Estafeta is operated by GREENWAVE FUTURE TECH LIMITED. Copyright in the Estafeta website and its original content belongs to GREENWAVE FUTURE TECH LIMITED.
1. General provisions
This Policy applies to visitors, registered users, customer representatives, administrators, developers, payment and support contacts. Registration, sign-in, API Key creation, a request, payment, or continued use means the user has read the Policy; separate consent is obtained when required.
Users must have legal capacity. A customer processing minors’ or third-party data must provide the lawful basis, notices, authority, and guardian consent. Third-party APIs, payment organizations, cloud platforms, and customer applications also operate under their own policies.
2. Information processed
Account/contact data and contractual, tax, registration, payment, order, invoice, transaction, anti-fraud, and compliance data may be processed. Payment passwords and full card data should remain with the payment provider and are not stored by Estafeta.
Technical data includes account, application, Key/token, time, model, usage, price, quota, response, error, latency, IP, browser, device, login, and audit events. Text, files, images, audio, video, code, callback data, and output are processed only as needed for routing, response, metering, security, diagnostics, complaints, and law and are not retained beyond necessity unless history is enabled. Support correspondence, attachments, cookies, and local storage may also be processed.
3. Purposes and legal bases
Purposes include accounts, authentication, keys, routing, responses, metering, billing, top-ups, refunds, support, availability, anti-fraud, incident investigation, audit, tax, regulation, and courts. Bases may include contract, pre-contract steps, legal obligation, legitimate interests, consent, and other lawful bases. Marketing requires a lawful basis; opt-out does not stop security, payment, and service notices.
4. Localization and international transfers
We organize data storage and processing under the applicable laws of the Hong Kong Special Administrative Region, including the Personal Data (Privacy) Ordinance (Cap. 486), and mandatory rules applicable to the specific user, data category and service location. Transfers outside Hong Kong to model, payment, cloud or infrastructure providers use contractual, organizational and technical safeguards. Where applicable law requires notice, consent or other procedures, we fulfill those requirements. Corporate customers are responsible for lawfully transferring their employees’, users’ or counterparties’ data and meeting applicable storage, international transfer and security obligations.
5. Recipients
Data is shared with hosting, networking, monitoring, security, email, payment, accounting, and support providers only as necessary. Required request content goes to the selected API provider. Disclosure may be made to authorities or courts by law and to a successor that continues confidentiality. Estafeta does not sell personal data or give request bodies to third parties for independent marketing without a lawful basis.
6. Data-subject rights
Subject to law, a person may request information, access, a copy, correction, completion, restriction, blocking, or deletion; withdraw consent, object, close an account, or ask about automation and international transfers. We may verify identity or authority. Complaints may be made to a competent regulator or court.
7. Retention
Information is kept only for contract performance, settlement, tax/accounting, disputes, security, and law, then deleted, destroyed, or anonymized. Logs, transactions, ledger, audit, and incident records may have different legal or internal schedules.
8. Security
Reasonable measures include HTTPS, access control, tenant isolation, secret encryption, revocable sessions, least privilege, audit, monitoring, backups, and updates. Absolute security is impossible; users must protect passwords, API Keys, devices, and integrations and promptly report suspected compromise.
9. Automated processing
Authentication, risk controls, routing, rate limits, metering, fund reservation, anti-fraud, and anomaly detection may be automated. Where law grants a right to challenge a solely automated decision with significant effect, obtain an explanation, or request human review, we handle the request accordingly.
10. Customer as controller
A customer choosing request content, providers, and output use is generally responsible for minimization, lawful authority, accuracy, confidentiality, and data-subject rights. Do not submit payment credentials, secrets, unlawfully obtained data, or unarranged sensitive data. A signed data-processing agreement prevails within its scope.
11. Changes
We may update this Policy for product, provider, legal, regulatory, or operational changes and notify through the website, console, email, or another reasonable channel. Separate consent is obtained when mandatory.
12. Contact and complaints
Operator: GREENWAVE FUTURE TECH LIMITED; registered address: RM 9042, 9/F, BLK B CHUNG MEI CTR 15-17 HING YIP STREET, KWUN TONG, KLN, HONG KONG. Send privacy requests and complaints to tiger4wan@gmail.com with “Privacy request” in the subject. Never send a password, API Key, full card number, or passport copy by ordinary email.
13. Website analytics
With your consent, Estafeta uses analytics cookies and services provided by third-party partners on the website and customer console. We measure traffic sources, page and content performance, interface language, browser and device information, and registrations, sign-ins, email verifications, model selections, API key creations and confirmed service outcomes after consent, including top-up, payment and refund states confirmed by the existing service interfaces during the current flow, to understand usage, evaluate content and improve our products and services. Before a choice or after rejection, we do not load these analytics services or send analytics data. Rejecting does not affect access.
We and our third-party partners may use analytics cookies to recognize browser sessions and standard UTM campaign labels in promotional links to attribute traffic sources. Page URLs exclude raw query strings and fragments. Analytics must not contain email addresses, names, API keys, prompts, model output or payment credentials, and is not used for personalized advertising. Browser session storage may retain the necessary internal order references and sent-state markers to reduce duplicates caused by reloads and repeated queries; these references are not sent to third parties. Payment conversion information sent to third-party partners contains the state confirmed during the current flow and a top-up amount and currency only when explicitly available from the service. Refund analytics records confirmed states and does not infer refund amounts or transaction counts.
You can change or withdraw your choice at any time through Privacy settings. Withdrawal stops subsequent analytics and clears the related analytics cookies; it does not automatically delete data already sent to third-party partners. Your choice is saved in the same browser, shared between the website and customer console, and not linked to your account. If browser storage is unavailable, the choice applies only to the current page. You can also use privacy or analytics-blocking controls supported by your browser.