Privacy Policy

Last updated: October 7, 2026 Effective date: April 15, 2026

This Privacy Policy explains how Rodrigo de la Torre González (individual sole proprietor) ("we", "us", "the Company" or "Xtarly"), with registered address at Av. Vallarta 4327, Camino Real, 45040, Zapopan, Jalisco, Mexico, collects, uses, stores and protects the personal information of users ("you") of the Xtarly Rewards mobile application and the white-label applications powered by the Xtarly platform (including Caffenio Rewards, Dolce Beauty, and other business-branded loyalty apps built on the Xtarly platform), as well as of the website https://www.xtarly.com (together, the "Services").

By downloading, installing or using the Services you agree to the practices described in this Policy.

1. Data controller

Controller: Rodrigo de la Torre González (individual sole proprietor)
Address: Av. Vallarta 4327, Camino Real, 45040, Zapopan, Jalisco, Mexico
Contact / Privacy Officer: atencion@xtarly.com
Support: atencion@xtarly.com

Who is responsible for what. Xtarly is the controller (responsable) of the data of your account in the Services, of the data of business owners and representatives who use the platform or contact us through the website, and of the data of visitors to xtarly.com. If your account belongs to a loyalty program operated by a business (for example, Caffenio Rewards), that business (the "Program Operator") is the controller of the data you share with its program and of the decisions about its use (rules, rewards, communications), and Xtarly acts as processor (persona encargada): it processes that data on behalf of and under the instructions of the Program Operator, as agreed with it. The Program Operator is identified inside the app. To exercise your rights regarding that program you may contact the Operator or email us at atencion@xtarly.com and we will forward your request.

2. Personal data we collect

We only collect information needed to operate the loyalty program:

2.1 Data you provide

Account data: full name, email address, password (stored hashed), phone number (optional), preferred language and country.
Profile picture / avatar: optional image you may upload from your gallery or camera.
Referral code: code you may enter or share.
Social sign-in data: if you choose to sign in with Google or Apple, we receive from those providers only your name and verified email address (and, for Google, your profile picture). We do not receive your Google or Apple password. Apple may provide a relay email address if you choose to hide your real email.
Birthday (optional): if you add it to your profile, so the business can greet you or give you a birthday benefit.

2.2 Data generated by your use of the Service

Loyalty program data: points balance, stamps, tier, transaction history, reward redemptions, redeemed coupons.
Push notifications: Expo/FCM/APNs device token, platform (iOS/Android) and read/unread status of notifications.
Technical data: anonymous session identifier, app version, OS, device model, IP address and access timestamps.

2.3 Data we do not collect

We do not access your GPS location.
We do not access your contacts.
We do not access the microphone.
We do not collect payment data in the app (the app does not process end-customer payments). If you subscribe to a Xtarly plan for your business, the payment is processed by Stripe (see section 6).
We do not use third-party advertising SDKs in the mobile app. (For the website, see section 12: we use optional advertising cookies, subject to your consent.)
We do not embed third-party behavioral analytics (Google Analytics, Facebook SDK, etc.) in the mobile app.

3. Device permissions

Permission	Purpose	Mandatory
Notifications	Send alerts for points earned, rewards, coupons and tier changes	No
Camera	Take a picture for your avatar, and scan QR codes at the point of sale to earn points	No
Photos / Gallery	Pick an image for your avatar	No
Internet	Connect to our servers	Yes

You can revoke any permission at any time from your device settings.

4. Purposes of processing

Primary purposes (required to provide the Service)

Create and manage your account.
Authenticate you via email and password, or via Google Sign-In / Sign in with Apple (JWT / refresh token stored securely via expo-secure-store).
Credit points, stamps and tier; record transactions and redemptions.
Display the menu, branches, banners and content of the program you belong to.
Send you transactional program notifications (points earned, available rewards, new coupons, tier changes, program messages) through the app, your wallet card, email or WhatsApp at the number you registered.
Prevent fraud, abuse and misuse.
Comply with legal obligations.
If you subscribe to a paid plan for your business: to charge your subscription through Stripe, notify you before each renewal and keep a record of each charge to meet tax obligations.

Secondary purposes (you may opt out without affecting the Service)

Promotional communications from the loyalty program you joined, which the business may target based on your activity in the program (for example, if you are close to a reward, your points are about to expire, you have not visited in a while, or it is your birthday month).
Satisfaction surveys.

