Privacy Policy

• For Cardholder and Shopper data, the Merchant you enroll with or buy from is the data controller (responsable). We process that data on the Merchant's behalf, as its processor (encargado), only to provide the service, and each Merchant publishes its own privacy notice. For an online store, it appears on the store's legal information page.
• For Merchant account data (business staff using our dashboard), we are the data controller.

Cardholders (loyalty program members):

• Email address, phone number, first and last name (optional, provided at enrollment)
• Birthday (month/day used for birthday campaigns)
• Loyalty card balance, stamp/redemption history, and activity ledger (earn, redeem, adjustment events)
• Device identifiers and push tokens registered by Apple Wallet or Google Wallet when you add a pass, used only to push balance updates to that pass
• Marketing preference (whether you opted in to promotions)
• The same details when a Merchant imports its existing members from another loyalty program

Shoppers (online store customers):

• Name, email address and phone number (optional) given at checkout
• For delivery orders: delivery address, zip code and order notes
• Order contents, amounts, fees, status, and when you accepted the store's terms of sale and privacy notice
• Payment status from Stripe. Card details are entered directly with Stripe; we never receive or store full card numbers

Merchants (business dashboard users):

• Account email and authentication credentials
• Business name, branding (logo, colors), and program configuration
• Staff names, contact details and permissions
• For online stores: the business's legal name, RFC, address and contact details, its terms of sale and privacy notice, its Stripe connected account status, and a record of who accepted our Seller Terms and when
• Billing information, processed by Stripe on our behalf — we do not store full card numbers

Everyone:

• IP address, used briefly to limit abusive requests (e.g. repeated sign-ups or checkouts)

• To create and maintain your loyalty card and keep its balance in sync across Apple Wallet and Google Wallet
• To let merchant staff look up and redeem a card by scanning its barcode/QR code
• To send you optional marketing communications, only if you opted in
• To process online store orders and payments, show them to the Merchant, and send you an order confirmation
• To send service emails, such as order confirmations or a notice that your loyalty card is ready
• To bill merchants for their subscription plan via Stripe
• To prevent fraud and abuse, and to meet legal, tax and accounting obligations
• To operate, secure, and improve the platform

• The Merchant you enroll with or buy from, who can see your card activity, orders and contact details
• Stripe, to process store payments (on the Merchant's own Stripe account) and subscription billing
• Apple (APNs) and Google Wallet, to deliver and update wallet passes
• Resend, to deliver our emails
• Vercel (hosting), and Supabase (database, image and file storage), which run our infrastructure
• Authorities, when the law requires it

These providers act under contractual confidentiality and security obligations. Several are located in the United States, so your data may be transferred and stored outside Mexico. We do not sell personal data.

We retain Cardholder, Shopper and Merchant data for as long as the Merchant's account exists, including while its plan is inactive, so that subscribing again restores everything. After a Merchant closes its account, or a Cardholder or Shopper asks us to cancel their data, we keep it blocked for 5 years to meet legal, tax, accounting and dispute-resolution obligations, and then delete or anonymize it.

If you are located in Mexico, you have ARCO rights: to Access, Rectify, Cancel, or Object to the processing of your personal data, as well as to revoke your consent, under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares. For Cardholder or Shopper data, send your request to the Merchant (its contact details are in its privacy notice or store legal page); if you contact us instead, we will forward it to the Merchant and help it respond. For Merchant account data, contact our privacy office at hello@fidlat.com.

Depending on your state of residence, you may have the right to know what personal information we collect, request deletion or correction of it, and opt out of its sale or sharing (we do not sell personal information). To exercise these rights, contact hello@fidlat.com.

We use industry-standard safeguards to protect personal data, including encryption in transit and restricted access to production data. No system is completely secure, and we cannot guarantee absolute security.

Our services are not directed to children under 13 (or the applicable age of consent in your jurisdiction), and we do not knowingly collect their personal data.

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Questions about this policy or your data: hello@fidlat.com, Jordi Espinoza Mendoza, C. Segunda Mz. 2 Lt. 26, Fracc. El Tecolote, C.P. 22675, Tijuana, Baja California, México.