Privacy

Luna Azul is a tool for running an agency. The data your team enters belongs to your agency. We don’t read it, sell it, share it with third parties, or use it to train artificial-intelligence models. We don’t build profiles of your customers across agencies. We don’t serve advertising on the basis of your data.

• What your team enters into the product: agency settings, customers, contacts, shipments, sales, remittances, recharges, invoices, schedule events, and the messages you send.
• Operational metadata that any web app collects: IP address at sign-in, browser user-agent, the URLs visited inside the dashboard, and timestamps. Used for security, support, and abuse prevention.
• Stripe billing identifiers when you subscribe. Card numbers themselves never touch our servers — Stripe holds them.

Application data lives in Supabase (Postgres) hosted in the United States. Files (ID scans, package photos, signatures, data-export bundles) live in Supabase Storage in the same region. Data is encrypted at rest by the database/storage provider and encrypted in transit (TLS) between your browser and our servers.

We implement administrative, technical, and physical safeguards designed to protect customer information from unauthorized access, disclosure, alteration, or destruction.

While we use commercially reasonable security measures, no method of transmission over the Internet and no method of electronic storage is completely secure. Therefore, we cannot guarantee absolute security of any information transmitted to or stored within our systems.

• Your agency’s users. Each tenant’s data is isolated by row-level security at the database layer.
• Our staff (during support). Access is logged. Cross-tenant read/write actions by RMS staff are recorded in an audit table the tenant can review. We do not bulk-query customer data.
• Other tenants: never. RLS prevents this; we double-check during data exports.

Sign in, go to Settings → Data & Cancellation, click “Request export.” A ZIP bundle is generated within minutes and emailed to the agency owner. The bundle is available for 7 days. CSV (open in Excel) plus JSON (lossless) for every table.

Same page: Settings → Data & Cancellation → Cancel my account. We queue a final export and schedule deletion in 7 days. During that grace window you can reactivate at any time, no questions asked. After the deadline, every row of every table tied to your agency is hard-deleted, every file in Storage is removed, and the tenant record itself is dropped. We don’t keep an encrypted backup. Once the 7-day window closes, recovery is not possible.

Depending on your location, you may have certain rights regarding your personal information, including:

• The right to access the personal information we maintain about you.
• The right to request correction of inaccurate information.
• The right to request deletion of your information, subject to legal and operational requirements.
• The right to request a copy of your information in a portable format.
• The right to withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at support@paracubasolutions.com. We may require verification of your identity before fulfilling a request.

We will respond within a reasonable timeframe and in accordance with applicable law.

We don’t sell, rent, or otherwise share your data with third parties. Operational sub-processors are limited to: Supabase (hosting), Stripe (billing), Resend (email delivery), Twilio (SMS delivery). Each handles only the slice of data required to deliver its function.

We don’t use customer data, agency data, message content, or shipment data to train any artificial-intelligence model — ours or a third party’s.

Operational data: kept while your account is active. After cancellation: 7-day grace window, then full purge. Email-send logs: 90 days. Audit logs of platform-level access: kept indefinitely (this is the “who saw what” trail, not customer data).