You may opt out of secondary purposes by emailing atencion@xtarly.com or from the app's notification settings.

If you receive these messages on WhatsApp, you can also opt out of that channel by replying BAJA ("unsubscribe") to the message itself.

If you receive these messages by email, every promotional email carries an unsubscribe link: using it stops promotional emails from that business.

Business prospects and commercial contacts (businesses)

If you are a business owner or representative, we process your contact details (name, phone number, email address, publicly available business information and the operating data you enter in our tools, such as business type, average ticket, visits per customer and margin) in order to: (a) respond to your request; (b) send you commercial information, pricing and promotions about Xtarly by WhatsApp, email or phone, where you have authorized us to do so; and (c) keep a record of your authorization and of your opt-out. You may withdraw your authorization at any time by replying BAJA ("unsubscribe") to any WhatsApp message, by replying "baja" to any email, or by writing to atencion@xtarly.com.

5. Legal basis (GDPR / EU users)

Performance of a contract: to operate your account and the loyalty program.
Consent: for push notifications and promotional communications (revocable at any time).
Legitimate interest: for security, fraud prevention and Service improvement.
Legal obligation: to comply with tax and regulatory requirements.

6. Who we share your data with

We do not sell your personal data. In this section we distinguish three situations: (a) processors, providers that process data on our behalf and under our instructions, which under the law is not a transfer; (b) the Program Operator, controller of its program's data, for which Xtarly acts as processor (section 1); and (c) third parties, to whom we transfer data only in the cases indicated and in accordance with section 6.1. We share your data only with:

The Program Operator you enrolled with (e.g., Caffenio): it is the controller of its program's data and Xtarly processes that data for it as processor (section 1). It receives the data solely to operate its program.
Providers acting as processors (they process data on our behalf):
- Vercel Inc. — backend and website hosting.
- Railway Corporation — hosting of the platform's servers (API).
- Sentry (Functional Software, Inc.) — error and performance monitoring for the website, the app and our servers, so we can detect and fix failures. It receives the technical details of each error (what failed, on which page or screen, and the browser and device type), a sample of load-time measurements and, like any server receiving a connection, your IP address. In the business dashboard and the cashier screen it may receive a session replay with all text hidden and images blocked. We configure it not to send your name, email, phone number or cookies; it does not set cookies in your browser and we do not use this information for advertising. It may process this data in the United States (see section 7).
- Google LLC (Google Sign-In) — identity verification when you choose to sign in with Google.
- Apple Inc. (Sign in with Apple) — identity verification when you choose to sign in with Apple.
- Expo / Google Firebase Cloud Messaging / Apple Push Notification service — push notification delivery.
- Supabase (managed PostgreSQL) — database storage.
- Supabase Storage — avatar storage.
- Resend — delivery of your account emails (verification and password reset) and of the emails the business you are enrolled with sends you through the platform: your loyalty-card notices and, if you authorized it, its promotions. They are sent from the business's own domain or from notificaciones@xtarly.com in the business's name.
- Twilio Inc. — delivery of WhatsApp messages related to your account (billing and service status notices) and, where you have authorized it, commercial communications.
- WhatsApp / Meta Platforms, Inc. — delivery of messages on WhatsApp, both those related to your Xtarly account and those the business you are enrolled with sends you from its own WhatsApp Business number through the platform.
Stripe (payment processing) — a processor insofar as it handles the payment on our behalf, and a third party insofar as it uses the data for its own fraud prevention. If you subscribe to a paid Xtarly plan for your business, Stripe processes your subscription charges. It receives the details you enter in the payment form, such as your name, email address and card or other payment method details, together with the plan, amount, currency and date of each charge. Stripe processes them on our behalf to handle the payment and also uses them to prevent fraud, under its own privacy policy (https://stripe.com/privacy). Stripe may process this data in the United States (see section 7).
Website advertising and analytics platforms (third parties; only if you accept optional cookies, see 6.1): Google LLC (Google Analytics and Google Ads) and Meta Platforms, Inc. (Meta Pixel and Conversions API) receive the information about your visit to xtarly.com described in section 12, to measure site usage and the results of our ads and to decide who sees them. These platforms also use that information under their own privacy policies, linked in section 12. The Meta Pixel is not loaded in the mobile app or on the enrollment pages of each business's loyalty program.
Applications you choose to connect to your account (third parties chosen by you; for example, AI assistants such as Claude, by Anthropic). If you manage a business and authorize an external application to access your Xtarly account, we provide it —at your request and only while the connection is active— with what the permissions you accepted on the authorization screen cover: your name, email and profile photo, and the business information the application reads: your loyalty program configuration (rules, tiers, rewards, coupons and automatic notices), your business details, your menu, your branches with their address, your staff's names and roles, overall business metrics per period (how many customers, transactions and redemptions there were, with their total and average amounts), how many customers are in each group of your program (for example, close to a reward, with no recent visits or with a birthday this month) and, if you granted the campaigns permission, the drafts, status and overall results of your campaigns (how many messages were sent, delivered or read), without identifying any customer. We never provide it with personal data of the program's customers: Xtarly, not the application, personalizes and sends the messages to your customers. That application is not our provider: you choose it and use it, with your own account, and it handles what it receives under its own terms and privacy policy, possibly outside Mexico (for example, in the United States). You can revoke the connection at any time from Account settings → Security.
Competent authorities when legally required.

