Privacy policy

FLUVIA (https://www.fluvia.pe) is an information platform about river transport in the Peruvian Amazon operated by AAPER SOFT, tax ID (RUC) 20712294642, with address at Jr. Independencia 1024, Pucallpa 25001, Peru.

Privacy contact email: fluvia.contacto@gmail.com.

This policy is governed by Peruvian Law No. 29733 on Personal Data Protection and its Regulation approved by Supreme Decree No. 016-2024-JUS. [TO COMPLETE registration of the databases with the National Register for Personal Data Protection and, if applicable, appointment of the personal data officer].

You do not need an account, or to give us your name, ID, phone number or email, to look up routes, schedules and departures.

Advertising form: if you write to us from the advertising page, we store the data you enter (name, company, email, WhatsApp, plan of interest and message) and the date, to answer your commercial request and contact you about it. The FLUVIA team receives an email notice with that data. We do not store your IP address with the request. [TO COMPLETE legal basis].

Messages to the FLUVIA team on WhatsApp: the “Equipo Fluvia” button opens a chat with FLUVIA's number. If you write to us, we receive your number and messages on WhatsApp in order to reply. [TO COMPLETE legal basis and retention period for these chats].

Contacting operators: the companies' WhatsApp buttons open a direct chat between you and the operator. FLUVIA does not receive or store that message or your number.

Abuse prevention: to limit mass submissions we use a pseudonymized version of your IP address (a code derived from it with a secret key, which does not contain it) as a temporary key in the Upstash service: up to one hour for the advertising form and about one minute for internal analytics. It is not stored in our database.

If you accept, we use Google Analytics 4 (Google) and Microsoft Clarity (Microsoft) to understand which routes and departures people look for and to improve the site. The legal basis is your consent.

Until you accept, Google Analytics and Microsoft Clarity are not loaded and receive nothing. If you reject or withdraw consent, they stop receiving data from that moment and we remove from your browser the cookies they create on fluvia.pe. Cookies Microsoft stores on its own domains cannot be removed from our site.

Google Analytics receives the pages you visit (with cleaned addresses: we remove anything you typed and any parameter we do not need), technical data about your browser and device, and these events: route searches (only places in our catalog), departure and cargo views, filters applied, searches with no results, and clicks to contact an operator (without their number). Google may infer an approximate location from your connection.

Microsoft Clarity records, in pseudonymized form (a random identifier, never your name), how the page is used: clicks, scrolling and navigation, to spot design problems. All page text and anything you type are masked before being sent, so Clarity does not see their content; the Clarity project also uses strict masking mode.

We never send names, documents, phone numbers, emails or free text typed by you to these tools. We run no personalized advertising, remarketing or Google ads signals, and we never sell data. Company ads shown on some pages use no tracking cookies: we only count, in aggregate, how often they are shown and clicked.

You can change your choice at any time from “Cookie preferences” in the footer.

We record in our own database which pages are visited and how many times each operator is contacted. Each record holds the event type, the (cleaned) page address, the section, the company or departure identifier, the language, the device type and the date. It stores no IP address, cookies or personal identifiers. It runs unless you reject analytics, and stops if you do. [TO COMPLETE validation that these records are not personal data, and their legal basis].

To run FLUVIA we use these providers, which process data on our behalf:

• Vercel (site hosting and delivery; servers in Washington, D.C., United States).

• Supabase (database storing advertising requests and internal analytics; AWS us-east-2 region, Ohio, United States).

• Upstash (request limiter; receives the pseudonymized version of your IP). [TO COMPLETE service region].

• Resend (email notice for advertising requests; São Paulo region, Brazil).

• Google (Gmail, the fluvia.contacto@gmail.com mailbox for privacy requests; and Google Analytics, only with your consent). [TO COMPLETE provider of the mailbox that receives advertising form notices, if different].

• Microsoft (Clarity, only with your consent).

• UploadThing (storage and delivery of banner and company images; when you see a banner, your browser downloads the image from its network).

• WhatsApp (Meta), when you choose to open a chat from the contact buttons.

Several of these providers process data outside Peru, mainly in the United States and Brazil, which is a cross-border flow of personal data. [TO COMPLETE legal basis and safeguards for the cross-border flow under Law No. 29733 and its Regulation].

Needed for the site to work:

• NEXT_LOCALE (session cookie): remembers the site language.

• fluvia_consent_v1 (local storage): keeps your analytics choice until you change it or clear your browser data.

• fluvia:evt:* (session storage): avoids counting the same event twice; removed when you close the tab.

Only if you accept analytics:

• _ga and _ga_<ID> (Google Analytics): tell visits apart; Google states a duration of up to 2 years.

• _clck and _clsk (Microsoft Clarity, on fluvia.pe) and Microsoft cookies on its own domains: group the pages of a visit; Microsoft states a duration of up to 1 year.

Authorized FLUVIA staff also use a session cookie for the admin panel. [TO COMPLETE legal review of this list before publishing].

Advertising form requests: [TO COMPLETE retention period]. The system deletes them automatically once the configured period expires; until one is set, they are kept until deleted manually.

Internal analytics: [TO COMPLETE retention period]. It is deleted automatically once the configured period expires; until one is set, it is kept.

Chats with FLUVIA's WhatsApp: [TO COMPLETE retention period].

Google Analytics: 2 months, as set in the property.

Microsoft Clarity: per the provider's settings (session recordings for 30 days and aggregated data for up to 13 months).

Pseudonymized IP for abuse prevention: up to one hour (advertising form) or about one minute (internal analytics).

You can withdraw consent for analytics at any time from “Cookie preferences” in the footer. Withdrawal does not affect data sent before; to ask for its deletion, write to us.

You can exercise your rights of access, rectification, cancellation and objection, and the other rights recognized by law, by writing to fluvia.contacto@gmail.com with the subject “Data protection”, stating your name, the right you are exercising and how to reply to you. [TO COMPLETE identity verification procedure and response times under the Regulation approved by Supreme Decree No. 016-2024-JUS].

If you believe we did not handle your request, you can file a complaint with the National Authority for Personal Data Protection of Peru's Ministry of Justice and Human Rights.

The site only works over encrypted connections (HTTPS) and access to stored data is restricted to authorized FLUVIA staff.

If we change this policy, we will update the date on this page.