This Policy describes how Cardify collects, uses and protects the personal data of the subscribing businesses that purchase the Service through cardify.com.mx and the Cardify iOS app. The processing of your end customers' data (the people who receive loyalty cards in Apple Wallet or Google Wallet) is described in a separate section below. If you live in the United States, section 10 explains your rights under U.S. state privacy laws.
Rosendo de Jesús Castellanos González ("Cardify"), an individual doing business, with an address at Calle 20 de Noviembre número 313, Colonia Centro, Tepatitlán de Morelos, Jalisco, C.P. 47600, Mexico, is responsible for processing your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and, where they apply, the privacy laws of the place where you live.
Contact: soporte@cardify.com.mx.
When you subscribe to and use the Service, we collect:
We do not receive or store credit or debit card data. Subscription payments are processed by Stripe. Cardify receives customer and subscription identifiers, payment status, amount, currency and dates. If Stripe already has them, it may also return billing country, state and city as a fallback for general location; Cardify does not keep street address or postal code. Older accounts may temporarily keep subscription confirmations issued by Apple while they are being migrated.
We do not collect sensitive personal data such as racial or ethnic origin, health, beliefs or sexual orientation.
We don't ask for any location when you create your account. If you later add a location in the app, we keep its address and city to run the Service—showing them on your customers' pass and, if you turn it on, sending proximity alerts—and to build aggregate statistics. Adding a location is optional and up to you; we don't infer your business's location from your IP address.
Primary purposes (needed to provide the Service):
Secondary purposes (not essential):
If you don't want your data used for secondary purposes, tell us anytime at soporte@cardify.com.mx. Saying no won't affect the main Service.
We use the following providers to run the platform. Each one processes only the data strictly needed for its function. We do not sell your data for money. Sharing data with advertising platforms to measure our own ads is explained in sections 9 and 10.
These providers may be located outside your country. We use contractual and technical measures to keep a level of protection equivalent to the one required by the LFPDPPP.
The Business is the controller of its customers' records and decides which enrollment fields to request. Records include name, email and card activity, plus phone number, optional date of birth and, when enabled, delivery address and optional delivery notes. Cardify processes these records on the Business's instructions as a processor or service provider; it remains responsible for processing it determines for its own platform security, support and legal duties.
An address is saved in the Business's customer record and may be consulted through its other cards by authorized staff; it is not shared with other independent businesses. It is not included in Apple Wallet or Google Wallet passes. Cardify does not sell these records, use them for its own advertising or send them to Meta, TikTok or OpenAI for advertising measurement. Supabase and Cloudflare process the information needed for their storage, server, hosting and protection services. Wallet providers receive only the pass data needed for their service. Resend receives the recipient email and message content needed to deliver verification and service emails, excluding delivery addresses and notes.
The Business must provide its legal identity, address, privacy notice and contact details before collection, justify why an address is needed and obtain any legally required consent. It must limit staff access and any disclosures it makes to couriers, external maps or other recipients. Cardify's enrollment Privacy Notice complements those duties. Providing an address does not place an order; the Business operates its deliveries.
Customers can request correction or deletion of their address through the Business or soporte@cardify.com.mx. Turning off the field, removing the Wallet pass or leaving the address empty does not by itself erase one already saved. Confirming a new address requires authorization and email verification. Addresses and notes expire 12 months after the last confirmation and a daily job deletes them; customers may request earlier deletion. Previously collected addresses without authorization stop being shown and are deleted in 30 days unless confirmed again. The Business remains responsible for external copies. The parties' processing, security, incident and deletion obligations are described in section 7 of the Terms.
We keep the Business's data while the subscription is active and for up to 30 calendar days after cancellation, during which you can request an export. After that it is deleted or anonymized, except data that tax, accounting or evidentiary rules require us to keep longer (for example, electronic invoices for up to 5 years).
End-customer data is kept while the related card is active and deleted after the customer leaves or after the subscription of the Business that issued the card is canceled.
Cardify uses reasonable administrative, technical and physical measures to protect personal data against loss, misuse or unauthorized access, including:
No system is completely invulnerable. If a security incident significantly affects your data, we will notify you without undue delay.
You have the right to access, correct and delete your personal data, to object to its processing and to withdraw any consent you gave us. To exercise any of these rights, email soporte@cardify.com.mx with:
We may ask for additional information to verify your identity before acting on the request. We respond within 20 business days (or the shorter period required by your local law) and carry out approved requests within the following 15 business days. Exercising these rights is free.
Under Mexican law you can also contact the Mexican data-protection authority if you believe your rights have been violated.
cardify.com.mx uses local storage and strictly necessary technologies to keep the sign-up flow working, remember your preferences (like language and currency) and protect the site. Cloudflare may set minimal technical cookies to protect against attacks.
We use the Meta Pixel, the Meta Conversions API, the TikTok Pixel, the TikTok Events API and the ChatGPT Ads pixel and Conversions API to learn whether a campaign brings visits, sign-ups, checkouts and subscriptions. These tools are on from your first visit and a notice tells you how to turn them off; you can opt out at any time, separately for Meta, TikTok and ChatGPT. These providers may set advertising cookies and receive technical data such as the URL visited, IP address, browser, click and browser identifiers, general page content and conversion events. For a confirmed subscription we also share the value and currency of the conversion, but never card data.
Cardify may confirm the same events to Meta and TikTok from its servers to improve measurement. We use a random or transaction-derived identifier so each provider can match the browser and server signal without counting two conversions. We never send your business name, passwords, form values, access tokens or Stripe identifiers. On the sign-up and payment pages we don't load these providers' code at all: measurement there happens only from our servers.
While Meta is on, we send Meta your email address and an account identifier converted into an irreversible code using SHA-256. This lets Meta recognize that a subscription came from an ad without us giving it your email: it receives the code, not the data. The conversion happens on our servers. We don't send this data to TikTok. If you turn Meta off, none of this is sent.
If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out and don't load Meta, TikTok or ChatGPT unless you turn them on yourself. You can turn them off, back on or change this choice anytime from the Your privacy choices link in the footer of cardify.com.mx, which opens a panel with a switch for each provider. When you turn them off, we delete any advertising cookies already created. Turning off one or both advertising tools doesn't affect signing up, paying or using Cardify. The iOS app doesn't use cookies; it uses the device's local storage to keep you signed in.
If you live in California or another U.S. state with a comprehensive privacy law, you have these additional rights:
In the last 12 months we collected the categories listed in section 2 (identifiers, commercial information about your subscription, internet activity on our site, and general location) from you, your devices and Stripe, for the purposes in section 3. We disclosed them to the service providers in section 4, and shared cookie data and hashed identifiers with Meta, TikTok and OpenAI as described in section 9. We keep them for the periods in section 6. We don't knowingly collect end-customer data from children under 13.
To exercise these rights, email soporte@cardify.com.mx with the subject "Privacy request". We verify your identity by matching the email on your Cardify account and respond within 45 days. You can use an authorized agent, who must show written permission from you.
Business subscriptions are for adults who run a business. The end-customer enrollment flow is not directed to children under 13 and requires an age confirmation. Cardify does not knowingly collect their personal information. If you think we received a child's data by mistake, email us and we'll cancel the enrollment and delete the information.
Cardify may update this Policy by posting a new version at this same URL. If the changes are significant, we'll email you at least 15 calendar days in advance. The date of the last update is always shown at the top.
For any question, comment or request about this Privacy Policy, email us at soporte@cardify.com.mx.