All providers acting as processors are bound by data-processing agreements under applicable law.

6.1 Transfer clause (articles 35 and 36 of the Mexican Federal Law on the Protection of Personal Data Held by Private Parties, LFPDPPP)

Transfers that require your consent. The only transfer to third parties we make for our own purposes is the communication of the data about your visit to xtarly.com to Google LLC and Meta Platforms, Inc. for analytics and advertising (section 12). By choosing "Accept" in the cookie banner, or by ticking the equivalent checkbox in our forms, you indicate that you accept that transfer. By choosing "Reject", or if you do not accept it, you indicate that you do not accept that transfer and it does not take place. You can change your decision at any time from "Cookie preferences" in the site footer or by emailing atencion@xtarly.com.
Transfers that do not require your consent. The other communications described in this section are made to processors (they are not transfers) or are covered by article 36 of the Law: they are necessary to maintain or perform the legal relationship with you (for example, Stripe to charge your business's subscription) or are required by a competent authority.
Applications you connect. Information is provided to an external application only at your request, when you authorize it on our authorization screen; removing the connection is equivalent to revoking that authorization.
Third parties that receive personal data by transfer assume, with respect to that data, the same obligations that apply to us as controller.

7. International transfers

Some providers process data outside your country of residence (primarily the United States and the European Union). In those cases we apply appropriate safeguards (Standard Contractual Clauses, equivalent certifications or informed consent) to ensure an adequate level of protection.

8. Data retention

We keep your data for as long as your account is active and for any additional period required to meet legal and tax obligations (up to 10 years in Mexico under tax rules; 5 years in the EU unless a longer obligation applies). Session tokens are deleted on logout or expiry. Notification tokens are deleted when the app is uninstalled or the device is deregistered.

9. Security

We apply reasonable technical and organizational measures:

TLS/HTTPS for all communications.
Passwords hashed with modern algorithms (bcrypt/argon2).
Tokens stored encrypted via expo-secure-store (iOS Keychain, Android Keystore).
Principle of least privilege for staff access.
Periodic audits and backups.

No system is 100% invulnerable; please use a strong password and do not share it.

10. Your rights

You have the right to:

Access the personal data we hold about you.
Rectify inaccurate data.
Delete your account and data (right to be forgotten).
Object to or restrict certain processing.
Portability of your data in a structured format.
Withdraw consent at any time.
Lodge a complaint with the competent authority: in Mexico, the Secretaría Anticorrupción y Buen Gobierno (Anti-Corruption and Good Government Secretariat), the authority for personal data held by private parties (gob.mx/buengobierno); in the EU, your supervisory authority.

To exercise any of these rights, or to request account deletion, email atencion@xtarly.com from the address associated with your account, stating your name, the right you wish to exercise and a clear description of the data concerned. We will respond within 20 business days of receiving your request and, where applicable, give effect to it within the following 15 business days; these periods may be extended once for an equal period where the circumstances justify it. To handle access requests we may ask you to verify your identity or that of your representative. You can also delete your account from Settings → Account → Delete account inside the app.

If your request concerns the loyalty-program data of a Program Operator, you may also address it to that business; if we receive it, we will forward it and let you know.

Public account-deletion page: https://www.xtarly.com/legal/delete-account

11. Children

The Services are intended for users 13 years of age or older (or the equivalent minimum age in your jurisdiction, e.g., 16 in the EU). We do not knowingly collect data from children without verifiable parental consent. If you believe a minor has provided us with data, contact atencion@xtarly.com and we will delete it.

