Personal data processing

Provisional draft: the binding text is under legal review and will be published before launch.

The Spanish document is the reference text. The English and Portuguese versions are summaries.

Policy version: 2026-09-borrador

Data controller

C+H Cordeles y Herramientas SAS (NIT 900.632.990-3). Bagurity is a brand and a database separate from any other product of the company.

About your account: email, first and last name, phone, language and password (stored encrypted, never in plain text).
About your luggage: name, type, brand, color, marks, instructions, alternate contact and photo, as you enter them.
About usage: scan dates and the status of your luggage. The IP address is never stored in plain text: it is turned into a code that cannot identify you.
About whoever finds a piece of luggage and leaves a notice: message, contact, photo and, only if they allow it, their location.
We do not ask for or store the contents of your luggage, its value, your address or your travel details.

To create and protect your account and send you service emails (verification, recovery, notices).
To show whoever finds your luggage only what you authorize, and to notify you when someone finds it.
The data a finder leaves is used only so the owner can reply to them.

Data left by a finder (message, contact, photo and location) is deleted after 30 days.
The code derived from the IP address of scans is discarded after 30 days.
Accounts that do not confirm their email are deleted after 7 days.
Your account and everything associated with it is deleted immediately when you ask.
Encrypted backups are kept for 30 days and then deleted; data you delete may remain in them until that backup is deleted.

As a data subject you can, at any time:

Know and access your data: download a file with everything we keep from your profile.
Update and correct your data from your profile and your luggage.
Delete your data: delete your account from your profile.
Withdraw your authorization: when you delete your account we stop processing your data.
File complaints with the Superintendence of Industry and Commerce (SIC).

From your profile you can download and delete your data. You can also write to the contact email.

We answer queries within 10 business days and claims within 15 business days.

Email delivery: Resend, Inc. — United States.
Service hosting (server): Hetzner Online GmbH (Germany), with the server located in Ashburn, Virginia — United States.
Encrypted backups: Backblaze, Inc. — United States. They are encrypted by us before upload: the provider cannot read them.
These providers process data only to provide the service. This list is updated whenever a provider is added.

Session cookie: needed to keep you signed in. Scripts cannot read it and it lasts 7 days.
Language cookie: remembers the language you chose.
One local-storage entry recording when your session was last renewed. We use no advertising or third-party analytics cookies or tools.

The service is not aimed at people under 18. If you believe a minor created an account, write to us to delete it.

Each version has an identifier. If it changes, we will ask you to accept it again when you register.