Privacy Policy

The controller of your data is the operator of falcongrow.com. For any privacy question, write to contacto@falcongrow.com.

• Account data: username, email address and password (stored as an irreversible hash).
• Purchases without an account: if you buy without signing up, we collect your email and the link where the service is delivered. We create an account with that email so you can follow your order and we send you a one-time link to choose your password; if an account with that email already exists, the order is added to it.
• Usage data: orders (including the link to the post or profile where each service is delivered), top-ups, transactions, support tickets with the content of their messages and, if you leave one, your review.
• Payment data: FalconGrow does not store card data. Payments are processed by third parties (see section 5). We keep the amount, the currency and the exchange rate applied, the payment reference and status and the payment provider; with some methods, also the email you paid with.
• Technical data: IP address, browser and device type, date and time of access, and server activity logs. From the browser we infer whether you use a phone, a tablet or a computer, and we store only that category.
• Where your visit came from: the page you landed on, the site that referred you, the campaign parameters of the link (UTM) and a random visitor identifier. When you sign up, we store them with your account along with the country you connected from (see sections 5 and 9).

We use your data to:

• Create and manage your user account.
• Process your top-ups and service orders.
• Send you necessary messages about your account and your orders (activation, password recovery, confirmation of top-ups and completed orders).
• Send you reminders and commercial messages about our own services: a payment you did not finish, unused balance or the option to repeat an order. Every one of those emails includes an unsubscribe link.
• Handle your support tickets and refunds.
• Detect and prevent fraud, abuse or unauthorized access.
• Measure where visits come from and which of them end in a sign-up, a top-up or a purchase, and measure and improve our ads (see section 9).
• Remember your language and your choice about measurement cookies.
• Comply with applicable legal obligations.

We never sell your personal data, and we do not send you third-party advertising.

The processing of your personal data is based on:

• Performance of a contract: processing is necessary to provide the services you purchased.
• Consent: by creating your account or making a purchase, you consent to the processing described in this policy. Measurement and advertising cookies have their own rule, explained in section 9.
• Legitimate interest: to keep the platform secure, prevent fraud and send you reminders about our own services, which you can opt out of at any time.

To provide the service, we share strictly necessary data with the following providers:

Payments

• PayPal (PayPal Holdings, Inc.): card and PayPal account payments. It receives the amount and the payment reference; you enter your details directly with PayPal. Privacy policy: paypal.com/privacy.
• NOWPayments: cryptocurrency payments. It receives the amount and the payment reference. Privacy policy: nowpayments.io/privacy-policy.
• Flow (Chile): local payments in Chile (WebPay, Khipu, MACH and bank transfer). It receives the amount, the payment reference and your email. Privacy policy: flow.cl.
• Mercado Pago: credit card, debit card and Mercado Pago account payments. It receives your account email and the top-up amount; card details are entered directly with Mercado Pago and FalconGrow never sees them. Privacy policy: mercadopago.cl/privacidad.

Service delivery

• Wholesale service provider: to run each order it receives the destination link you entered and the quantity. It does not receive your email, your name or your username.
• Automated support assistant: an artificial intelligence agent operated by FalconGrow, on a Contabo server (Germany), reads tickets, usernames and orders with their links to help answer them and handle refunds. To process that information it may rely on language model providers.
• Internal notifications: our team receives operational alerts through Telegram (Telegram Messenger Inc.) that may include your username, your email and the content of your tickets.

Email

• Sending: emails leave from our own mail server; if that delivery fails, they are re-sent through Resend (Resend, Inc., USA), which receives the recipient and the content of the message and reports bounces and complaints.
• Receiving: the emails you write to our addresses are received and handled in Gmail (Google LLC).

Measurement and advertising

• Google (Google LLC): Google Analytics 4 and Google Ads measure visits and conversions. They receive the address of the page visited, the referring page, browser and device data, your IP address and their cookie identifiers (see section 9).
• Meta (Meta Platforms, Inc.): the Meta Pixel measures visits and conversions from our ads. It receives the address of the page visited, browser and device data, your IP address and its cookie identifiers.
• We do not send Google or Meta your name, your email or your username, and we do not load their tools on the pages you reach through a verification or password-reset link.
• If you view the site in English or Portuguese, these tools only load if you accept the cookie notice (section 9).
• ipapi.co (IP geolocation): when you sign up, we send your IP address to this service to learn which country you connect from. We store only the country, not the IP.

Infrastructure

• DigitalOcean (DigitalOcean, LLC): our servers are hosted with DigitalOcean, in San Francisco (USA), covered by its data protection terms.
• Backups: a daily copy of the database is stored encrypted on a Contabo server (Contabo GmbH, Germany). That server cannot decrypt it.

