Privacy policy

Last updated: August 2026.

This is a courtesy translation of the Spanish privacy policy. If the two versions differ, the Spanish version is the one that governs.

Tulogy (“we”) operates the Miami locker and Panama delivery service described on this site, and is the controller of the personal data we collect. We are governed by Law 81 of 26 March 2019 on the protection of personal data of the Republic of Panama and its implementing regulations. You can reach us at envios@tulogypty.com or on WhatsApp at +507 6301-6042.

What data we collect

• Account data. Name, email address, phone number, your identity document (national ID or passport) and a password. The document lets us verify your identity and avoid duplicate accounts. The password is never stored in the clear: only a cryptographic hash (argon2id) is kept, and it cannot be reversed.
• Operational data. The packages linked to your account: tracking number, description, weight, price, status history, delivery addresses and windows, and the state of your payments. It is the minimum needed to provide the service and to show you your own history.
• Photos of packages and labels. Our team may photograph your package or its label when receiving or weighing it (so you can confirm the printed weight, for example). These photos are held in private storage and are visible only to you and to Tulogy staff.
• Communications. Transactional email (account verification, welcome, activation) and — only if you turn them on — push notifications on your device.
• Technical data. A session cookie that is essential to keep you signed in, preferences saved on your device (theme, language, phone country, your answer to the cookie notice) and, only if you accept the analytics cookies, usage metrics for the site and the app — the pages you visit, never the contents of your packages or your account data — through Google Analytics.
• Location, only if you share it. When registering you can tap “Use my location” to fill in your delivery address automatically. Only then does your browser share your coordinates with us, and we keep only the point you confirm alongside your address. We never track you in the background or access your location at any other time. The map loads from OpenStreetMap, so opening it gives that organisation your IP address and the area you are looking at; if you would rather avoid that, type your address by hand and the map never loads. You can skip the address entirely and add it later.
• Referral programme. If you register through an invitation link, we record which code you used and who invited you; the person who shared the link only sees that their invitation was used.

What we use it for

• Providing the service: receiving, weighing, charging for and delivering your packages.
• Telling you about status changes and arranging deliveries.
• Answering questions and complaints.
• Protecting accounts and preventing fraud.
• Understanding in aggregate how the site is used so we can improve it — only with your cookie consent.

We do not sell your data, and we do not share it for third-party advertising.

Who we share it with

We use providers that process data on our behalf, under their own security and confidentiality commitments:

• Google Cloud — the application and the photos are hosted on Google infrastructure (us-central1 region, United States).
• MongoDB Atlas — the database where accounts and packages live.
• Resend — sending the transactional email.
• Google (Gemini) — when the team scans a label to read the tracking number and the weight, the photo of the label is processed by a Google AI service. It is not used to train models on data we identify as yours.
• Google Analytics / Tag Manager — only if you accept the analytics cookies (see below).
• Sentry — technical error monitoring, configured not to send personal data.

Because part of this infrastructure is in the United States, your data may be processed outside Panama; we require equivalent protection measures from these providers. We may also disclose data where a competent Panamanian authority requires it by law.

Cookies

• Essential. The session cookie (__session) that keeps you signed in. Without it the service does not work, so it needs no consent and expires on its own.
• Analytics (optional). Google Analytics, loaded through Google Tag Manager, only if you tap “Accept” on the cookie notice. If you decline — or simply do not answer — nothing loads and no analytics cookie is set.

How long we keep it

For as long as your account is active, and for the periods Panamanian law requires for commercial and accounting records. Package and payment history is kept as a record of the commercial relationship; sessions expire on their own and can be revoked instantly.

How we protect it

• Passwords hashed with argon2id; never in the clear.
• Server-side sessions, revocable immediately.
• Photos in private storage, served only to authenticated users entitled to see them.
• Role-based access: staff see what they need to operate; you see only what is yours.
• Encryption in transit (HTTPS) across the whole site.

Your rights

Law 81 of 2019 gives you the rights of access, rectification, cancellation, objection and portability over your data. To exercise them, write to us at envios@tulogypty.com from your account’s email address and we will answer within the legal deadlines. If you believe we did not deal with your request properly, you may go to the National Authority for Transparency and Access to Information (ANTAI).

Minors

The service is intended for people over 18. We do not knowingly create accounts for minors.

Changes to this policy

If we change this policy substantially, we will update the date at the top and announce it on the site. Using the service after a change means you are aware of the current version.

Looking for the terms of service? They are in the Terms and Conditions.