Comprehensive Privacy Notice

Last updated: September 2026 (v2026-09)

In compliance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, "LFPDPPP") and its Regulations, DESARROLLO Y SOLUCIONES DE SOFTWARE, with its address at Av. Lateral Vía Atlixcáyotl 5210, Col. Emiliano Zapata, San Andrés Cholula, Puebla, C.P. 72810, Mexico, is responsible for the processing of your personal data.

1. Personal Data We Collect

For the purposes set out in this notice, we may collect:

Identification data:

• Full name
• Email address
• Phone number

Data about your business:

• Trade name
• Logo and brand images
• Location addresses
• Tax information for invoicing

Data about your business's customers:

• Name (optional, depending on the business's settings)
• Phone number (optional, depending on the business's settings)
• Address (optional, depending on the business's settings)
• Unique identifier (QR code)
• Loyalty transaction history
• Points, stamps or membership balances
• Email address (optional, depending on the business's settings)
• Gender (optional, depending on the survey settings)
• Age range (optional, depending on the survey settings)
• Answers to customer satisfaction surveys
• Referral code

Financial data:

• Credit/debit card information (processed securely by Stripe)

Browsing and advertising data:

• Identifiers of the ad through which you reached our site (for example, Google's gclid and Meta's fbclid parameters) and campaign parameters (UTM)
• The page you entered on, the referring page and the date of the visit
• Advertising cookie identifiers from Google and Meta, only if you accept them in the cookie notice

We do not collect sensitive personal data (ethnic origin, health status, religious beliefs, sexual preferences, etc.).

2. Purposes of Processing

Primary purposes (necessary):

• Creating and managing your Fidelip account
• Providing the platform's services
• Processing payments and issuing invoices
• Providing technical support
• Complying with legal and tax obligations
• Managing customer referral programs
• Sending balance notifications through digital cards (Apple Wallet, Google Wallet)

Secondary purposes (optional):

• Sending information about new features and updates
• Conducting satisfaction surveys
• Producing usage statistics and analysis
• Generating survey reports and statistics for businesses
• Measuring and improving our advertising campaigns on Google and Meta (Facebook and Instagram), learning which ad led to your sign-up, and showing you Fidelip ads on those platforms (remarketing)

If you do not want your data to be processed for secondary purposes, you can email us at [email protected].

3. Data Transfers

Your personal data may be transferred to:

• Stripe, Inc. - Payment processing (financial data). PCI-DSS compliant.
• Railway Corporation - Cloud hosting services (data stored on servers in the United States with appropriate safeguards).
• Resend, Inc. - Delivery of transactional emails.
• Apple Inc. and Google LLC - To generate digital cards in their respective wallets.
• Google LLC (Google Analytics) - Analysis of web traffic and user behavior to improve our services.
• Anthropic PBC
• Google LLC (Google Ads) and Meta Platforms, Inc. - Advertising measurement, optimization and remarketing. If you accept advertising cookies, your browser receives these platforms' tags. When you create a business account, we also send them your email address and phone number, irreversibly encrypted (SHA-256), together with the ad identifier, solely to count the sign-up as a result of the campaign.

Except for the advertising transfer, these transfers do not require your consent under Article 37, section VII of the LFPDPPP, as they are necessary to provide the service. The advertising transfer serves a secondary purpose: you may object to it at any time by rejecting advertising cookies and by writing to [email protected].

4. ARCO Rights

You have the right to Access, Rectify, Cancel or Oppose (ARCO rights) the processing of your personal data. To exercise these rights, send your request to [email protected] with the following information:

• Full name
• Email address registered with Fidelip
• A clear description of the right you wish to exercise
• A copy of an official ID

We will respond within a maximum of 20 business days. If your request is granted, it will take effect within the following 15 business days.

5. Withdrawal of Consent

You may withdraw your consent to the processing of your personal data by sending a request to [email protected]. Please note that this may mean we can no longer provide the service to you.

6. Limiting Use or Disclosure

You may limit the use or disclosure of your data for secondary purposes by registering with the Public Registry to Avoid Advertising (Registro Público para Evitar Publicidad, REPEP) of PROFECO, Mexico's consumer protection agency, or by emailing [email protected].

7. Use of Cookies and Tracking Technologies

We use cookies and similar technologies. For more information, see our Cookie Policy.

8. Security Measures

We implement technical, administrative and physical security measures to protect your personal data:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of data at rest
• Role-based access control
• Access monitoring and auditing
• Regular backups

9. Data Retention

We will keep your personal data for as long as you maintain an active account with us and for the time needed to meet legal and tax obligations (generally 5 years under Mexico's Federal Tax Code, the Código Fiscal de la Federación).

10. Data of Minors

Fidelip is aimed at businesses and does not knowingly collect data from minors. If you become aware that a minor has provided personal data, contact us so we can delete it.

11. Changes to this Privacy Notice

We reserve the right to modify this notice. Changes will be announced on our website and by email.

12. Protection of Your Rights

If you believe your right to the protection of your personal data has been violated, you may file a complaint with Mexico's Ministry of Economy (Secretaría de Economía) or take the legal action available under applicable Mexican law.

13. Contact

For any questions or comments about this privacy notice:

• Email: [email protected]
• Address: Av. Lateral Vía Atlixcáyotl 5210, Col. Emiliano Zapata, San Andrés Cholula, Puebla, C.P. 72810, Mexico

14. Additional Rights for Residents of the European Economic Area (EEA)

If you reside in the European Economic Area (EEA), including Spain, you have additional rights under the General Data Protection Regulation (GDPR).

14.1 Legal Basis for Processing

• Performance of a contract: We process your data to provide the loyalty service you signed up for (managing points, stamps and membership benefits, and generating digital passes).
• Consent: For analytics cookies (Google Analytics), we ask for your explicit consent through our cookie banner.
• Legal obligation: We keep billing data as required by applicable Mexican and Spanish tax law.

14.2 Data Subject Rights (GDPR)

In addition to ARCO rights, you have the right to:

• Access: Request a copy of your personal data in a structured, machine-readable format.
• Rectification: Correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): Request the deletion of your data when it is no longer needed for the purpose for which it was collected.
• Portability: Receive your data in a structured, commonly used and machine-readable format, and transmit it to another controller.
• Restriction of processing: Ask us to restrict the processing of your data in certain circumstances.
• Objection: Object to the processing of your data based on legitimate interest.

To exercise these rights, contact [email protected]. We will respond within a maximum of 30 days.

14.3 International Data Transfers

Your data may be transferred to and processed in Mexico and the United States through our service providers. These transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission. Our sub-processors include:

• Railway (infrastructure and hosting) — United States
• Stripe (payment processing) — United States/EU
• Resend (transactional email delivery) — United States
• Apple Inc. (Apple Wallet) — United States
• Google LLC (Google Wallet) — United States

14.4 Retention Periods

When a customer or business requests the deletion of their account, identifiable personal data is deleted from the production database. Backups containing deleted data are overwritten within the 30-day rotation cycle; during that period we keep a record of the request so the deletion can be reapplied if a backup is ever restored.

How to request deletion: customers can delete their account from their business's customer portal (also reachable from the back of the Apple/Google Wallet pass). Businesses can delete their account from Settings → Danger zone, with a 30-day grace period to reverse the process.

14.5 Supervisory Authority

If you believe the processing of your data infringes the GDPR, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es or with the data protection authority of your country of residence.