LastFolk — Privacy Policy

LastFolk is operated by Pictorica Devs LLC. LastFolk connects online stores ("Merchants") with third-party courier networks, or with the Merchant's own drivers, to enable local delivery, and provides rating, dispatch, tracking, and reconciliation functionality.

For any privacy question or to exercise your rights, contact our designated Data Protection Officer / privacy contact:

• Email: contact@lastfolk.com
• Entity: Pictorica Devs LLC, 30 North Gould Street, Sheridan, Wyoming, United States

The Data Protection Officer function is handled internally by Pictorica Devs LLC and is responsible for data-protection matters across LastFolk and its affiliated entities. You can reach it at the email above.

EU / UK representatives. LastFolk is operated by Pictorica Devs LLC, established in the United States. As required under Article 27 of the EU GDPR and the UK GDPR, we have appointed DataRep (Data Protection Representative Limited, trading as DataRep) as our Data Protection Representative in the EU/EEA and the United Kingdom. You may contact our Representative:

• EU/EEA representative — DataRep: by email at datarequest@datarep.com (please quote "LastFolk; pictorica.dev" in the subject line), via the webform at www.datarep.com/data-request, or by post to "DataRep", The Cube, Monahan Road, Cork, T12 H1XY, Ireland. DataRep maintains contact locations in every EU/EEA member state.
• UK representative — DataRep: by email at datarequest@datarep.com (quote "LastFolk; pictorica.dev"), via www.datarep.com/data-request, or by post to "DataRep", 107-111 Fleet Street, London, EC4A 2AB, United Kingdom.

Please address postal correspondence to "DataRep" (not to LastFolk or Pictorica Devs LLC directly), or it may not reach the Representative.

This Policy applies to:

• Merchants — store owners and their authorized users who install or use LastFolk.
• End Customers — individuals who place orders with a Merchant that are fulfilled through LastFolk.
• Website visitors — people who visit our public websites.
• Drivers — members of a Merchant's own delivery fleet who use the LastFolk Driver app (see Section 3.7).

Where LastFolk processes End Customer data on behalf of a Merchant to fulfill deliveries, LastFolk generally acts as a processor/service provider and the Merchant is the controller/business. Where LastFolk determines the purposes of processing (for example, for its own security, billing, and product operation), LastFolk acts as a controller/business. The same applies to drivers of a Merchant's own fleet: the Merchant decides which deliveries they are offered and is the controller of their delivery data, which LastFolk processes on its behalf; for the driver's account, sign-in, security, and the notifications we send to the driver's phone, LastFolk acts as a controller.

3.1 Information Merchants provide. Account and contact details (name, business name, email, phone), store URL and platform, billing identifiers, plan selection, and — where applicable — credentials or connection tokens for third-party services the Merchant chooses to connect (including a Merchant's own courier account under "bring your own" configurations).

3.2 End Customer delivery information. To rate and fulfill a delivery, we process order and delivery details such as recipient name, delivery and pickup addresses, contact phone, email address, package attributes (size/weight), order identifiers, delivery status, and tracking events. We process this on the Merchant's behalf. We use the End Customer's email address only for service notices about that delivery, sent on the Merchant's behalf and in its name — for example, that it is on its way, has been delivered, or was cancelled, with a link to its tracking page — and never for marketing.

3.3 Payment-related identifiers. We do not store full card numbers. Payment is processed by a third-party payment processor. We may store non-sensitive identifiers (such as a customer or payment-method reference ID) needed for billing and reconciliation.

3.4 Technical and usage data. IP address, device and browser data, log data, timestamps, and product usage events, used to operate, secure, and improve the Service.

3.5 CCPA/CPRA categories. For California residents, the personal information above falls within these statutory categories: identifiers (name, email, phone, IP address); commercial information (plan and billing identifiers); internet or network activity (usage and log data); geolocation data (delivery and pickup addresses and, for drivers of a Merchant's own fleet, their position during a delivery, as described in Section 3.7); and professional or business information (store details and, for people who ask to deliver with LastFolk, their vehicle type and whether they deliver independently or for a company, as described in Section 3.8). We do not collect sensitive personal information beyond what is described, and we do not sell personal information. We do not currently "share" personal information as that term is defined under the CPRA — that is, we do not disclose personal information for cross-context behavioral advertising, and we do not build or export advertising audience lists. We do measure the effectiveness of our own advertising: when a visitor arrives from an ad, we may process advertising click identifiers to attribute a resulting sign-up to the campaign that produced it. Sources are the Merchant, the End Customer's order, the people who ask to deliver with LastFolk (Section 3.8), and automatic collection; purposes are described in Section 4.

3.6 Delivery chat. While an order is on its way, the End Customer can write from the tracking page to the store about the order and, when the store delivers it with its own drivers, to the assigned driver. We keep those messages on the Merchant's behalf so the handover can be arranged without sharing phone numbers: in the conversation with the driver we hide phone numbers, email addresses, and the delivery's verification code when they are typed in. The store can read the conversation with the driver for its own orders. We never send the text of a message by email or notification: whoever we notify is told only that a new message arrived. The conversation with the driver closes 15 minutes after delivery (at once if the delivery is cancelled, fails, or is returned, or the driver is changed) and the one with the store 24 hours after the delivery ends; both stop being shown 24 hours after the delivery ends and are deleted 30 days after they are written. To limit abuse, we keep a one-way, keyed hash of the network address a customer's message was sent from — never the address itself — for no more than two days.

We use personal information to: provide and operate the Service (rating, dispatch, tracking, reconciliation); create and manage accounts; process billing and reconcile charges; communicate service, transactional, and support messages; provide customer support; reply to people who ask to deliver with LastFolk (Section 3.8); maintain security, prevent fraud and abuse; measure the effectiveness of our advertising and attribute sign-ups and other conversions to the campaigns that produced them; comply with legal obligations; and improve and develop the Service.

