Want to see how it works for your business?

Back to home

Privacy Policy

Last updated: 2026-10-24

Draft — pending legal review. If you plan to use PuntosPro in production, we recommend having the final text reviewed by an attorney.

PuntosPro ("we", "the platform") is committed to protecting your privacy. This policy explains what personal data we collect, how we use it, and what rights you have over it. By using our app or website you agree to the practices described in this document.

1. Data controller

The controller of your personal data is Gaspar Birenbaum Chapital, owner of PuntosPro, based in Montevideo, Uruguay. For any privacy-related question you can email us at privacy@puntospro.com.

2. Data we collect

The data we collect depends on the type of account you create and how you use the platform.

If you're an end customer (PuntosPro app):

  • Name, email and password (hashed) when you sign up. Alternatively you can sign in with Google or Apple (Sign in with Apple); in that case we don't store a password, only the email verified by the provider.
  • Optional data you choose to add: phone, date of birth, gender, national ID.
  • Alias and unique QR code generated automatically so you can use the platform.
  • Notification language you choose (Spanish or English).
  • Memberships at enrolled businesses: points balance, tier, visits, total spent, transaction and redemption history.
  • Coupon book purchases and their usage (if applicable).

If you're a business (admin panel):

  • Business name, email, phone, address, city, state/province, business category.
  • Owner or team user data: name, email, hashed password, role (admin / staff).
  • Loyalty program configuration: point rates, tiers, rewards, campaigns.

Technical data:

  • IP address and the approximate country and city derived from it (for rate limiting, fraud prevention and support). For your account we only keep the country and city you signed up from and last signed in from, not the IP.
  • Session cookies needed to keep you signed in (httpOnly cookies named "token" and "app_token").
  • Audit logs for critical actions (login, redemptions, plan changes).
  • If you accept measurement cookies on the website, Google Analytics and Meta Pixel record your visits and, if you're a business, whether you completed sign-up. They are never loaded inside the iOS or Android app. We also store in your browser which campaign or site you came from (UTM parameters and referrer) so we know which ads bring us new businesses; that data is only sent to PuntosPro if you register a business.
  • If you turn on push notifications, an identifier for your device or browser so we can send them. It is deleted if you turn them off, sign out or the identifier stops being valid.

3. How we use your data

  • Operate the loyalty program: identify you, assign points, record redemptions, and apply tiers.
  • Send you service emails (welcome, points earned, redemptions, points expiry, password reset) and promotional emails from your programs (birthday, re-engagement, survey invitations). You can opt out of promotional emails at any time using the link included in each email. In some emails we measure whether you opened them with an invisible image, to learn which sends work.
  • Generate your personal QR code and read merchant or customer QRs using the device camera. The camera only turns on when you open the scan screen; we don't record, transmit, or store any images or video — we only decode the QR locally.
  • Optionally generate a Google Wallet pass for your loyalty card.
  • Prevent fraud and abuse and resolve disputes.
  • Comply with applicable legal obligations.
  • With your consent, measure website traffic, the effectiveness of our advertising campaigns and how the platform is used (for example, which buttons get clicked), in order to improve it.
  • Count anonymously how many people open a business's QR code or link, or start signing up their business on the site, and at which step they stop (whether the page loaded, which field they last touched, which error they saw), and randomly try different versions of those screens, to improve sign-up. It uses no cookies and isn’t linked to your account. It doesn’t store your IP either: to tell whether the same person opened the QR or link more than once, it only keeps a code computed with a secret key from your network, browser and the month, which changes every month. It’s deleted after 180 days.
  • Sending you push notifications, only if you turn them on: updates from your programs and PuntosPro surveys about the app. You can turn them off anytime in your phone or browser settings.

We don't sell or rent your data to third parties for advertising purposes.