12. Cookies and similar technologies (website)

The xtarly.com website uses the following cookies:

Type	Name / Owner	Purpose	Duration
Strictly necessary	`session_token` — Xtarly (Better Auth)	User session authentication	Until sign-out
Strictly necessary	`xt_country` — Xtarly	Stores the country you are connecting from (detected by our hosting provider from your IP address; only the country code, e.g. "MX") so we can show you the right currency, prices and contact number. Not shared with third parties.	1 day
First-party measurement	`xt_utm` — Xtarly	Set only if you arrive at the site from a link with campaign parameters (`utm_*`). Stores the source, medium, campaign, the page you landed on, the page you came from and the date of that first visit, so we know which campaign brought the person who later leaves us their details or registers their business. Not sent to third-party platforms. You can delete it from your browser or ask us not to use it by emailing atencion@xtarly.com.	90 days
Functional (referrals)	`xt_ref` — Xtarly	Set only if you arrive through a referral link (`?ref=CODE`) or type in a referral code. Stores the code only, to credit the referral if you register your business (see Referral Program Rules).	90 days
Strictly necessary	`consent` — Xtarly	Store your choice about Google analytics and advertising cookies	30 days
Strictly necessary	`consent_v2` — Xtarly	Store your choice about Meta advertising cookies	30 days
Strictly necessary	`NEXT_LOCALE` — Xtarly	Remember the language you chose when it differs from the one your browser indicates	Session (until you close the browser)
Strictly necessary	Browser local storage (`xt-card-designer-v1`, `xt-calculator-v1`) — Xtarly	To remember in this browser the details you left in the card designer or the calculator (name, business, email and phone number) and your design, so we don't ask you for them again. It is not shared with third parties. You can delete it with "Use different details" or by clearing the site data in your browser.	30 days
Analytics (optional)	Google Analytics 4 (`_ga`, `_ga_RDFRE8DCWG`) — Google LLC — ID: G-RDFRE8DCWG	Aggregate site usage measurement	Up to 2 years according to Google; current browsers cap it at 400 days
Advertising (optional)	Google Ads (`_gcl_au`) — Google LLC — ID: AW-18156222591	Measure whether a visit that came from a Google ad ends in a request or a sign-up	90 days
Advertising (optional)	`test_cookie` — Google LLC (doubleclick.net domain)	Technical cookie set by the Google Ads tag when it loads	Minutes (expires the same day)
Advertising (optional)	Meta Pixel (`_fbp`, `_fbc`) and Conversions API — Meta Platforms, Inc.	To measure whether a visit to xtarly.com leads to a card design request, a loyalty program calculation or a sign-up, and to decide who sees our ads on Facebook and Instagram, including people who have already visited the site. Meta receives the pages you visit, the buttons you click, your IP address and your browser details. When you request a design, make a calculation or sign up, our server also reports that event to Meta with your IP address, your browser details and these cookies, so it is not counted twice. We do not send Meta your email address or phone number.	Up to 90 days

Cookies marked as optional are only loaded if you give your consent, either through the banner shown on your first visit or by ticking the equivalent checkbox in the card designer and calculator forms. You can change or withdraw your decision at any time from the "Cookie preferences" link in the footer of every page of the site, which shows you the banner again so you can choose anew. You can also do so by deleting the consent and consent_v2 cookies from your browser settings, or by emailing atencion@xtarly.com. If you withdraw your consent, Google Analytics, Google Ads and the Meta Pixel stop loading and our server stops sending events to Meta; cookies those platforms have already set can be deleted from your browser. The first-party measurement cookie xt_utm does not depend on the banner because it does not share data with third parties; you can object to its use as indicated in its row.

For more on Google's data practices: policies.google.com/privacy. For more on Meta's data practices: facebook.com/privacy/policy.

The mobile app does not use third-party cookies.

13. Changes to this Policy

We may update this Policy. We will publish the new version at this same URL and, if changes are material, notify you by email or in-app at least 15 days in advance.

14. Contact

Rodrigo de la Torre González (individual sole proprietor) Av. Vallarta 4327, Camino Real, 45040, Zapopan, Jalisco, Mexico 📧 atencion@xtarly.com 🌐 https://www.xtarly.com

15. Language of this Policy

This Policy is published in Spanish and in English. In case of any discrepancy or doubt of interpretation between the two versions, the Spanish version prevails.