The update date does not establish prior notification. Material changes for existing Businesses will be communicated under section 13; express acceptance of the address notice applies when voluntarily activating that feature.
These Terms of Service (the "Terms") govern access to and use of the Cardify app, services and platform (together, the "Service"), provided by Rosendo de Jesús Castellanos González, an individual with an address at Calle 20 de Noviembre número 313, Colonia Centro, Tepatitlán de Morelos, Jalisco, C.P. 47600, Mexico ("Cardify", "we", "us").
By downloading the app, purchasing a subscription or using the Service, you expressly agree to these Terms. If you do not agree, do not purchase or use the Service.
These Terms are also available in Spanish. Both versions have the same content; if they ever conflict, the Spanish version prevails.
Cardify is for individuals and legal entities that operate a business, in Mexico or in any other country where the Service is offered (the "Business" or "Customer"). By subscribing you represent that:
Cardify is a loyalty platform that lets the Business issue digital cards (stamps, prepaid visit passes, memberships and promotions) to its end customers through Apple Wallet and Google Wallet, and manage those cards from an iOS app and a web dashboard. An active subscription includes, subject to the capacity of the plan purchased:
Cardify offers the following plans. The price depends on the country you subscribe from:
An end customer counts once per Business account, regardless of their activity or the number of cards they are enrolled in. Permanently deleted customers stop counting once the deletion process is complete, without prejudice to records Cardify must keep for legal or security reasons.
When the plan limit is reached, the Business can keep viewing and serving existing records, but cannot register new customers until it moves to a plan with more capacity or reduces its number of registered customers. Cardify may show warnings before the limit is reached.
These limits apply immediately to new subscriptions and plan changes made on or after September 9, 2026. Subscriptions purchased earlier keep their current conditions until Cardify gives notice of any change under section 13.
The Starter plan costs $25.00 USD (twenty-five US dollars) per month when purchased from outside Mexico, and $399.00 MXN (three hundred ninety-nine Mexican pesos) per month when purchased in Mexico. The Growth plan costs $50.00 USD (fifty US dollars) per month outside Mexico and $799.00 MXN (seven hundred ninety-nine Mexican pesos) per month in Mexico. Prices include any applicable taxes. The currency is set when you subscribe and does not change on later renewals, even if you move to a different country. Subscriptions, charges and renewals are processed by Stripe. Cardify does not receive or store your full card details; Stripe processes them under its own terms and security standards.
Your subscription renews automatically every month unless you cancel at least 24 hours before the end of the current period. You can manage your payment method, invoices and cancellation from the Stripe portal available in your web account.
Cardify may change the subscription price by notifying you at least 30 calendar days in advance by email or in the app. If you do not agree with the new price, you can cancel before it takes effect.
You can cancel your subscription at any time from the Stripe portal in My account → Plan. Cancellation takes effect at the end of the monthly period already paid; you keep access to the Service until then.
To request a review or refund of a charge processed by Stripe, email soporte@cardify.com.mx. Requests are assessed under applicable law and the service actually provided.
Older accounts that still have a period billed by Apple must turn off renewal in Settings → your Apple ID → Subscriptions. That period and any related refund remain subject to Apple's policies until the move to Stripe is complete.
To use the Service you must create an account with a valid email address or sign in with Apple or Google. You are responsible for:
7.1. Roles and scope. The Business decides which customer information to request and the purposes of its loyalty program and deliveries; it is the controller of that processing. Cardify processes the records on its behalf as a processor, or as a service provider where the applicable law so provides. This covers collection, storage, consultation, updating, pass issuance, customer segmentation, business-confirmed promotions and deletion during the service relationship and any applicable retention period. Data includes name, email, visits and activity; phone, date of birth, address and optional delivery notes when requested. Cardify remains responsible for processing it determines for its own platform security, support and legal duties.
7.2. Instructions and notices. These Terms, the enabled settings and lawful requests sent to support document the Business's instructions. The Business must provide its legal identity, address, contact details and its own privacy notice before collection, establish a lawful basis and obtain and retain evidence of any required consent. Cardify's enrollment Privacy Notice complements those duties and does not replace them. The Business must not direct enrollment to children under 13 or knowingly enroll them.
7.3. Addresses and delivery operations. Requesting addresses is disabled by default. The Business may enable it only when necessary and proportionate for deliveries requested by its customers, with the purpose disclosed before collection. The field is shown only after the Business publishes its legal identity, address and contact email and accepts the standard notice in Profile. Addresses and notes are optional for customers and require separate authorization and email verification. If an address is not necessary for the requested service, the Business must keep this option disabled or provide an alternative that does not require it. It must not request identity documents, sensitive information, passwords or access codes in these fields.
The address is stored in the Business's customer record and may be consulted through its other cards by authorized staff. It is not included in the Wallet pass. The Business must restrict access to staff who need it, verify an address with the customer before relying on it for a delivery, and request correction through support when needed. The customer may confirm a new address by enrolling again and verifying their email. Cardify does not verify residence or operate deliveries. The Business handles orders, coverage, prices, timing, couriers, required disclosures and delivery claims.
