Privacy Policy

Who we are

The PerkPass platform is operated by WASABI S.R.L. DE C.V., a Honduran software development company. For questions about this policy, use the contact listed at the end of this document.

Businesses and their customers

PerkPass is used in two distinct contexts. Businesses create an account to configure and run their loyalty program. Separately, those businesses' customers join a program and receive a digital loyalty pass.

Each business decides how its program works: which rewards it offers, which rules apply, and what information it requests from its customers within the options the platform provides. Member information is handled to operate that program on behalf of the corresponding business. Information relating to business accounts, the public website, and the operation of the platform itself is handled directly by us.

Business account data

When a business signs up and uses the admin panel we may handle: the business name, tax ID (RTN), and contact details, the logo and brand assets it uploads, its loyalty program configuration, and the account details of owners and staff (name, email, phone number, and access credentials).

In the mobile app for owners and staff, the camera is used to scan customer QR codes and, optionally, to take a profile photo. The device photo library is used only to select a profile photo through the system picker; we do not use the gallery for posts or any other purpose.

Loyalty member data

When a customer joins a loyalty program, registered by the business's staff or on their own through a QR code or public link, we may handle: their name, phone number and, where provided, email address, birthdate (used for birthday reminders or rewards if the business enables those features), and optional profile details such as city, address, or gender.

For businesses with WhatsApp verification enabled, the phone number is used to send a one-time code through a messaging provider at registration, sign-in, or password reset.

Wallet passes

PerkPass issues and updates loyalty passes for Apple Wallet and Google Wallet. To keep passes up to date we handle pass identifiers and the technical records Apple and Google require to deliver updates to a device (for example, device registration identifiers for Apple Wallet passes).

If the business enables nearby notifications, the pass may include the business's locations so the phone's operating system can surface the pass when the customer is close by. Apple and Google process information on their wallet platforms under their own terms and privacy policies.

Activity data

To run the program we record loyalty activity: stamps or points awarded, visits, rewards unlocked, redemptions, and, when the business sends announcements (Comunicados), the information needed to deliver them on the pass or by email.

Technical data

Like most online services, we generate technical records needed to operate and protect the platform: IP addresses, session identifiers, browser or device type, and error and diagnostic logs.

The public website uses Vercel Analytics to count visits and page views. It may also load Google Tag Manager when it is published for search engines. That container may include measurement or analytics tags; this policy does not list the container's internal contents. Analytics cookies stay off until you accept them in the site notice, and you can decline them without losing any feature. The admin panel uses strictly necessary session cookies, described in the Cookies Policy, and, if you accept the panel's cookie notice, Microsoft Clarity for usage analytics; it also uses Sentry for error monitoring. Your language preference on the public site is stored locally in your browser.

Purposes

We use the information described above to:

• Provide the loyalty platform: business accounts, member registration, and program operation;
• Issue and update loyalty passes in Apple Wallet and Google Wallet;
• Track program progress: stamps, points, visits, rewards, and redemptions;
• Send verification codes and operational notices essential to account security;
• Deliver the announcements each business configures (on the pass or by email);
• Provide support to businesses and their teams;
• Protect the security, performance, and stability of the service;
• Analyze usage to improve the product;
• Comply with legal obligations where applicable.

Third-party services

To operate the platform we rely on providers that process data on our behalf or on their own platforms, as applicable:

• Supabase: authentication and file storage;
• Vercel: hosting of the web applications;
• Apple and Google: wallet platforms and delivery of pass updates;
• Resend: email delivery;
• Twilio: WhatsApp verification codes, for businesses with that feature enabled;
• Expo: push notifications for the owners-and-staff mobile app;
• Upstash: usage limits (rate limiting) to protect the service;
• Vercel Analytics, Google Tag Manager, Microsoft Clarity, and Sentry: measurement, analytics, and error monitoring, as described above.

These providers process data under their own security and confidentiality commitments. If we change providers in the future, we will update this policy.

Sharing

We do not sell personal data. We share information with the providers described above only to the extent necessary to deliver the service, with the business that operates the program each member belongs to, and where required by law or a competent authority.

Retention and security

We keep data for as long as needed for the purposes described, the relationship with the business, and applicable legal periods. We apply reasonable technical and organizational safeguards, such as encrypted connections (HTTPS), access controls, and providers with industry-standard security. No system is completely invulnerable; if an incident affecting your rights occurs, we will make the notifications required by law.

Your rights

Under applicable Honduran law, you may request access to, rectification, cancellation of, or objection to the processing of your data. If you are a customer of a business using the platform, you can first contact the business that operates the program; you can also write to us directly using the contact at the end of this policy.

Owners and staff who use the PerkPass mobile app can delete their account from Profile → Account & security → Delete account. That deletion closes access, unlinks authentication credentials (including Sign in with Apple revocation when applicable), and leaves the profile inactive and hidden from the business admin panel. You can register again later with the same email or phone; that creates a new account. Operational business records (for example points or redemption history) may be retained linked to the inactive record. You can also follow the instructions at Delete account.

Businesses using the platform may request a copy of the business records and loyalty-program data they provide or generate through the Service. Today, the admin panel lets businesses export their client list on plans that include that feature; a copy of the rest of those records can be requested through our official contact channel, listed at the end of this policy. We process that information in order to provide the Service. This does not eliminate the privacy rights of individual loyalty members over their personal data.

Minors

The service is intended for people who can validly join a loyalty program under the law. If you become aware of data about minors collected without proper support, contact the relevant business or write to us for review.

Changes

We may update this policy; the effective date appears at the top and we recommend reviewing it periodically. The Terms of Service complement this information.

Contact

For data protection requests or questions about this policy: info@perkpass.to.