Privacy policy

This policy explains what personal data Repitoo handles, why, who it shares it with and how to exercise your rights. It is written under Costa Rica's Law on the Protection of Individuals Regarding the Processing of their Personal Data (Law No. 8968) and its regulations.

1. Who we are and who this applies to

Repitoo is a loyalty card platform for businesses, the trade name of Raul Armando Gonzalez Urbina, an individual with Costa Rican identity card 801540401. This policy applies to two groups of people, and our role is different for each:

• Owners and teams of the businesses that use the Repitoo panel. For their data, Repitoo is the controller.
• Customers of those businesses, who carry a loyalty card on their phone or on the web. For their data, the controller is the business that gave them the card and Repitoo acts as a processor: it handles the data on the business's behalf and only to provide it with the service.

If you are a customer of a business, the business decides what data it asks for and why; this policy explains how we look after it at Repitoo.

2. What data we handle

About owners and their teams:

• Name, email, language and app preferences (theme and color).
• The business: name, type, location of its shops, opening hours, logos and card designs.
• Each person's role in each business and the invitations sent.
• Subscription data: plan, dates and status of charges. The card number goes to the payment provider, not to Repitoo.
• Technical security data: sessions, IP address and access logs, to limit attempts and prevent abuse.

About each business's customers, whatever that business chooses to ask for or load:

• Name and, if given, email and phone.
• Birthday day and month, without the year.
• Other data the business adds, such as address, notes or its own fields.
• Card activity: stamps, rewards, coupons, gifts, messages received and visit dates.
• If Apple Wallet is used, a device identifier to notify it when the card changes.
• If an account is created in "My cards": email and password (stored encrypted) or Sign in with Google.

What we do not handle: we do not receive customers' location (the phone works out on its own whether it is near the shop), we do not use third-party analytics or advertising tools, and we do not sell personal data.

3. What we use it for

• Providing the service: creating and updating cards, adding stamps, giving rewards and coupons, and showing the panel.
• Sending service emails: the sign-in link, the customer's card, invitations and billing notices.
• Sending the messages the business schedules to cards, capped per card and only during its opening hours.
• Charging the subscription and keeping accounts.
• Giving support, solving problems and improving Repitoo with internal metrics on how the platform is used.
• Protecting the platform: preventing fraud, unauthorized access and abuse.
• Meeting legal obligations.

We do not use a business's customers' data for our own commercial purposes, nor do we combine it with another business's.

4. Consent and legal basis

We handle data with the informed consent of the person it belongs to or when the law allows it, for example to perform the contract with the business or meet a legal obligation. When a customer joins a program, the page explains what the business will use their data for before they send it. The business is responsible for having the consent of the customers it loads itself, for example when importing a file. Consent can be withdrawn at any time, without retroactive effect.

5. Artificial intelligence

Some features use an artificial intelligence model (currently Anthropic's Claude) to suggest texts, designs and how to read an imported file. When reading a file, the model receives only the column headers and the shape of the values (for example, "8 digits"), never the customers' data. In the other assistants it receives what the owner writes about their business. Under the provider's commercial terms, that data is not used to train its models.

6. Who we share data with

Only with those we need to provide the service, and each receives the minimum necessary:

• The business that owns the program, which sees its own customers' data.
• Providers working on our behalf: cloud hosting and database, file storage, email delivery, payment processing (for example, Stripe) and artificial intelligence.
• Apple and Google, to issue and update the passes in their wallets and, if the person chooses it, for Sign in with Google.
• Authorities, when a law or a court order requires it.
• A buyer or successor of Repitoo, if the company is sold or merged, with the same protections as this policy.

Shop maps in the panel are requested from OpenStreetMap by our servers, with no data about who views them.

7. International transfers

Some providers store or process data outside Costa Rica, for example in the United States. We only work with providers that offer adequate security and confidentiality guarantees, and we require them to handle the data only to provide their service to us.

8. How we protect data

• Every connection is encrypted (HTTPS) and passwords are stored encrypted.
• Each business's data is kept separate: a business never sees another's customers.
• API keys are stored as a cryptographic digest, not in plain text.
• Uploaded files are kept in private storage and images are processed before they are shown.
• Our team members with administrative access sign in with a second authentication factor, and every action they take in an account is logged.

No system is completely secure. If an incident affects personal data, we will inform those affected and the authority within the time limits set by law.

9. How long we keep it

We keep data while the business's account is active and the program needs it. If the business closes its account, we delete or anonymize the data within the following 90 days, except what the law requires us to keep (for example, accounting records) or what is needed to handle a claim. Imported files are deleted as soon as the import finishes. Technical security logs are kept for as long as their purpose requires.

10. Your rights

Everyone has the right to know what data about them we handle and to ask for access to it, its correction, update or deletion, and to withdraw their consent. They can also object to receiving messages from the business.

• If you are a customer of a business, you can ask the business directly or write to us; we will pass the request on to the business and help it respond. You can also remove the pass from your wallet or delete your "My cards" account whenever you want.
• If you are an owner or a team member, you can change your data in the panel or write to us.

We respond within the period set by law, five business days. We may ask you to confirm your identity before giving out or changing data. If you believe we did not handle your request properly, you can go to Costa Rica's Data Protection Agency (Agencia de Protección de Datos de los Habitantes, PRODHAB).

11. Cookies

We only use the cookies Repitoo needs to work, never third-party advertising or analytics cookies:

• Session cookies, to keep you signed in to the panel or to "My cards".
• Preference cookies, to remember the language, the light or dark theme, the brand color and screen settings, such as the step of the buttons when adding stamps.

If your browser blocks them, you will not be able to sign in, but the cards in your wallet will keep working.

12. Minors

Repitoo is a service for businesses and is not directed at minors. A business that offers its program to minors must have the consent of their parents or guardians when the law requires it. If we find data of a minor handled without that consent, we will delete it.

13. Changes to this policy

If we change this policy, we will publish the new version with its date. If the change is significant, we will notify owners by email in advance.

14. Contact

For any privacy question or to exercise your rights, write to hola@repitoo.com (also our address for legal notices), naming the business and the card or the account's email.