Privacy Policy

This policy explains what Paco Webs ("Paco Webs," "we") collects, why, and your choices.

1. What we collect

You give us:

• Account info: name, email, phone, business name, trade, profile photo.
• Business and website content: details, hours, service areas, photos, logos, text, menus, prices, social links.
• Marketplace activity: listings, photos, messages with other users, reviews, reports, business claims.
• Orders and payments: name, business, email, phone, what you bought, coupon codes, payment status. Card details go directly to Stripe; we only receive limited info such as card type and last four digits.
• Messages to us: contact form, support requests, tool ideas, quote requests.
• Tips: amount, and optionally your business name and website for the Supporters Wall.

Collected automatically:

• Device and usage data: pages viewed, features used, clicks on news sources, a random device identifier, browser type, approximate location from IP address.
• Browser storage: drafts, cart, language and preferences saved in your browser so your work isn't lost.
• Advertising pixel: the Meta (Facebook) Pixel measures our ads, such as page views and checkouts. Meta may receive your IP address, browser details and cookie identifiers.

From your website's visitors (on your behalf):

• When someone fills out a contact form, booking request or food order on a site built with Paco Webs, we collect their name, email, phone, message or order, and a one-way scrambled ("hashed") IP address to block spam. We deliver this to the site owner, who decides how to use it. For requests about that information, contact the business first; you can also reach us through our contact page and we'll forward it.

From others:

• Directory information from public sources or other users; information from payment and sign-in providers.

2. How we use it

• To run the Services: accounts, publishing, listings, messages, orders, domains, subscriptions.
• To keep people safe: screening listings, photos and messages for scams and inappropriate content (including automated and AI checks), handling reports, preventing fraud and abuse.
• To process payments and send receipts, renewal notices and service messages.
• To provide support.
• To measure and improve the Services and our advertising.
• To comply with law and enforce our Terms.

We don't sell your personal information for money.

3. AI processing

Some features send content to AI models through our providers (Lovable's AI gateway, which uses models from companies such as OpenAI). For example, marketplace photos and text are checked for safety, and copy you ask the AI to write is generated from what you type. We use these providers to deliver the feature, not to build public profiles of you.

4. Who we share with

• Other users and the public: your public website, listings, reviews, business profile and (if you choose) Supporters Wall entry are public and may be indexed by search engines. Messages go to the person you're talking to.
• Service providers working for us: hosting, database and file storage (Lovable Cloud / Supabase), payments (Stripe), AI (Lovable AI gateway and its model providers), email delivery, domain registration, booking partners.
• Advertising and measurement: Meta, through the Pixel. This may count as "sharing" for targeted advertising under some state laws — see Your choices.
• Legal and safety: when required by law, or to protect users, the public or us.
• Business transfers: in a merger, acquisition or sale of assets.

5. How long we keep it

We keep account data while your account is open. When you delete your account, we delete or anonymize your personal information within 30 days, except what we must keep for legal, tax, fraud-prevention or dispute reasons (for example order records up to 7 years). Backups roll off on a regular schedule. Visitor inquiries stay in the site owner's portal until the owner deletes them.

6. Your choices and rights

• Access, correct, delete or download your information: use Your Portal or our contact page. We respond within 45 days.
• Opt out of targeted advertising: contact us with "Opt out" as the subject. You can also block third-party cookies or use Meta's ad settings. We honor Global Privacy Control (GPC) signals where required.
• Marketing emails: use the unsubscribe link.
• Appeals: if we deny a request, reply to our decision to appeal. Depending on where you live (for example Connecticut or California) you may have additional rights under state law. We won't discriminate against you for using them.

7. Security

We use encryption in transit, access controls, database row-level security and trusted providers. No system is perfectly secure, so use a strong password and keep your login private.

8. Children

The Services aren't meant for children under 13, and accounts require users 18 or older. We don't knowingly collect data from children under 13. If you believe a child gave us information, contact us and we'll delete it.

9. Changes

We'll post updates here and change the date. For significant changes we'll give notice on the site or by email.

10. Contact

Reach us through our contact page.