Privacy Policy

Who is responsible for your data

Carmen Marlet Fregoso Rodríguez (an individual with business activity registered under Mexico's Simplified Trust Regime (RESICO)), who operates the platform under the "Aroa Wallet" brand ("Aroa"), based in Zapopan, Jalisco, Mexico, is responsible for the personal data collected through the Aroa Wallet platform as its operator, and acts as a processor (a service provider) when it handles data on behalf of a Tenant.

This Policy is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), published in the Official Gazette of the Federation (DOF) on March 20, 2025, and its regulations, and includes a section for users in the United States.

Personal data we collect

From the Tenant (the subscribing business):

• Name or legal name and tax details (RFC for Mexico accounts).
• Contact email of the owner and staff.
• Payment method details (processed directly by Stripe; Aroa does not store card numbers or CVV).
• Logo, branding, physical location and loyalty program settings.

From the staff who use the app and dashboard (owners and cashiers):

• Name, email and assigned locations.
• The phone's location when adding a stamp or redeeming, only if the business turns on the location lock. It is compared with the location of the store and is only saved when the attempt is rejected.
• Photos and images the business uploads (logo and pass images), from the web or from the phone's camera or gallery.
• Which staff member took the receipt photo, or who skipped that step, and when, if the business asks for it (see Receipt photos).
• App crash reports (which screen failed and the error), without personal data.

From the Tenant's customers:

• Name.
• Phone number (required to sign up).
• Email (optional).
• Birthday (optional).
• The amount of each purchase, when the business records it.
• A photo of the purchase receipt when a stamp is added, only if the business asks for it (see Receipt photos).
• Wallet balance, if the business uses it, and its PIN, which is stored as a hash: nobody can read it, not even Aroa.
• Technical identifiers of the digital pass (serial number, authentication token), strictly to run Apple Wallet and Google Wallet.
• Stamp and reward history linked to the pass, including date, source (QR or manual) and, where applicable, the location where it happened.

We do not collect sensitive personal data. We do not ask customers for addresses, government IDs, tax IDs, bank details or health data.

How we use it

Primary purposes (needed to provide the service):

• Create and maintain the Tenant's account.
• Issue, update and revoke loyalty passes in Apple Wallet and Google Wallet.
• Process payments and, for Mexico accounts, issue tax invoices (CFDI 4.0).
• Send push notifications about the pass (stamps added, reward ready).
• Send emails to the business owner: security alerts and the daily stamp summary.
• Prevent staff theft: with the location lock on, confirm that the cashier's phone is at the store before adding a stamp.
• Prevent misuse of the program: when the business asks for a receipt photo, check that every stamp comes from a purchase.
• Technical support, fraud prevention and legal compliance.

Secondary purposes (you can opt out):

• Emails to the Tenant about new features of the service.

To opt out of secondary purposes, email hello@aroagroup.com at any time.

Receipt photos

Some businesses ask for a photo of the purchase receipt when they add a stamp. It is only taken if the business turns this option on; otherwise it is not collected.

What data: the photo of the receipt that the business staff takes when adding the stamp. It may show what you bought, the total, the date, the location and, if the receipt includes them, a name or the last digits of a card; Aroa does not extract that data or store it separately. We also keep which staff member took it, or who skipped that step, and when.

Why: to check that every stamp comes from a purchase and to detect misuse of the loyalty program, for example stamps without a purchase or the same receipt on several cards. Aroa staff may review the photos and, if something does not add up, show it to the business as a case to review, which never blocks anyone on its own. This is part of the primary purposes of this Policy (fraud prevention), and Aroa handles it on behalf of the business. It is not used for advertising or for anything else.

Who sees it: the business owner and Aroa staff. Whoever takes it sees it on their screen at that moment; after that, neither cashiers nor managers can open it. It is stored in a private space for each business.

How long we keep it: 40 days from upload. If the photo is evidence in a case to review that is still open, it stays until the business marks the case as reviewed; then it is deleted as soon as the 40 days have passed. Once the image is deleted, only the record that the stamp had a photo remains. If the business closes its account, the photos are deleted with the rest of its data.

Your rights: you have the same rights over the receipt photo as over the rest of your data. To ask for a copy or ask us to delete it, contact the business or email hello@aroagroup.com; we answer within the periods in the Your rights section.

Who we share it with

Aroa does not sell, rent or share personal data with third parties for marketing, advertising or model training.

Aroa sends data to the following processors, which handle it only on Aroa's behalf and only to run the service:

• Supabase Inc. (United States, us-east-1 region): database, authentication and storage.
• Vercel Inc. (United States): website hosting and serverless functions.
• Apple Inc. (United States): issuing and delivering Apple Wallet passes through APNs.
• Google LLC (United States): issuing and delivering Google Wallet passes (when applicable), maps in the Android app (the Google Maps SDK, which sends technical device data to Google under its own policy) and ad conversion measurement only if the visitor accepts the advertising cookie.
• Stripe Inc. (United States): processing the Tenant's payments.
• Resend Inc. (United States): sending transactional emails.

