Privacy Policy

The data controller responsible for processing your personal data is Sergio Ballestero, an individual (sole proprietor) with Paraguayan RUC No. 3.733.394-1, domiciled at Teodoro Rojas casi Juana Paula Carrillo, Asunción, Paraguay, operating under the trade name "Welcomy" ("the Platform"). This policy explains how we collect, use, and protect your information when you use our queue management platform. For personal data inquiries: [email protected] or WhatsApp +595 971 268080.

Two roles. For user-account and website data, Welcomy is the controller. For the visitor data that a business client manages through the Platform, the business is the controller (it determines the purposes and warrants the legal basis, including for minors) and Welcomy acts as processor, handling it solely on the business's behalf and instruction, under the Data Processing Agreement, which forms part of this policy. See the Visitors section.

This section is for people who take a ticket, book, follow an order or answer a survey at a business that uses Welcomy.

• Who decides about your data. The business serving you is the controller: it decides what data it asks for (for example, your ID at the kiosk) and why, and it is the one that obtains the legal basis to process it. Welcomy is its technology provider and processes your data only on that business's behalf, under the Data Processing Agreement.
• What data. What the business asks for or you leave: ID number, name, email (for the survey or the booking), phone number if you ask for WhatsApp notices or write to that number, your booking details, your survey answers and comments, and the times of your visit. Welcomy does not record clinical information, diagnoses or results.
• WhatsApp notices. Only if you write to us from your phone; the message that opens when you scan the QR names the business. Reply BAJA (or STOP) to stop them.
• Comments and surveys. At businesses that use AI analysis, your comments may be sent, without your name or ID, to an AI provider (Google or Anthropic, or the one the business configured) to summarise them. We say so under the comment box. Do not include personal or health information.
• Your rights. To access, correct or delete your data, ask the business that served you. If you write to [email protected], we pass the request on and help it answer you.
• How long. Visitor records are anonymised after 2 years (see "Data Retention").

We collect the following categories of personal data:

• Visitor Data (on the business's behalf): identification number (cédula/RUC), name (when provided), email (when left to receive the survey or a booking code), phone number (when the visitor opts in to ticket, booking or order updates via WhatsApp, or writes to the WhatsApp number), booking data (date, time, service, branch and any notes added), satisfaction-survey answers and comments, notes the business's staff add to the visit, and queue interaction data (ticket or order number, service selected, wait times). Welcomy records only attendance data (that the person took a ticket and was served); it does not collect or store clinical information, diagnoses, or results.
• User Account Data: First name, last name, email address, username, profile photo and, if you turn it on, your two-step verification settings.
• Billing Data: For customers on a paid subscription, we collect business name, RUC/CI (tax ID), address, and data required to issue the legal invoice. Card data is processed and stored in tokenized form by our payment processor (Adams Pay); Welcomy does not store full card numbers.
• Technical Data: IP address (for rate limiting and security), browser user agent, and session cookies.
• Usage Data: Service interaction timestamps, queue statistics, usage patterns and, in the app, product analytics and session recording (with text and fields masked) to improve the service.

We process your personal data for the following purposes:

• Providing queue, order and booking management services (ticket generation, queue tracking, WhatsApp and email notices, surveys), on behalf of the business serving the visitor.
• User authentication and account management.
• Charging subscriptions and issuing the legal invoice.
• Generating analytics and reports for the business (including, on the plans that have them, AI summaries) and for service improvement, with product analytics.
• Ensuring platform security (rate limiting, fraud prevention, audit log).
• Measuring the effectiveness of our own ads on Meta (Facebook and Instagram), as described under Cookies & Analytics.
• Sending service-related communications (ticket status, account and billing notices) and, only if you accepted it, news and offers.
• Complying with legal and tax obligations.

Automated decisions. We do not take decisions based solely on automated processing that produce legal effects on people or significantly affect them. The AI analyses are summaries and suggestions for the business, which decides what to do with them.