We do not sell personal information, and we do not use End Customer delivery data for advertising.

Where GDPR/UK GDPR applies, we rely on: performance of a contract (to provide the Service); legitimate interests (to secure, operate, and improve the Service, balanced against your rights); legal obligation (to comply with law); and consent where required (which you may withdraw at any time). When you ask to deliver with LastFolk (Section 3.8), we process your details to take the steps you asked for before any agreement.

We share personal information only as needed to run the Service, with the following categories of recipients (we work with vetted subprocessors and do not sell your data):

• Third-party courier networks — to dispatch and fulfill deliveries. Recipient and pickup details are shared with the courier assigned to a delivery.
• A Merchant's own drivers — for deliveries the Merchant carries with its own fleet, the assigned driver receives the recipient and pickup details in the LastFolk Driver app.
• Payment processor — to charge fees and reconcile payments.
• Cloud hosting and infrastructure providers — to host and operate the Service.
• Address and mapping services (Google) — to validate and geocode addresses, measure the road distance of a delivery, and display delivery maps, for accurate rating and routing. When a Merchant plans routes with several stops, also to put the stops in order (route optimization), and to calculate and draw the route by road between the store and the stops — for that we send only the coordinates of the store and of the stops, never the driver's position.
• AI service provider (Google, through the paid Gemini API or Vertex AI) — when a Merchant imports a file of deliveries, to recognize which column holds what. We send only the file's column headings and at most five of its rows, with the personal data in them masked; never the rest of the file. We use this service only on terms that do not allow the provider to use that data to improve its own products.
• Analytics, communications, and error-monitoring providers — to operate, support, and secure the Service.
• Advertising and measurement providers — to deliver our advertising and measure its effectiveness, including attributing sign-ups to the campaign that produced them.
• Professional advisors, and authorities — where required by law, to protect our rights, or in connection with a corporate transaction.

The categories of recipients listed above reflect our current subprocessors. We maintain a current list of specific subprocessors, available to Merchants on request via contact@lastfolk.com. Where LastFolk acts as a processor, we will give Merchants advance notice of any intended addition or replacement of a subprocessor and an opportunity to object, as set out in our Data Processing Agreement (available at /dpa).

The Service is operated from, and data may be processed in, the United States and other countries. Where we transfer personal data across borders, we rely on appropriate safeguards: the European Commission's Standard Contractual Clauses (2021) for transfers from the EEA, the UK International Data Transfer Addendum (IDTA) for transfers from the United Kingdom, and, for other jurisdictions, adequacy decisions or other lawful transfer mechanisms. Where required, we conduct a transfer impact assessment and apply supplementary measures. A copy of the relevant transfer mechanism is available to Merchants on request.

We retain personal information for as long as needed to provide the Service, comply with legal, tax, accounting, and reconciliation obligations, resolve disputes, and enforce our agreements. When no longer needed, we delete or anonymize it. Merchants may request deletion of End Customer data they control, subject to our legal retention needs. Some data has a shorter, fixed period, stated where it is described: delivery chat messages (Section 3.6), drivers' position points and details (Section 3.7), and the details of people who ask to deliver with LastFolk (Section 3.8).

We use technical and organizational measures to protect personal information, including encryption in transit (TLS/HTTPS) and at rest, access controls and role-based access, and least-privilege practices. No system is perfectly secure; we cannot guarantee absolute security, but we work to protect your information and to notify affected parties of incidents as required by law.

EEA/UK (GDPR): you may request access, correction, deletion, restriction, portability, and objection, and may lodge a complaint with a supervisory authority.

California (CCPA/CPRA): you may request to know, access, correct, and delete personal information, and to opt out of "sale" or "sharing" (we do not sell or share personal information as defined by law). You may use an authorized agent to submit a request on your behalf. We will not discriminate against you for exercising your rights.

Other U.S. states: residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and others) have similar rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling. If we deny a request, you may appeal that decision by contacting us at contact@lastfolk.com; if your appeal is denied, you may contact your state attorney general.

Brazil (LGPD): individuals in Brazil have rights of confirmation, access, correction, anonymization, portability, deletion, and information about data sharing, and may contact the Brazilian National Data Protection Authority (ANPD).

To exercise any right, contact contact@lastfolk.com. Where LastFolk processes data on behalf of a Merchant, we will direct End Customer requests to the relevant Merchant or assist the Merchant in responding.

The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

Our websites and application use cookies and similar technologies. Strictly necessary cookies (for authentication, security, and core functionality) are always active because the Service cannot work without them. Non-essential cookies (such as analytics, preference, and marketing/advertising cookies) are used only where permitted: for visitors in the EEA and UK, we set non-essential cookies only after you give consent through our cookie banner, and you may withdraw consent at any time. Marketing cookies and advertising identifiers — including advertising click identifiers used to attribute a sign-up to the campaign that produced it — are set only with your marketing consent. Two copies of such an identifier may exist, and they are governed separately: the copy stored in your browser is deleted immediately when you withdraw marketing consent, and in any case expires no later than 90 days after it was captured; where the identifier has already been attached to an enquiry or record you submitted, it is kept alongside that record for no more than 90 days from capture and is then erased automatically. You can also control cookies through your browser settings; disabling some cookies may affect functionality. Our cookie banner lets you review and change your choices at any time.

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, where required, provide additional notice. Continued use of the Service after changes take effect constitutes acceptance.

Pictorica Devs LLC (LastFolk) — Privacy contact: contact@lastfolk.com — 30 North Gould Street, Sheridan, Wyoming, United States.