Under the LFPDPPP, giving data to a processor that handles it on Aroa's behalf is a remission, not a transfer: the processor follows Aroa's instructions and does not use the data for its own purposes. The only data Google handles under its own policy is the technical data from the maps SDK and ad measurement, the latter only if the visitor accepts the advertising cookie. Aroa chooses providers whose privacy practices are equal to or stricter than what the law requires.

Your rights

As the owner of your personal data, you can:

• Access the personal data Aroa holds about you.
• Correct incomplete or inaccurate data.
• Delete your data when it is no longer needed.
• Object to specific uses.

To exercise these rights, email hello@aroagroup.com with:

• Your full name.
• Something that confirms your identity.
• A clear description of the data and the right you are exercising.
• Anything that helps us find the data.

Aroa answers within 20 business days of receiving the request and, if it applies, carries it out within the following 15 business days. These periods can be extended once for the same length when there is a good reason.

Withdrawing consent

You can withdraw your consent at any time by emailing hello@aroagroup.com. Keep in mind that withdrawing it may prevent us from providing some services and may end the relationship with Aroa or with the Tenant.

Storage and retention

We keep personal data only as long as needed for the purposes above and the legal obligations that apply:

• Tenant data: during the relationship and up to 30 days after cancellation (so you can export it). Then it is deleted, except tax records, which Mexican tax law requires us to keep for 5 years.
• Customer data: while the Tenant keeps the service active. If the Tenant cancels, it is deleted together with the Tenant's data.
• Receipt photos: 40 days from upload, except those that are evidence in an open case, which stay until the business marks it as reviewed. Then they are deleted automatically.
• Technical logs: 30 days online, then deleted automatically.
• Sign up magic links: 7 calendar days, then deleted automatically.
• Attempts rejected by the location lock or by a blocked card, with the phone's location at that moment: 180 days, then deleted automatically.

How to delete your account or only some data, and what we keep: wallet.aroagroup.com/en/borrar-cuenta.

Security

Aroa uses reasonable administrative, technical and physical measures to protect personal data:

• TLS 1.2+ encryption for all traffic (HSTS enabled).
• Multi-tenant isolation with Row Level Security (RLS).
• Aroa staff sign in only with Google OAuth and MFA enabled.
• Credentials stored with SHA-256 hashing and salt; Aroa never stores plain text passwords.
• Production access limited by the principle of least privilege.
• Continuous error monitoring with Aroa's own system, hosted on the same infrastructure listed above: data does not go to an extra provider. Personal fields are redacted before they are logged.
• Automatic daily backups: the database provider keeps them 7 days and Aroa's own for 14 days; copies taken before each system update are kept 90 days.

Cookies and similar technologies

The site uses strictly necessary cookies to keep you signed in and remember your language. Visit analytics are our own (Aroa Analytics), with no third party cookies and no personal data.

Ad measurement (only with your consent): when Aroa runs ads (for example Google Ads), public pages may show a banner asking permission to use Google LLC's conversion cookie, which only tells us which ad led to a sign up. That cookie is only set if you accept it; if you decline, the site works exactly the same. We do not use social media pixels or other third party tracking.

You can withdraw that consent at any time right here (the button appears below if you gave it in this browser); cookies Google already set can be removed from your browser settings.

Users in the United States and Puerto Rico

If you live in the United States or Puerto Rico, including California, you also have the right to know what personal data we hold about you and get a copy, to ask us to correct or delete it, and not to be treated differently for exercising these rights.

Aroa does not sell personal data and does not share it for cross context behavioral advertising. The only advertising cookie is this site's ad measurement cookie, which is only set if you accept it and which you can withdraw in the cookies section.

To exercise these rights, email hello@aroagroup.com; we may ask you to confirm your identity, and you can use an authorized agent. Data is stored on servers in the United States (us-east-1 region) of the providers listed above. Aroa Wallet is not directed to children under 13 and does not knowingly collect their data.

Changes to this Policy

Aroa may update this Policy. Changes are posted at wallet.aroagroup.com/en/privacidad with the date of the last update at the top. Material changes are emailed to the Tenant's owner at least 30 days in advance.

Complaints

If you believe your data protection rights were not respected, you can file a complaint with Mexico's data protection authority, the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Governance), which oversees compliance with the LFPDPPP. More information at gob.mx/buengobierno. If you live in the United States, you can also contact the privacy authority of your state. We would rather hear from you first at hello@aroagroup.com.

Privacy contact

Privacy officer email: hello@aroagroup.com