We process data based on:

• Visitor data: the legal basis is determined and obtained by the business serving the visitor, as controller — for example, the consent given when identifying at the kiosk, handling the booking or ticket the person requests, or the business's legitimate interest in organising its service; Welcomy processes the data on its behalf. When a visitor writes to us on WhatsApp to receive notices, that message is their express request.
• Contract Performance: Processing necessary to provide the service to businesses and their registered users.
• Consent: Commercial emails (separate, optional box) and, in the European Economic Area and the United Kingdom, website analytics and ad measurement.
• Legitimate Interest: Platform security, fraud prevention, service improvement, and usage analytics and the measurement of our ads outside Europe, which you can object to with "Decline".
• Legal Obligation: Invoicing and tax record-keeping, and compliance with Paraguay's Law 7593/2025 on Personal Data Protection.

We retain personal data for the following periods:

• Visitor records: Anonymized after 2 years. Identification numbers and personal details are removed; only anonymized statistical data is retained.
• Account deletion: When you delete your account it is deactivated immediately and you are signed out. Your personal information (name, email) is kept for 30 days and then anonymized. During those 30 days you can restore access by contacting support. Deleting your account does not delete your business's data or affect other users in your account.
• Inactive business accounts: If a business has no active paid subscription and no administrator signs in for 1 year, we notify the account administrators by email; if there is still no sign-in after a further 30 days, we anonymize the business's visitor and appointment records.
• Audit log: Relevant security and administration actions (what was done, who did it — including their email —, from which IP address and when) are kept in a log that cannot be modified or deleted, as evidence in case of incidents. It is kept for 5 years; after that, we anonymize the email and IP address of each entry and keep only what was done and when. Anonymizing an account before that period does not reach that log.
• Other technical logs: Public API usage logs (including the IP address) are kept for 12 months, and the encrypted content of those requests for 30 days; notifications we receive from providers (payments, WhatsApp), 90 days; and the exchange with the payment processor, 400 days.
• WhatsApp notices: The link between a phone number and the visit it asked for notices about is deleted after 90 days.
• Consent records: Retained for the duration of the processing relationship plus 5 years for legal compliance.
• WhatsApp opt-out list: If you reply BAJA (or STOP, or DESUSCRIBIR) to a WhatsApp message from a business using Welcomy, we record three things on a suppression list: your phone number, which of those words you sent, and the date. That list is the only thing that stops the messages, so it has no expiry date and is not deleted when a business or an account is deleted — it is held outside any single business's data and has no business attached. It is removed only when you ask to hear from us again (see Help). The legal basis is honouring your objection (Law 7593/2025, withdrawal of consent).

Residual copies may persist in the encrypted backups until they are overwritten on their normal cycle: up to 14 days for the database backups and 7 days for the server snapshots. When a business's service ends, it may ask for an export of its data for 30 days; after that we delete or anonymise it within the following 30 days. We may retain certain data longer where required by law.

Under Law 7593/2025 and other applicable data protection laws, you have the following rights:

• Access: Request a copy of all personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Deletion: Request deletion or anonymization of your personal data.
• Data Portability: Receive your data in a structured, machine-readable format (JSON).
• Withdrawal of Consent: Withdraw previously given consent at any time.
• Objection: Object to processing based on legitimate interests.

To exercise them, use the "Data & Privacy" section in your account settings, or write to [email protected]. We answer within 30 calendar days of your request.

If you are a visitor of a business, address your request to that business, which is the controller; if it reaches us, we pass it on and help it answer you within the same period.

If you are not satisfied with the answer, you may complain to the Agencia Nacional de Protección de Datos Personales, the supervisory authority under Law 7593/2025.