7.4. Limits on processing. Cardify will process customer records only for the documented service purposes or as legally required; it will not sell them, use them for its own advertising, or combine them with other businesses' customer records for unrelated purposes. The Business must not sell, disclose or reuse an address for unauthorized purposes, unsolicited home visits or advertising unrelated to the disclosed purpose. Separate legal duties and consent requirements apply to any additional use.
7.5. Security and providers. Both parties must apply appropriate security measures and confidentiality obligations. The Business authorizes Cardify to use Supabase for storage and server processing, Cloudflare for enrollment hosting and protection, and Resend for verification and service emails (recipient email and message content, excluding delivery address and notes), including necessary international processing under applicable safeguards. Apple and Google receive the necessary Wallet pass data under their applicable terms; they do not receive the delivery address in the pass. Any additional subcontractor with access to customer records must be disclosed to the Business in advance and bound by appropriate confidentiality, security and purpose restrictions. Cardify remains responsible for its own contractual and legal duties. The Business must separately assess and inform customers about couriers, external maps and any other recipients it chooses.
7.6. Requests, incidents and end of service. The parties will cooperate on access, correction, deletion, objection and other applicable privacy requests. The Business must forward requests requiring technical action to soporte@cardify.com.mx promptly enough to meet legal deadlines. Each party will notify the other without undue delay of a confirmed incident affecting these records and cooperate on legally required notifications and remediation. Cardify will provide reasonably necessary compliance information and cooperate with legally required assessments without exposing other customers' information or compromising security. If Cardify can no longer meet its processing obligations, it will inform the Business and cooperate to stop or remedy the affected processing. Upon termination or a lawful deletion instruction, Cardify will arrange return or deletion of customer records, except legally required restricted retention. The Business remains responsible for its own external copies. Disabling address collection or removing a Wallet pass does not by itself erase a saved address.
Address retention. It expires 12 months after its last confirmation, stops being shown and is deleted by a daily job. Customers may request earlier deletion. Previously collected addresses without this authorization stop being shown and are deleted in 30 days unless confirmed again. The Business expressly accepts these conditions when publishing its notice, without relying on implied acceptance through continued use.
The Business agrees not to:
Cardify may suspend or terminate the account of any Business that breaks these rules, with prior notice when possible. Damages caused by misuse are the sole responsibility of the Business.
The Service is provided "as is" and "as available". While we work to keep it running continuously, we do not guarantee it will be free of interruptions, errors or delays. Apple Wallet, Google Wallet, push notification services, internet connectivity and infrastructure providers are supplied by third parties and may fail for reasons beyond our control.
Cardify may carry out scheduled maintenance that temporarily affects availability. When reasonably possible, we will give advance notice.
The "Cardify" brand, the app design, text, graphics, source code and documentation belong to Rosendo de Jesús Castellanos González or his licensors and are protected by Mexican and international intellectual-property laws.
The Business keeps all rights to its own logo, trade name and materials it uploads to the platform. By uploading them, it grants Cardify a limited, non-exclusive, royalty-free license to display them on the Service's cards, passes and materials for the duration of the subscription.
To the fullest extent permitted by law, Cardify will not be liable for indirect, incidental, special, consequential or punitive damages, including lost profits, lost data, loss of reputation or lost business opportunities arising from the use of, or inability to use, the Service.
Cardify's total cumulative liability for any claim arising from these Terms will not exceed the amount paid by the Business during the three (3) months before the event giving rise to the claim.
These limits do not exclude liability for fraud, gross negligence or any liability that cannot legally be excluded or limited, including applicable privacy and consumer-protection duties.
To the extent permitted by law and attributable to the Business, the Business will indemnify Cardify for third-party claims and reasonable, documented defense costs caused by the Business's unlawful collection or disclosure of customer data, misuse of addresses, delivery operations or other breach of these Terms. This does not cover loss caused by Cardify's own acts or omissions. Cardify will promptly notify the Business and allow reasonable participation in the defense; no settlement may impose obligations on the Business without its consent.
Cardify may change these Terms by posting an updated version at this same URL. Material changes will be sent to your registered email at least 15 calendar days in advance. Continuing to use the Service after the changes take effect means you accept them.
Either party may end the relationship at any time. If the Business cancels, the Service stays active until the end of the monthly period already paid. Cardify may suspend or terminate access immediately in cases of serious breach of these Terms, fraud or legal requirement.
After termination, the Business's data is kept for up to 30 calendar days, during which it can request an export. After that, data is deleted under the Privacy Policy, except data the law requires us to keep.
The processing of personal data is governed by our Privacy Policy, which is an integral part of these Terms.
These Terms are governed by Mexican law. Where legally permitted, the competent courts of Tepatitlán de Morelos, Jalisco, Mexico will have jurisdiction. Mandatory protections, privacy rights and the jurisdiction of authorities or courts established by applicable law remain unaffected.
For questions, support or any communication about these Terms, email us at soporte@cardify.com.mx.