4. Who we share your data with

We share data only with providers that supply services needed to operate the platform. Each of them processes data under its own privacy policy:

  • Vercel — hosting, app delivery, and anonymous usage metrics (Vercel Web Analytics and Speed Insights, cookieless and without personal data).
  • Supabase — database where your account information and movements are stored.
  • Resend — transactional email delivery.
  • Google — optional OAuth login and digital wallet pass generation when available.
  • Google (Google Analytics) — website visit statistics, only if you accept measurement cookies.
  • Meta Platforms (Meta Pixel) — measurement of our advertising campaigns on Facebook and Instagram, only if you accept measurement cookies.
  • PostHog — session recordings and click maps of the website to understand how the platform is used, only if you accept measurement cookies. Anything typed into forms, email addresses, phone numbers and the data of each business's customers are hidden before being sent. If you are signed in, the recording is linked to your account by an internal identifier (not by your name or email).
  • Google (Firebase Cloud Messaging), Apple (Apple Push Notification service) and your browser's notification service — delivery of push notifications, only if you turn them on.

We may also disclose information if required by a competent authority or as necessary to protect our rights or the rights of third parties.

5. Data retention

We keep your information for as long as your account is active. If you request deletion, we'll erase your identifiable personal data within 30 days, unless the law requires us to retain part of the information (for example, accounting records or financial transaction logs).

6. Your rights

Under Uruguay's Personal Data Protection Act (Law No. 18.331) and equivalent regulations, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or outdated data.
  • Request the deletion of your account and associated data.
  • Object to the processing of your data in certain circumstances.
  • Export your data in a readable format.

To exercise any of these rights, email us at privacy@puntospro.com from your registered address. We will respond within 10 business days. You also have the right to file a complaint with Uruguay's data protection authority (URCDP).

7. Security

Your passwords are stored hashed with bcrypt. Sessions use signed JWT tokens and httpOnly cookies with the Secure flag in production. All connections to the platform use HTTPS. We apply role-based access controls and audit logs for critical actions. No system is 100% impenetrable: we recommend choosing unique passwords and enabling two-factor authentication when available.

8. Minors

Our platform isn't directed at children under 13. If you're under 18, we ask you to have your parent's or guardian's consent to use it. If we discover a child under 13 has created an account without consent, we'll delete it.

9. International transfers

Some of our providers (Vercel, Supabase, Resend, Google, PostHog) have servers outside Uruguay. By using PuntosPro you accept that your data may be transferred to and processed in other countries where data protection may differ from Uruguay's, always under contractual clauses that ensure an adequate level of protection.

10. Cookies

Necessary cookies, always used because the platform doesn't work without them:

  • "token" — business session (valid for 7 days).
  • "app_token" — end customer session (valid for 30 days).

Measurement cookies, only set if you accept them in the website's cookie notice (never inside the iOS or Android app):

  • "_ga" and "_ga_*" — Google Analytics, to count visits and page views (last up to 2 years).
  • "_fbp" — Meta Pixel, to measure Facebook and Instagram campaigns (lasts 3 months).
  • "ph_*_posthog" — PostHog, to recognize your browser across visits and group the pages of a single session (lasts 1 year).

We also store in your browser's local storage:

  • "pp_cookie_consent" — your choice about measurement cookies, so we don't ask you again.
  • "pp_attribution" — the campaign or site you came from (up to 90 days). It never leaves your browser unless you register a business.
  • "pp_signup_visit" — a random identifier for your visit, only in this tab (session storage), to measure at which step of business sign-up people stop. It's deleted when you close the tab and isn't linked to your account.

You can accept or reject measurement cookies, and change your mind at any time, from "Cookie settings" in the page footer. If you reject them, the platform works exactly the same.

11. Changes to this policy

We may update this policy to reflect changes in the platform or regulations. If changes are substantial, we'll notify you by email at least 15 days in advance. The last-updated date is always shown at the top of this document.

12. Contact

If you have questions, concerns or complaints about this policy or about the processing of your data, write to privacy@puntospro.com.