Welcomy is hosted outside Paraguay, so data is transferred to and stored in other countries:

• United States: Hetzner (application and database servers, in Ashburn, Virginia), Meta (WhatsApp and ad measurement), Google (Gemini, sign-in and, on the website, Analytics and Fonts), Anthropic (Claude), Cloudinary (images) and Microsoft (sign-in).
• European Union: PostHog (product analytics) and Brevo (email).
• Cloudflare's global network: DNS, content delivery and site protection; encrypted backups are stored in Cloudflare R2.
• Paraguay: Adams Pay (payments) and Goekua (electronic invoicing).

Safeguards. We work with providers that take on contractual data-protection commitments (data processing agreements and, where the provider offers them, standard contractual clauses), with encryption in transit and at rest, and with access limited to what is needed to provide the service. The per-provider detail is in the Data Processing Agreement, and we notify changes to that list. When the regulations of Law 7593/2025 set the requirements for these transfers, we will adjust to them.

Welcomy uses the following types of cookies and local storage:

• Essential cookies: Authentication session cookies (required for the platform to function).
• Preference cookies: Language preference, cookie consent status, and UI settings.
• Product analytics cookies: We use PostHog to measure platform usage and improve the service. This includes an analytics identifier (a cookie on the welcomy.io domain) and session recording in the admin app, with automatic masking of all input fields and sensitive data (names, ID numbers, phone numbers). We do not use this data for advertising and we do not sell it.

The app uses no advertising cookies. On the website (welcomy.io), the Meta Pixel writes _fbp and _fbc, only to measure our own ads and subject to your choice in the banner (see Cookies & Analytics).

Usage analytics in the app. The app (app.welcomy.io) applies the same two regimes described under Cookies & Analytics. Outside the European Economic Area and the United Kingdom — including Paraguay — usage analytics run by default, to understand how the platform is used and improve the experience. Choosing Reject in the banner stops them: from that moment no analytics data is collected from your browser, and your choice is remembered. We never sell this data or use it for advertising.

Account events. When a business account is created and its initial setup is prepared, our servers record it — the sign-up method, the plan and that setup — linked to the account, together with where the visit that led to the sign-up came from, if anywhere: the campaign parameters of the link (utm_*), an ad click identifier (gclid or fbclid) and the site you arrived from (the address only, without parameters). We use it to know which channels bring new businesses. These records are made by our servers as part of providing the service, not collected from your browser, so they do not depend on the banner.

Conversions reported to Meta. If you arrived from a Meta ad (Facebook or Instagram) — that is, with an fbclid click identifier — our servers tell Meta, through its Conversions API, that the account was created and, if you later buy a paid plan, that purchase and its amount. We send: your email, irreversibly hashed (SHA-256), a hashed account identifier, the click identifier, the Meta Pixel browser identifier (the _fbp cookie, only if you did not reject cookies on the site), the plan, and the IP address and browser you signed up from. Meta uses them to attribute and optimise our ads. If you chose Reject on the website before going to the app, the click identifier never reaches it and nothing is reported (if you had already opened the app before rejecting, the app keeps it for up to 30 days); the exception is an ad that links straight to app.welcomy.io, without passing through the website or its banner. If you did not arrive from a Meta ad, nothing is reported to Meta.

Two analytics services run on this site: Google Analytics (traffic, pages, referral source) and PostHog (product analytics, shared with the app at app.welcomy.io so that the visit and the sign-up read as one journey). Between them they record pages visited, time on site, where you arrived from, and clicks. PostHog may also record a replay of the session, with every form field masked — nothing you type is captured.

Ad measurement (Meta). The Meta Pixel also runs, only to measure our own ads on Facebook and Instagram: it records each page visit, whether you tap a button to create an account and whether you tap one to contact us (WhatsApp, email or Instagram), and writes the _fbp cookie and, if you arrived from an ad, _fbc. It follows exactly the same consent regimes as the analytics below.

