Privacy Policy

Last updated: October 2026

Baja Pass cares deeply about the privacy of its visitors and users. This Privacy Policy describes how Cabo Hospitality LLC, together with its affiliated companies ("Baja Pass," "we," "our," or "us"), collects, uses, and shares your Personal Information, and the rights you may have. It applies to all Baja Pass users and services, including www.bajapass.com and related services.

Please read this policy before using our Services. If you do not agree with our practices, please discontinue use. Contact us with any questions or concerns.

1. What is Personal Information?

Personal information is information that can be associated with a specific person and used to identify them. We do not consider anonymized or aggregated clickstream data (hardware, OS, browser) to be personal information.

2. The information we collect

We collect what you give us and what your browser sends. When you buy a pass: your name, email, and billing country and postal code (card details go straight to Stripe; we never see or store them). When you ask for a savings estimate: your first name and email. When you chat with our assistant or write to us: what you write. Promoters also give us payout details (bank, CLABE, CURP and address), which we store encrypted. From every visit: IP address, browser, the pages you view and, if you arrived from an ad or a promoter link, the campaign tags and promoter code in the link.

3. How we use it

We use it to sell and deliver your pass, re-send it when you ask, answer your questions, pay promoter commissions, and send you emails about Baja Pass. Transactional emails (receipt, pass delivery, expiry reminders) always arrive; marketing emails stop with one click on their unsubscribe link. We also use it to measure which campaigns bring visitors and sales, and to keep the site secure (rate limits, bot checks and error reports).

4. Information we share & why

We do not sell your personal information or give it to third parties for their own marketing. These providers process it on our behalf: Stripe (payments), GoHighLevel (our customer database and email), WalletWallet (creates your Apple or Google Wallet pass), Vercel (hosting), Cloudflare (bot checks and our AI assistant), Sentry (error reports), Google Analytics, Ahrefs and Metricool (visit measurement), and the providers named in section 5. Advertising: if you accept cookies in our banner, or make no choice, Meta and TikTok receive a purchase or sign-up event with your email (and phone, if you gave it) in hashed (encrypted) form, plus IP address and browser, so we can measure our ads. If you choose "Essentials only", our servers do not send that event. We may also disclose information to comply with the law or enforce our Terms. Data is processed and stored in the United States and México.

5. Our AI assistant

The chat on this website is answered by an automated AI assistant, not a person, and the chat window says so. When we offer them, the same assistant may also answer messages sent to hola@bajapass.com and to our messaging channels (SMS, WhatsApp, Instagram and Facebook). The assistant receives what you write to it and, depending on the channel, your email address, phone number or social-media account ID; it never sees your payment details. We use those messages to answer you, to pass a request to our team when it needs a person, and to review the quality and safety of the assistant. We do not use them for third-party marketing.

These providers process that information on our behalf: Anthropic (the AI model that writes the replies), Cloudflare (runs the assistant and stores conversation records), Google (our hola@bajapass.com mailbox), Twilio (SMS and WhatsApp), Meta (Instagram and Facebook messages) and GoHighLevel (our customer database, when a conversation becomes a request or a contact). Conversation records are kept for up to 180 days and then deleted. The assistant cannot change your pass, take payments or make commitments on our behalf; if you would rather talk to a person, write to hola@bajapass.com.

6. Cookies & third-party sites

Cookies we use: bp_cookie_ok (remembers your banner choice, 1 year), bp_attr and bp_ref (campaign tags and promoter code from the link you arrived with, 30 days; they decide who gets credit for a sale) and, for promoters, bp_promoter (keeps you signed in, 14 days). Only if you accept: _ga (Google Analytics), _fbp and _fbc (Meta) and _ttp (TikTok). With "Essentials only", Google Analytics runs without cookies and the Meta and TikTok pixels never load. Ahrefs and Metricool count visits on every page (IP address and the page you came from). You can delete cookies in your browser at any time; links to other sites follow their own privacy policies.

7. Your choices & rights

You can change your cookie choice by deleting the cookies this site sets, stop marketing emails with the unsubscribe link in any of them, and ask us for a copy of your data, a correction, or deletion. Email hola@bajapass.com; we reply within 30 days. When we delete your data we remove you from our customer database and email lists; Stripe keeps the payment record the law requires us to keep.

8. Security & retention

Transmission over the internet is not completely secure, but once we receive your information we use safeguards such as firewalls, encryption and access controls to protect it. We retain your personal information for the period necessary to provide the service and meet legal obligations, after which we dispose of it securely.

9. Children

Our websites are not directed toward children under 18 and we do not knowingly collect their information. If you believe we have, email hola@bajapass.com.

10. Updates

We may update this policy as required by law or to reflect changes in our practices. If we make material changes we will notify you. Please review this page periodically.

11. Contact

Questions about this policy or your rights? Email hola@bajapass.com.