Privacy notice

This notice explains what personal data Fidelize handles, why, who we share it with and how you can exercise your rights, in accordance with Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its applicable regulations.

1. Who is responsible

Fidelize is operated by Juan Pablo Aboytes Dessens, located at Col. Santa María, Mexicali, Baja California, Mexico (“Fidelize”, “we”, “us”). Contact for anything related to this notice: our address, Col. Santa María, Mexicali, Baja California, Mexico.

Fidelize is a platform that lets businesses offer digital loyalty cards, so we handle data in two different roles:

• Business data (owners and staff who use the dashboard): Fidelize is the data controller.
• Data about each business’s customers (people who sign up for a loyalty card): the business you sign up with runs its program and is responsible for its relationship with you; Fidelize processes that data on the business’s behalf, as a processor, to operate the card.

2. What data we handle

If you sign up for a loyalty card:

• Your name and phone number.
• Your card’s status: stamps collected, rewards redeemed, a card code, and the dates stamps were added or rewards redeemed.
• If you add the pass to Apple Wallet: a device identifier and a notification token that Apple generates so your pass can update. We do not receive your Apple ID or any other data from your phone beyond those identifiers.
• If you add the pass to Google Wallet: the pass (name, card code and stamps) is stored on the Google Wallet platform so it can be shown on your phone.

If you run a business on Fidelize:

• Your email address and password (the password is stored hashed; we never see it).
• Your business details: name, logo, banner photo, colour, reward rules, and the log of stamps and redemptions made by your staff.

We do not handle sensitive personal data, financial or payment data, or your location.

3. What we use your data for

Purposes necessary to provide the service:

• Creating and running your loyalty card and showing it in Apple Wallet or Google Wallet.
• Letting the business’s staff find your card (by phone or code) to add stamps and redeem rewards.
• Updating your pass and notifying you of your own progress (for example, “2 stamps to go”).
• Giving each business access to, and running, its dashboard.
• Keeping the service secure, preventing abuse and meeting legal obligations.

We do not use your data for advertising, we do not sell it, and we do not use it for any secondary purpose. If that ever changes, we will tell you and give you the choice to opt out.

4. Who we share your data with

• The business you signed up with sees your name, phone number and card status. Each business only sees its own customers.
• Service providers that process data only on our behalf: Supabase (database and storage), Vercel (application hosting), Google (Google Wallet) and Apple (Apple Wallet and its notification service). Some of these providers process data outside Mexico, mainly in the United States.
• Authorities, only when the law requires it.

5. Cookies

We only use the cookies needed to keep business users signed in. We use no advertising cookies and no third-party analytics. Signing up for a card requires no account and no session cookies.

6. How long we keep your data

For as long as your card or the business’s account is active. If you ask us to delete it, or the business closes its program, we delete or anonymise the data, except what we must keep by law. Backups are deleted according to their rotation cycles.

7. Your rights (ARCO) and how to exercise them

You can access your data, rectify it, cancel (delete) it or object to its processing, and you can withdraw your consent or limit its use. Send your request in writing to our address, Col. Santa María, Mexicali, Baja California, Mexico, including:

• Your name and a way to reply to you.
• The business you signed up with and the phone number you used.
• Which right you want to exercise and, if applicable, what data to correct.
• A document proving your identity (or that of your representative).

We will reply within 20 business days at most and, if your request is granted, carry it out within the following 15 business days. You can also ask the business to delete your card, or remove the pass from your Wallet at any time (removing it from your phone does not delete your card in Fidelize).

If you believe your right to the protection of your personal data has been violated, you may go to the competent data-protection authority.

8. Security

All communication is encrypted (HTTPS). Each business’s data is isolated from the others at the database level, and the server and Wallet credentials are never sent to the browser. No system is infallible; if a breach affecting your rights ever occurred, we would notify you.

9. Minors

Fidelize is not directed at minors. If you are under 18, ask a parent or guardian to help you sign up.

10. Changes to this notice

We will publish any change on this page with its update date. If the change is significant, we will also announce it through the means available to us.