Privacy Policy – Boxha Boox App

Last updated: July 27, 2026 · Version 2

1. Identity and address of the data controller

Rafael Orozco Zamudio ("Boxha Boox" or the "Controller"), with address at Agustín Melgar y Simón Morúa S/N, C.P. 83550, Puerto Peñasco, Sonora, Mexico, is the party responsible for the processing of personal data collected through the Boxha Boox mobile application (the "App"), in accordance with Mexican legislation on the protection of personal data held by private parties.

2. Personal data we collect

2.1 Data provided by the user

First and last name: to identify the account and personalize communication.
Phone number: the account's primary identifier; verified via SMS code.
Email address: verified via code; used for account-related communications.
Password: stored only in encrypted (hashed) form; never in plain text.
Date of birth (optional): the user may choose whether to provide it; see secondary purposes.

2.2 Data generated by use of the service

Session and security data: last login date and IP address, to protect the account against unauthorized access.
Device data: operating system, model, and push notification token, for delivering notifications; in support tickets, also the OS version and App version, for diagnostic purposes.
Transactional history: orders placed (products, notes, amounts, status, pickup code), cashback movements and balance, and coupons used.
User-submitted content: ratings, comments, photos, and videos in order feedback and support tickets.
Acceptance records: a record of the version of the terms and of this policy accepted by the user, as proof of consent.
Fraud-prevention records: associated with the phone number, including registration dates, registration IP address, and the number of registrations made, to prevent abuse of bonuses and benefits.

2.3 Payment data

Card data (number, expiration date, security code) is captured and processed directly by Stripe, our payment processor, from the user's device and under Stripe's privacy policy (stripe.com/privacy). Boxha Boox does not receive, process, or store card data; it only records the amounts and payment status of each order.

We do not collect sensitive personal data.

3. Purposes of processing

3.1 Primary purposes (necessary for the service)

Creating, verifying, managing, and protecting the user's account.
Processing orders and payments, generating pickup codes, and managing the order lifecycle.
Operating the cashback program: earning, use, and adjustments of the balance.
Applying coupons and promotions.
Sending transactional communications related to the account and orders (e.g., verification codes, confirmations, status updates, and push notifications).
Providing support and handling tickets, including technical diagnostics.
Preventing fraud and abuse, including the repeated registration of accounts to obtain bonuses.
Complying with legal and tax obligations and with requests from competent authorities.

3.2 Secondary purposes (not necessary for the service)

Sending promotional communications, offers, and news by email or push notification.
Producing internal statistics, including analyses using the date of birth where the user has provided it.
Possible birthday benefits or rewards that may be implemented in the future.

The user may refuse the processing of their data for secondary purposes without affecting their use of the service, either through the options available in the App, through the unsubscribe link included in each promotional communication, or by sending a request to the contact email indicated in Section 9. The date of birth is optional, and the user may remove it from their profile at any time.

4. Minors

The App is intended for individuals 15 years of age or older. For users between 15 and 17 years of age, the processing of their personal data is carried out on the understanding that they have the authorization of their parent or legal guardian, who may exercise on their behalf the rights set out in this policy.

5. Processors and transfers

We do not sell personal data. To operate the service, we share data with providers that process it on behalf of and under the instructions of Boxha Boox (data processors):

Twilio: delivery of SMS verification codes.
Google / Firebase: delivery of push notifications.
Stripe: payment processing (it also acts as a controller with respect to the card data it captures directly).
DigitalOcean: server infrastructure, database, and file storage.
Email provider: delivery of transactional and, where applicable, promotional emails.

These providers may be located outside Mexico (mainly in the United States) and are contractually required to protect the data in accordance with this policy. The point-of-sale platform used by the establishment is part of the operations of the same Controller; therefore, the exchange of order and sales information with that platform constitutes internal processing and not a transfer to third parties.

Beyond the above, we will only transfer personal data where legally required by a competent authority or in the other cases provided by law, which do not require the data subject's consent.

6. Data retention and account deletion

We retain personal data for as long as the account remains active and for the periods necessary to fulfill the purposes described and the applicable legal obligations.

When the user requests the deletion of their account, the process is as follows:

Request: the deletion is scheduled and notified by email. During this stage the account remains usable and the request can be canceled, including by simply logging in again.
Deactivation: once there are no active orders, the account is deactivated and all sessions are immediately terminated.
Deletion: after a grace period of approximately 30 days from deactivation, identifying data is permanently and irreversibly deleted or anonymized: name, email, phone number, password, date of birth, session IP addresses, comments, notes, messages, photos and videos, registered devices, and sessions.

After deletion, we retain, in de-identified form (with no possibility of identifying the user), transactional records such as order amounts and items, ratings, and cashback movements, for statistical, accounting, and system-integrity purposes, as well as records of acceptance of legal documents as proof of consent.

Fraud-prevention retention: we retain the phone number and IP address associated with account registrations, together with the dates and number of registrations, even after account deletion. The sole purpose of this retention is to prevent abuse of bonuses and benefits through the repeated creation of accounts, and this data is not used for any other purpose.

Account deletion entails the permanent loss of the cashback balance.

7. Security measures

We apply administrative, technical, and physical measures to protect personal data, including: encryption of communications, storage of passwords exclusively as cryptographic hashes, short-lived and revocable sessions, access controls and server-side validation, request rate limiting, and secure management of infrastructure credentials. No system is infallible, but in the event of a security breach that significantly affects the rights of data subjects, we will provide notice as required by law.

8. ARCO rights and withdrawal of consent

The user (or their parent or legal guardian, in the case of minors) has the right under Mexican law to Access their personal data, Rectify it when inaccurate, Cancel (delete) it, and Object to its processing (known as "ARCO" rights), as well as to withdraw their consent and to limit the use or disclosure of their data.

Many of these actions can be performed directly in the App: updating name, email, phone number, and password; removing the date of birth; opting out of promotional communications; and requesting account deletion.

To formally exercise ARCO rights, the data subject must send a request to the email indicated in Section 9, including: (a) the data subject's name and a means of communicating the response; (b) documents or information proving their identity (for example, being able to verify control of the registered phone number or email); (c) a clear and precise description of the data with respect to which they seek to exercise any of the rights; and (d) any element that facilitates locating the data. We will respond within a maximum of 20 business days from receipt of the request and, if the request is granted, we will give effect to it within 15 business days following the response.

Cancellation (deletion) of data may not apply to data we must retain due to a legal obligation or for the fraud-prevention purposes described in Section 6.

If the data subject believes their data protection rights have been violated, they may file a complaint with the competent data protection authority in Mexico.

9. Contact

For any questions about this policy or to exercise your rights, write to: boxhaboox@gmail.com, or visit the Controller's address indicated in Section 1.

10. Users in the United States

The service is available to users located in Mexico and the United States. Users in the United States have the same rights of access, rectification, deletion, and opting out of promotional communications described in this policy, and may exercise them through the same channels. The App is not directed at children under 13 years of age.

11. Changes to this policy

We may update this privacy policy from time to time. We will publish any changes in this section and, where a modification substantially affects the processing of personal data, we will notify users through the App or the registered email address and, where appropriate, request the user's consent again. We recommend reviewing this policy periodically.