When they load, and why it depends on where you are. We apply two different regimes, because the rule that binds is not the same everywhere. If you arrive from the European Economic Area or the United Kingdom, nothing loads until you accept: analytics stay switched off while the banner waits for an answer, and if you reject it or ignore it, not one script is requested. From the rest of the world — including Paraguay, where the product is sold — we measure by default from the moment the page loads, and stop the moment you tell us not to. That is a deliberate choice rather than an oversight, and an earlier version of this policy stated that nothing was collected unless you accepted: that was not accurate, and this section replaces it.

How we know where you are, and what we do NOT do with it. Cloudflare, which serves this site, derives the country from your IP address — something it already knows in order to deliver the page — and passes us only that country code, in a technical cookie (wy_geo, 24 hours). We do not store your IP, and we do not use it to profile you or to vary the content: it decides which of the two regimes above applies to you, and nothing else. If that value does not reach us for any reason, we measure by default, as for the rest of the world, and every event records that the country was unknown — so a failure on our side shows up in our own numbers instead of passing unnoticed.

Under either regime, choosing Reject in the banner stops all three services: Google Analytics stops using cookies and storing analytics data (Google Consent Mode), and PostHog stops recording at that same moment. The Meta Pixel stops sending at that moment too. Your choice is saved in your browser, so on later visits the Meta Pixel is not loaded — its script is never requested — and PostHog only counts the visit: it records that a page was viewed, with no cookies or storage in your browser, no clicks, no session recording and no identifier of yours. To avoid counting the same visit twice, PostHog computes a code on its servers from your IP and browser with a key that changes every day; your IP is not stored and that code cannot recognise you from one day to the next. Rejecting also deletes Meta's cookies (_fbp, _fbc) and any PostHog identifier left from before. From the European Economic Area or the United Kingdom, by contrast, nothing loads if you reject, not even this count. PostHog loads and sends its data through a subdomain of ours (e.welcomy.io), which forwards it to PostHog in the United States; that is why a content blocker may not stop it, while it does block Google Analytics. What decides is your choice in the banner: if you tap “Reject”, PostHog stops recording what you do at that moment and, from the next page on, only counts the visit as described above.

What is stored in your browser. Your consent preference, in localStorage (key wy_cookie_consent); and if we showed you the exit notice, a flag in sessionStorage (wy_exit_shown) whose only job is not to show it again, cleared when you close the tab. Neither is a cookie and neither tracks you across sites. Separately, wy_geo — the country code described above, 24 hours, technical and necessary to know which consent regime applies to you. Actual tracking cookies are set by the providers: Google Analytics uses _ga and _ga_*, and PostHog uses ph_* on .welcomy.io so the same visit is recognised across this site and the app. If you reject, none are written.

Your IP. In Google Analytics 4, IP addresses are dropped on receipt and never stored — that is not a setting we switch on, it is how the product works; an earlier version of this policy credited an 'IP anonymization' toggle that GA4 no longer has. PostHog receives your IP as part of the connection itself and uses it to derive an approximate location. We do not keep your full IP in either case.

Fonts are served from Google Fonts, and it is worth stating precisely: they are requested when the page loads, on every page including the legal ones, and before you answer the banner — like any externally hosted asset. That means Google receives your IP address and your browser. They set no cookies and are not part of analytics; if you would rather avoid it anyway, a content blocker prevents it and we do not work around that.

You can change your cookie preference at any time by clearing your browser's localStorage or site data for welcomy.io.

