This is a translation. In case of discrepancy, the Spanish version prevails.

Privacy policy

CARFAL S.A. · Effective as of October 12, 2026

This policy explains what data CARFAL S.A. retains when the user contacts the company via WhatsApp, Instagram or Messenger, what it uses that data for, and how to request its deletion.

1. Data controller

CARFAL S.A., RUC 80025916-5, domiciled at Estero Bellaco esq. Avda. San Ignacio N.º 9666, Lambaré, Central, Paraguay. Enquiries about personal data are received at info@carfal.com.py.

2. Data retained

The user's name or profile name.
Their phone number (WhatsApp) or their Instagram or Facebook username.
The messages exchanged and the files the user sends (photos, documents, audio), with their date and time.
Internal notes by the CARFAL team about the enquiry (for example, the product of interest or a pending order).

CARFAL does not request card details or passwords through these channels.

3. Purpose

Answering the user's enquiries and providing commercial service.
Following up on their orders, quotations or complaints.
Sending them messages only if the user wrote first or agreed to receive them. The user may request at any time that no further messages be sent to them.

CARFAL does not sell the data or use it for third-party advertising.

4. Data processors

Meta (WhatsApp, Instagram and Messenger) transmits the messages and processes them under its own privacy policy.
Quorbex Technologies LLC (quorbex crm) provides the system in which CARFAL stores and answers the conversations. It acts as a provider to CARFAL and uses the data solely to deliver that service.
The data is hosted on servers contracted by quorbex in the United States (DigitalOcean), with encrypted backups in Finland (Hetzner).
If CARFAL enables automated replies, the text of the conversation is processed by an artificial intelligence provider (Anthropic and, as a fallback, OpenAI) solely to prepare the reply. A member of the CARFAL team may take over the conversation at any time.

5. Retention period

CARFAL retains the data for as long as a commercial relationship with the user exists and for up to 24 months after the user's last message. After that, it deletes the data. Encrypted backups are deleted automatically within a maximum of 12 months.

6. User rights

The user may request access to their data, its rectification or deletion, or that CARFAL stop sending them messages, by writing to info@carfal.com.py. CARFAL responds within 15 business days. The data is processed in accordance with Law No. 7593/2025 on Personal Data Protection and the other regulations applicable in Paraguay.

7. Data deletion request

Send an email to info@carfal.com.py with the subject "Delete my data".
Provide your WhatsApp number or your Instagram or Facebook username, so that CARFAL can identify your conversations.
CARFAL may ask you to confirm the request from that same number or account, in order to verify your identity.
CARFAL deletes your data and your conversations from its system and confirms by email once the deletion is complete, within 15 business days.

Some data is beyond CARFAL's control: the copy of the chat that remains on the user's phone is under the user's control, and Meta keeps its own records under its policy. Encrypted backups are deleted automatically within a maximum of 12 months. If the law requires certain data to be retained (for example, invoice data), CARFAL retains it only for the legally required period.

8. Changes to this policy

If CARFAL amends this policy, it publishes the new version on this page with its date.