS module. To ask us to delete your data you can:

• ask the agency directly, in the same conversation, or
• write to us at info@conboxi.com telling us which agency, which channel you used to contact it (WhatsApp, Messenger, Instagram or a Lead Ads form) and the name, number or email you used, so we can find your data.

We will delete your prospect data, except what the law requires us to keep, within the deadlines stated above.

Our data deletion page is for people who signed in with Facebook and requested deletion from their Facebook account. It is not the path for someone who only wrote to an agency or filled in a form: in that case, use the options above.

7. Information security

We apply reasonable technical and organizational measures to protect your information:

• Encryption in transit: all communication with the application uses mandatory HTTPS.
• Provider-level encryption at rest: the database (Neon PostgreSQL) and file storage (Cloudflare R2) encrypt data at rest with AES-256 through each infrastructure provider's native encryption. Conboxi does not apply additional application-level or field-level encryption to that data.
• Passwords hashed with bcrypt: we never store passwords in plain text.
• JWT authentication with expiration: session tokens have a limited lifetime.
• Invisible captcha (Cloudflare Turnstile) at sign-up to stop bots.
• Rate limiting on sensitive endpoints (login, password recovery, etc.).
• Account lockout after several consecutive failed attempts to mitigate brute-force attacks.
• WhatsApp verification with a 6-digit code before enabling the channel.
• Mandatory proof-of-delivery photo as operational evidence when a package is delivered to a home address.
• Multi-tenant isolation: each agency's data is separated at the application level.

No system is 100% invulnerable. If we detect a security incident that affects your personal data, we will notify you within the deadlines required by the applicable law.

8. Cookies and similar technologies

Conboxi only uses the browser's localStorage to store your session JWT, which lets you stay signed in between visits.

We do not use tracking or advertising cookies. We have no Facebook, Google Ads or similar pixels. We do not sell behavioral profiles.

This refers to this website: we do not load any pixel on its pages. Separately, if your agency turned on Meta ad measurement and you came from one of its ads, our servers report some stages of your relationship with the agency to Meta. We explain this in Section 2, item g, together with how to object.

9. Minors

The Conboxi service is NOT directed at people under 18. We do not knowingly collect personal data from minors. If we find that an account has been created on behalf of a minor, we will delete that account and the associated data.

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in the technology we use or in applicable law. When we make significant changes, we will notify you at least 30 days in advance through a notification inside the application, and we will update the "Last updated" date at the top of this document. If you keep using the service after the changes take effect, you will be deemed to accept them.

11. Applicable legal framework

The data controller is Celeste Chang Cuarezma LLC (Miami, Florida, United States), which operates the service under the trade name Conboxi. Accordingly, the processing of your data is governed by the applicable law of the United States and, extraterritorially, by the personal data protection law of the country where you reside when that law applies to the processing. We take as reference, among others, the following laws of the LATAM countries where the service operates:

• Colombia: General Habeas Data regime — Law 1581 of 2012 (Ley 1581 de 2012) and its regulatory Decree 1377 of 2013.
• Mexico: Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP) and its regulations.
• Brazil: General Personal Data Protection Law (Lei Geral de Proteção de Dados Pessoais, LGPD, Lei nº 13.709/2018) and the Brazilian Internet Civil Framework (Marco Civil da Internet, Lei nº 12.965/2014), applicable when there are Brazilian customers.
• Other personal data protection laws of LATAM countries that apply depending on the user's country of residence (Peru, Argentina, Chile, Ecuador, etc.).

Conboxi is directed at customers residing in Latin America and does not deliberately offer the service to residents of the European Union, so the General Data Protection Regulation (GDPR) does not ordinarily govern this processing.

12. Data controller contact details