We rely on the following processors, which handle data only on our instructions and to provide the service:

• OAuth Providers (Google, Microsoft): When you choose to sign in with a social provider, we receive your name and email from the provider. We do not share your data back with them.
• WhatsApp / Meta Platforms: When a visitor opts in to WhatsApp updates, their phone number and the notification content are processed through the WhatsApp Business API (Meta) to deliver the messages.
• Adams Pay (payment processor): For paid subscriptions, payment data is securely processed and tokenized by Adams Pay. Welcomy does not store full card numbers.
• Google (Gemini API) and Anthropic (Claude): The AI analysis features send aggregated queue metrics and, for the satisfaction analysis, the text of visitor comments — never their name, ID number or ticket number. Staff names are pseudonymised before sending. They are used on their paid tier, under which the provider does not use submitted content or responses to train its models. Applies only to the plans that include these features. Enterprise customers can instead point this analysis at their own AI provider from Integrations — in that case, processing of that data is governed by that customer's own relationship with their provider, not ours with Google/Anthropic — and can turn off sending comment text to any AI provider, theirs or ours, while still getting a non-AI sentiment analysis.
• PostHog (product analytics): Usage data and session recording (with masking of sensitive data) to measure and improve the service.
• Infrastructure (Hetzner): The application and its database are hosted on Hetzner servers in the United States (Ashburn, Virginia); real-time queue state is held in our own Postgres on those servers. Your data is stored with encryption at rest and in transit.
• Cloudflare: DNS, content delivery and site protection (firewall, rate limiting and, on the booking form, Turnstile to tell people from bots), plus storage of the encrypted database backups.
• Cloudinary: Storage and delivery of the images and videos uploaded to the Platform (logos, display banners, profile photos).
• Brevo: Delivery of service emails (verification, sign-in codes, account and billing notices); it receives the recipient's address and the message content.
• Goekua (electronic invoicing): Issuing the legal invoice; it receives the billing details required (business name, RUC/CI, address and amount).

In addition, the website loads third-party services that process data under their own policies:

• Google Analytics: website analytics (traffic, pages, referral source), subject to your choice in the banner, as described under Cookies & Analytics.
• Google Fonts: the website's typefaces; when they load, Google receives your IP address and browser (see Cookies & Analytics).
• YouTube (Google): the intro video, loaded only if you play it.
• Meta (Pixel and Conversions API): measurement of our own ads on Facebook and Instagram, subject to your choice in the banner, as described under Cookies & Analytics and Cookies & Local Storage.

We do not sell or rent your personal data. The only time we share data for advertising purposes is the one described above: with Meta, to measure our own ads — never so that others can show you advertising.

We implement the following security measures to protect your data:

• HTTPS encryption for all data in transit.
• Rate limiting to prevent brute-force attacks.
• JWT-based authentication with session expiration.
• Role-based access control (Admin, User, Viewer, Creator).
• Optional two-step verification (2FA), with its secrets encrypted in the database.
• Rejection of passwords found in known breaches: we query the Pwned Passwords service sending only the first 5 characters of the password's hash, never the password or your email.
• HSTS: browsers connect to welcomy.io and its subdomains over HTTPS only.
• Daily database backups, with an encrypted copy kept off the main server.
• Input validation and sanitization to prevent injection attacks.
• Regular security audits and automated testing.

If a security breach affecting personal data occurs, we investigate and contain it immediately. Where the law requires it, we notify the Agencia Nacional de Protección de Datos Personales and the people affected within 72 hours of becoming aware of it, with what is known at that point: what happened, what data is involved, what we did and what you can do.

If the data affected belongs to a business's visitors, we notify that business within 24 hours, as the Data Processing Agreement provides, so it can meet its own duties.

Our service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately at [email protected].

This Privacy Policy is governed by the laws of the Republic of Paraguay, in particular Law 7593/2025 on Personal Data Protection, enacted in 2025 and fully enforceable from November 2027. We adopt it now as the standard we process your data by. Its supervisory authority is the Agencia Nacional de Protección de Datos Personales (National Personal Data Protection Agency).

For users in the European Union/European Economic Area, the provisions of the General Data Protection Regulation (GDPR) also apply where relevant.

We do not sell your personal data.

We may update this policy. If a change is substantial, we give at least 30 days' notice by email to registered accounts and inside the app, and the users of business accounts accept it as described in the Terms of Service. Minor changes are published on this page with their "Last updated" date.