Privacy policy

1. What data we process

From the business and its team: the name, phone number and email of the person who creates the account, the email of each person added to the team, the business name, the address and location of each store, the contact phone, the logo, the colors and the program's settings. If you sign in with Google, we receive the email and name from that account. Your name and phone number are saved from the first step of sign-up, even if you do not finish it.

From the business's customers: the name, email, phone and date of birth the customer types when signing up from the business's QR code, and whether they agreed to receive notices from that business. Also their visits, stamps, points and rewards, and the purchase amount when the business records it. If they save the card to Apple Wallet or Google Wallet, we keep the pass and device identifiers needed to update it.

From the waitlist: the email you leave us to hear when sign-up opens.

Usage data: pages visited and actions inside the site and the app, the IP address and browser details. To limit sign-up code requests we store a hash of the IP, which cannot be turned back into the IP.

Payments: subscriptions are charged through Polar. We never see or store card details; from Polar we receive the subscription status.

2. What we use it for

To run the program (calculating stamps, points and rewards), verify the email with a code, update the wallet pass and show the business's notices on it, give you support, charge subscriptions, send you operational notices and improve the product.

We may message you on WhatsApp about your account: to help you finish signing up or get your card ready, or to ask why you did not continue. If you do not want us to message you, tell us and we will stop.

To measure our ads. If you visit the site from the European Union, the European Economic Area, the United Kingdom or Switzerland, only if you accept advertising cookies in the site's notice. When a business signs up or someone joins the waitlist, we send that event to Meta with the email, the phone and an identifier converted into a hash (SHA-256), along with the IP and browser details, to learn which ad brought the sign-up. Google Ads measures visits that come from its ads. Data about the businesses' customers is not used for this.

Rewa currently sends no automatic emails to the businesses' customers, only the sign-up verification code. Every automatic email to a customer carries an unsubscribe link, and using it deletes their consent.

We do not sell personal data.

3. If you are a customer of a business using Rewa

You sign up yourself, from the business's QR code, and the business is responsible for your data: it decides what benefits to offer and whether to send you notices. Rewa processes your data on the business's behalf and only to make the program work. The business's screens show your email and phone partly hidden.

To review, correct or delete your data, the most direct path is to talk to the business. You can also write to us and we will sort it out with them.

If your data is deleted, we remove your name, email, phone, date of birth and consent, and your card and pass stop working. Your visits and redemptions stay without data that identifies you, so the business's numbers still add up.

4. Who we share data with

We use providers that process data for us, only as needed for each task:

Supabase (database and authentication), Vercel (hosting and site metrics), PostHog (product analytics), Ahrefs (site visit metrics), Resend (sending email, such as the verification code) and Polar (subscription billing).

Google: sign-in if you choose it, Google Maps to find your business when you sign up, Google Wallet for the pass of anyone who saves it there and Google Ads to measure ads. Apple: Apple Wallet and its notification service, for the pass of anyone who saves it on an iPhone. The pass carries the customer's name and balance.

Meta: ad measurement with its pixel and its Conversions API, as explained in section 2. OpenStreetMap: locating the business's address when Google is not used, and showing the map.

Beyond those providers and legal obligations, we do not share personal data with anyone.

5. Cookies

We use session cookies to keep you signed in, a cookie to remember your language and analytics cookies to measure use of the site and the app.

On the public site and in business sign-up we use Meta and Google Ads advertising cookies to measure our ads. They are never used on the customer's card or in the business app.

From the European Union, the European Economic Area, the United Kingdom or Switzerland, they are only used if you accept them in the notice. If you reject or don't answer, Meta doesn't load and Google Ads stores no cookies. To change your answer, delete tryrewa.com's cookies in your browser and the notice comes back.

From other countries they are used without a notice. If you do not want to be measured, you can block them in your browser or with an ad blocker. If you ever rejected cookies in the notice, we respect that answer.

6. Where data is stored

Our providers may store data on servers outside your country (for example, in the United States or Europe). When that happens, each provider's contracts and safeguards apply to protect the information.

7. How long we keep it

For as long as the business account exists, including while it is paused. If the account is closed, we delete or anonymize personal data within a reasonable period, except for what we must keep for legal or accounting obligations. We keep waitlist emails until you ask us to delete them.

8. Security

Data travels encrypted and access is restricted: each business can only see its own customers and activity. Only the owner and admins can delete customers or correct balances, and every correction is logged with who made it and why. No system is infallible; if we detect an incident affecting your data, we will let you know.

9. Your rights

You can request access, correction, update or deletion of your personal data by writing to contact@tryrewa.com. In Argentina, the Agency for Access to Public Information (AAIP) enforces Law 25,326 on Personal Data Protection and you can file complaints with it. If you are in another country, the rights granted by your local law apply.

10. Minors

Rewa is aimed at businesses and their adult customers. We do not knowingly collect data from minors; if a minor signed up for a program, the business or their family can ask us to delete it.

11. Changes to this policy

We will publish the current version here with its update date. If a change is significant, we will announce it inside the app or by email.