Privacy Policy · Xtarly Cashier

Last updated: October 7, 2026 Effective date: April 15, 2026 Applies to: the Xtarly Cashier mobile app (Android com.xtarly.cashier, iOS com.xtarly.cashier) and the business staff's access to the Xtarly web dashboard.

This Policy describes the processing of personal data in Xtarly Cashier —the mobile app intended exclusively for authorized staff (cashiers, managers and supervisors) of merchants that operate a loyalty program on the Xtarly platform— and in that same staff's access to the Xtarly web dashboard. If you are an end customer of a program, see the Xtarly Rewards Privacy Policy.

1. Roles

  • Program Operator (merchant), e.g. Caffenio. Acts as controller for the data of its customers processed through Xtarly Cashier.
  • Rodrigo de la Torre González (individual sole proprietor) ("Xtarly"), address Av. Vallarta 4327, Camino Real, 45040, Zapopan, Jalisco, Mexico. Acts as:
    • Processor for customer data that the cashier looks up via the app (on behalf of and for the Program Operator).
    • Controller for the data of the cashier (employee) needed to grant access and provide support.
  • Cashier / App user: a natural person employed or authorized by the Program Operator to operate the POS.

2. Personal data processed

2.1 Cashier data (Xtarly is controller)

  • Credentials: corporate email, password (hashed) or passkey.
  • Employee data: name, role (cashier, manager, admin), assigned organization and branch, schedule if applicable.
  • Local PIN: 4-digit PIN stored only on the device (shared-device mode); it is not sent to the server.
  • Biometrics (optional): fingerprint or face data is never transmitted or stored on our servers; it is validated by the device OS via expo-local-authentication.
  • Technical data: session token (JWT), push notification token, anonymous device identifier, model, OS, app version, IP and timestamps.

2.2 Program customer data (Xtarly is processor, Operator is controller)

The cashier transiently accesses customer data to operate earn and redemption transactions:

  • Name, email, phone (if captured by the Operator), avatar.
  • Points balance, stamps, tier and visible transaction history.
  • This data is shown on screen only for the time needed to complete the operation.

2.3 Data we do not collect

  • No GPS location.
  • No access to contacts, microphone, SMS or files.
  • No advertising SDKs.
  • No third-party behavioral analytics (Google Analytics, Facebook SDK).

3. Device permissions

PermissionPurposeMandatory
CameraScan the customer's QR code to identify them and operate earn or redemption (react-native-vision-camera).Functional — the app can be used with email lookup if denied.
Biometrics (Face ID / Touch ID / fingerprint)Unlock the cashier's session after inactivity (default 2 minutes in background).No
NotificationsOperational alerts (shift change, security alerts).No
InternetConnect to our servers.Yes

You can revoke any permission from device settings.

4. Purposes of processing

  1. Authenticate the cashier (password, passkey, local PIN and/or biometrics).
  2. Look up and display the customer information needed to earn points or redeem rewards.
  3. Record transactions (earn, redemption, coupon redemption) with idempotency (clientMutationId) and traceability (cashierStaffId).
  4. Offline operation: queue pending mutations in encrypted local storage (MMKV) and sync them once connectivity is restored.
  5. Prevent fraud, errors and abuse (e.g., duplicate redemptions).
  6. Meet the Operator's legal obligations (receipts, audits).
  7. Send operational push notifications to the cashier.

5. Legal basis (GDPR / EU)

  • Performance of the employment or service contract between cashier and Operator (art. 6.1.b GDPR).
  • Legal obligation for tax/accounting purposes (art. 6.1.c).
  • Legitimate interest for security and fraud prevention (art. 6.1.f).
  • Explicit consent for local biometrics (processed on-device by the OS; Xtarly does not receive the biometric template).

6. Data sharing

We do not sell data. We share it with:

  • The Program Operator (the cashier's employer) — via operation and audit dashboards.
  • Processors under DPAs:
    • Vercel Inc. — backend and web hosting.
    • Expo / Google FCM / Apple APNs — push delivery.
    • Supabase (managed PostgreSQL) — storage.
    • Resend — operational emails.
    • Railway Corporation — hosting of the platform's servers (API).
    • Sentry (Functional Software, Inc.) — error and performance monitoring for the app and our servers, so we can detect and fix failures. It receives the technical details of each error (what failed, on which screen, and the device type), a sample of load-time measurements and, like any server receiving a connection, your IP address. On the cashier screen and in the web dashboard it may receive a session replay with all text hidden and images blocked. We configure it not to send your name, email, phone number or cookies, and we do not use this information for advertising. It may process this data in the United States (see section 8).
  • Applications the Program Operator connects to its account (for example, AI assistants such as Claude, by Anthropic): if the person who manages the business authorizes them, they may read your name, role and branch to help organize the team. They never receive your email, password or phone number. The Operator chooses and uses that application, with its own account and under its own terms, possibly outside Mexico (for example, in the United States).
  • Competent authorities when legally required.

7. Local on-device storage

  • Session token → encrypted in expo-secure-store (iOS Keychain / Android Keystore).
  • Local PIN (if shared-device mode is enabled) → hashed in expo-secure-store.
  • Offline transaction queue → MMKV (encrypted). Contains pending operations with the scanned customer ID until synced. Purged on successful sync.
  • Selected branch / preferences → local non-sensitive storage.

On sign-out or "Wipe", everything above is deleted from the device.

8. International transfers

Some providers process data outside your country (mainly US and EU). Standard Contractual Clauses or equivalent safeguards apply.

9. Retention

  • Cashier data: for the duration of the relationship with the Operator + the legal retention period (up to 10 years in Mexico for tax/labor; 5 years in the EU).
  • Transaction records: per the Operator's accounting obligations.
  • Session / push tokens: destroyed on sign-out, uninstall or expiry.
  • Local offline queue: only until sync is confirmed.

10. Security

  • TLS 1.2+ for all traffic.
  • Password hashing with modern algorithms.
  • Tokens and PIN stored in the device secure enclave.
  • Auto-lock after inactivity (default 2 minutes in background) and unlock via biometrics/PIN.
  • Idempotency (clientMutationId) on every mutation to prevent duplicate charges or redemptions.
  • Least-privilege access for Xtarly staff.

11. Cashier rights

As a data subject you may:

  • Access, rectify, delete, restrict or object to processing.
  • Request portability.
  • Withdraw consent.
  • Lodge a complaint with the competent authority: in Mexico, the Secretaría Anticorrupción y Buen Gobierno (Anti-Corruption and Good Government Secretariat), the authority for personal data held by private parties (gob.mx/buengobierno); in the EU, your supervisory authority.

Contact: atencion@xtarly.com. Response time: 20 business days.

For customer data accessed through the app, rights are exercised before the Program Operator (employer).

12. Cashier account deletion

The cashier account is managed by the Program Operator (your employer). To request deletion or deactivation:

  1. Contact your organization's admin/HR, or
  2. Email atencion@xtarly.com stating your organization and corporate email, or
  3. Use the form at https://www.xtarly.com/legal/delete-account-cashier.

13. Children

Xtarly Cashier is not directed at children. Only adults authorized by the Program Operator may use it.

14. Changes

We will post the new version at this same URL. For material changes, we will notify you in-app or by email at least 15 days in advance.

15. Contact

Rodrigo de la Torre González (individual sole proprietor) Av. Vallarta 4327, Camino Real, 45040, Zapopan, Jalisco, Mexico 📧 atencion@xtarly.com 🌐 https://www.xtarly.com

16. Language of this Policy

This Policy is published in Spanish and in English. In case of any discrepancy or doubt of interpretation between the two versions, the Spanish version prevails.