We keep your personal data while your account is active. If you ask us to delete your account, we will remove your identifiable data within 30 business days of your request, except for data we must keep to comply with legal obligations or to resolve pending disputes.

What that means in practice: your account is left with no name, username or email, and no access; your sessions, your API key, the origin of your visit, your order links, the text and name of your reviews and the content of your tickets are erased. Money movements and orders are kept without data that identifies you, because the accounts must still balance. If you had a remaining balance, we refund or adjust it first; if you choose not to claim it, it stays frozen in the account.

Backups are kept 14 days on our servers and 30 days in the external copy, so deleted data may remain in them until they are rotated.

Financial transaction records (with no additional identifying data) may be kept for up to 6 years for accounting and legal compliance.

If you unsubscribe from our commercial messages, we keep your email on an exclusion list so we do not write to you again; if you also ask for your data to be deleted, it is removed from that list too. Internal operational logs are deleted after 90 days.

We apply technical and organizational measures to protect your personal data, including:

• Encryption in transit with TLS 1.2/1.3 (HTTPS).
• Passwords stored with a cryptographic hash (PBKDF2).
• Sessions that expire automatically (72 hours) and are closed when you log out or change your password. The reseller API key is a separate credential and only changes if you regenerate it.
• Encrypted backups.
• Role-based access to data (least privilege).
• Access monitoring and alerts on anomalies.

No security system is infallible. If a breach affects your data, we will notify you as soon as possible.

Under Law No. 19,628 you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Deletion: request the erasure of your data when it is no longer necessary (see section 6).
• Objection: object to the processing of your data in certain circumstances, including commercial messages.

To stop receiving commercial messages, the unsubscribe link in each one is enough. To exercise any of the other rights, send your request to contacto@falcongrow.com stating your username and the right you wish to exercise. We will reply within 15 business days.

We use cookies and your browser's local storage. Some are necessary for the platform to work; others let us measure visits and our ads, and some are set by Google and Meta.

If you view the site in English or Portuguese, the first thing you see is a cookie notice: until you answer it, Google Analytics, Google Ads and the Meta Pixel are not loaded, and our own measurement cookies (fg_attr and fg_sid) are not stored either. If you reject, your visits are not measured in any language and any measurement cookies already stored are deleted. If you view the site in Spanish, measurement works from the start unless you rejected it earlier.

Necessary

• auth_token (cookie): keeps you signed in. It is not accessible from JavaScript and lasts 72 hours.
• token, is_logged_in, login_ts (local storage): keep your session in the browser. They are cleared when you log out and stop being valid after 72 hours.
• sessionid, csrftoken (cookies): only in the internal admin panel.
• fg_pago_iniciado (tab storage): lets you resume a payment if you go back during the process. Discarded after 30 minutes.
• fg_correo_pendiente (tab storage): shows the address we sent your account activation to. Cleared when you close the tab.

Preferences

• fg_lang (cookie): the language you chose. Lasts 1 year.
• fg_consent (cookie): your answer to the cookie notice. Lasts 6 months, after which we ask again.
• fg_favorites_v2, onboarding_banner_dismissed (local storage): your favourite services and the notices you already dismissed.

Our own measurement

• fg_attr (cookie): the page you landed on, the site that referred you and the campaign parameters of your first visit. Lasts 30 days.
• fg_sid (local storage): a random visitor identifier used to measure experiments and where sign-ups come from. It does not expire; you can delete it from your browser.
• fg_exp_* (tab storage): which version of a page we showed you in an experiment. Cleared when you close the tab.

Third parties

• Google Analytics 4 and Google Ads (_ga, _ga_*, _gcl_au): measure visits and conversions. Google sets their duration, up to 2 years.
• Meta Pixel (_fbp): measures visits and conversions from our ads. Meta sets its duration, usually 90 days.

How to control them

In English and Portuguese you can change your answer at any time from "Cookie preferences" at the bottom of the page. In any language you can block or delete cookies and local storage from your browser settings; if you block the necessary ones, you will not be able to stay signed in. For Google measurement you can also use its opt-out add-on (tools.google.com/dlpage/gaoptout) and manage your ads at myadcenter.google.com; for Meta, in your account's ad settings (facebook.com/adpreferences).

Your data may be processed outside Chile: in the United States (DigitalOcean, Google, Meta and Resend), in Germany (Contabo) and in the countries of the other providers listed in section 5. These transfers are made with the appropriate safeguards under applicable Chilean law.

We may update this Privacy Policy from time to time. We will notify you of any material change by email or with a visible notice on the platform. Continuing to use the services after changes are published means you accept the updated policy.

For any question, request or complaint about the processing of your personal data: contacto@falcongrow.com