Privacy Policy

1. Who we are

Opita Drops is a pilot-stage project running the Dropea marketplace: a two-sided marketplace connecting Latin American buyers with US residential drops verified by scoring (4 tiers). Each drop receives packages bought by the LATAM buyer from US retailers; our router picks them up same-day and delivers them to our CMRA-registered locker in Colorado Springs, CO, from where a subcontracted courier (consolidator Aeropost or FedEx/UPS express) ships to the customer address in LATAM.

• Operator: Opita Drops (pilot operation, legal formalization in progress)
• Locker: Colorado Springs, CO (CMRA Form 1583A registered with USPS)
• Drops: distributed network of US residential addresses with full KYC + scoring
• Tax ID: to be published upon completion of legal formalization
• Contact email: privacy@opitadrops.com

2. What personal data we collect

We collect only the data needed to operate the service:

• Identity: name, LATAM shipping address, date of birth (KYC)
• Contact: email, phone number (WhatsApp), country of residence
• Crypto wallet: USDC address on Base network (optional for payment)
• KYC: ID document, drop KYC (when applicable), selfie (when applicable)
• Transactions: shipping labels, processed packages, USDC payments, tracking numbers, scoring of the drop used
• Technical: IP (hashed with HMAC-SHA256), user agent, cookies

3. How we use your data

• Process Dropea marketplace shipments: residential drop → Colorado Springs locker → subcontracted courier → LATAM
• Comply with KYC/AML and OFAC sanctions (required by US federal law)
• Validate tracking numbers with anti-fraud AI (BIN screening, retailer whitelist, address match, declared value)
• Process USDC payments on Base network (gas paid by Opita Drops)
• Compute drop scoring and customer reputation
• Customer support via WhatsApp Business (María Medina, Sales Advisor)
• 5-year audit (required by the Bank Secrecy Act)

4. Legal basis by country

5. Who we share your data with

We never sell your data. We only share what is strictly necessary:

• Residential drops: buyer name + package tracking number (to confirm receipt)
• Couriers (Aeropost, FedEx, UPS): name + LATAM shipping address
• USPS: CMRA Form 1583A registration of the Colorado Springs locker (federal compliance)
• Payment processors: USDC wallet address (public on-chain by design)
• Regulatory authorities: when legally required (subpoena, SAR)

6. Data retention (5-year AML)

Under US federal AML (Anti-Money Laundering) requirements, we retain transaction records, KYC and communications for 5 years from the last transaction. After that period, personal data is deleted or irreversibly anonymized.

7. Security

• Encryption at rest (KMS)
• Encryption in transit (TLS 1.3)
• Pre-transfer wallet screening (OFAC + Etherscan + Blockchair)
• WORM (Write Once Read Many) audit trail
• IP address hashed (HMAC-SHA256) — never stored in plain
• 2FA for admin dashboard

8. Your rights and how to exercise them

Email privacy@opitadrops.com with:

• Subject: "Ejercicio de derechos ARCO / Ley 1581 / LGPD"
• Name + registered email + country
• The specific right you exercise (access, rectification, erasure, opposition)

We respond within 15 business days (Colombia), 20 days (Mexico LFPDPPP), 15 days (Brazil LGPD).

9. Cookies

We use necessary technical cookies (session, authentication) and aggregate analytics cookies (never individually identifying). We do not use third-party advertising tracking cookies.

10. Changes to this policy

We will notify material changes by email with at least 30 days notice. Minor changes are published on this page with an update date.

11. DPO contact

Data Protection Officer: dpo@opitadrops.com