Privacy Notice

The short version. We only ask for what we need to stock your villa and look after you during your stay. We never see or store your card details — payments are handled directly by Stripe. We do not sell your information, ever. You can ask us at any time what we hold about you, correct it, or ask us to delete it.

1. Who is responsible for your information

SEANJUAN, S. de R.L. de C.V., doing business as Blue Desert Cabo ("we", "us"), operating the Groceries Cabo Delivery service, with address at Calle Bahía Las Palmas Local 02, Col. Campo de Golf, C.P. 23405, San José del Cabo, Los Cabos, Baja California Sur, Mexico, is responsible for the personal information described in this notice.

For anything related to your privacy, write to bluedesert@bluedesertcabo.com.

2. What we collect, and why

Information	Why we need it
Your name, email and phone number	To confirm your order, send your receipt and reach you if something needs to be substituted.
Villa name or delivery address, arrival and departure dates	To deliver to the right place, at the right time, before you arrive.
Number of guests (adults and children)	To size chef services, butler coverage and transport correctly.
Your order and any notes or substitution preferences	To shop for you and to keep a record of what was delivered.
WhatsApp messages, photos and files you send us	To answer you and keep the history of your request in one place.
Allergies and dietary requirements	Only when you book a chef or a meal service — so we do not serve you something that could harm you. This is health information and we treat it as sensitive: see section 3.

What we do not collect

• Card numbers, expiry dates or security codes. When you pay, you are on Stripe's own secure page. Those details never touch our systems. All we keep is a payment reference and the amount.
• Passports, official identification or immigration documents.
• We do not ask for information about children beyond how many are in the party.

3. Sensitive information (allergies)

If you book a private chef or a meal service, we ask about allergies and dietary requirements. Under Mexican law this counts as sensitive personal data, and we need your express consent to handle it — which is why you are asked to tick a box before sending it.

We use it for one purpose only: so that the chef preparing your food knows what not to serve you. We share it with the chef assigned to your stay and with nobody else. If you would rather not share it in writing, tell your coordinator and they will arrange it directly with the chef.

4. Who else sees your information

We do not sell or rent your information. We share only what is strictly necessary, and only with:

• Stripe — to process your payment securely.
• Brevo — to send you your confirmation and receipts by email.
• Meta (WhatsApp Business) — if you choose to write to us on WhatsApp.
• Cloudflare — which hosts this site and stores your order.
• Google Analytics — usage statistics, including the items and amount of a completed order (see section 6).
• The service provider assigned to you — your chef, butler or driver receives your name, the villa, the date and the time. They do not receive your payment details or what you paid. Only a chef preparing your food receives your allergy information.

Some of these providers store information outside Mexico. By using the service you accept that international transfer, which is limited to the purposes described above.

We may also disclose information if a competent authority requires it by law.

5. How long we keep it

We do not keep things forever. These are our actual retention periods:

What	How long
Orders, receipts and delivery records	6 months
Refund records	1 year
Stay records, quotes and provider payment records	2 years (accounting)
WhatsApp conversations, photos and files	2 years
Enquiries sent from the website forms	3 months
Your login session (team members only)	12 hours, or 30 days if you tick "remember me"

After those periods the information is deleted automatically. We may keep anonymous totals — for example "how many orders were delivered in July" — which no longer identify you.

6. Cookies and similar technology

This site uses very few, and none of them for advertising:

• Your basket — kept in your own browser so you do not lose your list if you close the tab. It never leaves your device until you place the order.
• Your concierge's referral link — if you arrived through a personal link from one of our coordinators, we remember it for 30 days so your order is credited to them.
• Google Analytics (GA4) — usage statistics, so we know what to improve: which pages are visited, what is typed into the shop search, when an item is added to the basket, when a checkout is started, when the WhatsApp button is tapped, and — for a completed order — the order number, the amount, and the list of items purchased. Your name, e-mail, phone number, villa address and payment details are never sent to Google. You can opt out with Google's opt-out add-on.
• Microsoft Clarity — shows us anonymously how the site is used (what is clicked, how far people scroll) and records the session so we can find what is broken. Text fields, e-mail addresses and payment details are masked automatically and are never recorded. You can opt out with Microsoft's privacy controls.
• Session cookies — only for our own team when they sign in to the internal system. Not used for guests.

You can delete all of these from your browser settings at any time. Deleting your basket cookie simply empties your list.

7. How we protect it

• Everything travels encrypted (HTTPS) and the site enforces it.
• Card details never reach our servers — Stripe handles them directly.
• Only the coordinator assigned to your stay can open your file; our system checks this on every request, not just by hiding buttons.
• Accounts that handle money require a second verification step by email.
• Access is logged: we can tell who did what and when.
• We keep encrypted backups and we have tested that they can actually be restored.

No system is completely immune. If a security incident ever affected your information in a way that could harm you, we will tell you.

8. Your rights (ARCO)

You have the right to Access the information we hold about you, Rectify it if it is wrong, ask us to Cancel (delete) it, or Oppose its use for a particular purpose. You may also withdraw your consent at any time.

Write to bluedesert@bluedesertcabo.com telling us: your name, how to reach you, what you want us to do, and enough detail to find your records (for example the villa and the dates of your stay). We may ask you to confirm your identity so we do not hand your information to someone else.

We will reply within 20 business days and, if your request is granted, act on it within the following 15 business days.

Please note: if you ask us to delete everything while an order or a stay is still in progress, we may not be able to complete the service. We may also need to keep certain records for the period required by tax and accounting law.

9. Children

This service is intended for adults. We do not knowingly collect information from children beyond the number of minors in your party, which we only use to size services correctly.

10. Changes to this notice

If we change how we handle your information, we will update this page and change the date at the top. For significant changes we will let you know by email or through the site.

Questions about this notice? Write to bluedesert@bluedesertcabo.com or message us on WhatsApp.