Privacy Notice
This is a courtesy English translation. In case of any discrepancy, the Spanish version prevails.
1. Identity and address of the data controller
PunchyPass (trade name; legal entity registration in progress), with its address at Sinaloa 179, Roma Norte, Mexico City, is responsible for the processing of your personal data in accordance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), its Regulations, and the Privacy Notice Guidelines.
2. Personal data we collect
We collect the following personal data that you provide voluntarily:
- Waitlist (pre-launch mode): only your email address.
- Starting a PunchyPass Pro sign-up: your email, your business's trade name and, optionally, your WhatsApp number. We collect them in the form shown before you create your account so we can reach out if you leave the sign-up unfinished.
- Account creation: the data Auth0 captures as part of authentication (verified email and unique user identifier). We do not receive your password; Auth0 manages it directly.
- Subscription: the billing data captured by Stripe (name, tax address if applicable, masked card data). We do not touch or store your card; all payment information lives in Stripe.
We do not collect sensitive data, financial data other than the above, or information from minors.
3. Purposes of the processing
We process your data exclusively for the following primary purposes, which gave rise to and are necessary for our relationship with you:
- Notifying you when PunchyPass becomes available (waitlist).
- Allowing you to start a PunchyPass Pro sign-up and pre-filling the data you already gave us when you reach the account creation step.
- Sending you a recovery email if you started the sign-up and did not finish it, so you can pick it up again. This email is operational (not advertising) and is sent only once.
- Authenticating your access, managing your subscription, processing payments, and issuing invoices. These purposes operate through the data processors described in section 4.
- Handling ARCO rights requests you send us.
We process your data for the following secondary purposes only if you give us your express consent by checking the corresponding box:
- Sending you customer retention tips by email. You can revoke this consent at any time by replying to any of those emails or by writing to contacto@punchypass.com.
We do not sell, rent, or exchange your data with third parties for advertising purposes. We do not use your data for automated profiling with legal effects.
4. Transfers and data processors
Your data is stored and processed through the following data processors, which act on behalf of PunchyPass under confidentiality and security obligations. Each one processes only the data necessary for the stated purpose:
- Cloudflare, Inc. (United States): technical infrastructure that receives the modal form and routes your data to the other processors.
- Brevo (Sendinblue SAS) (France): management of the waitlist and of the Pro sign-up contact list; sending of marketing communications if you gave us your express consent.
- Auth0 (Okta, Inc.) (United States): user authentication. It verifies your email and manages your password without us ever seeing it.
- Stripe Payments Europe, Ltd. (Ireland, with processing in the United States): subscription billing and invoice issuance. It processes your card data directly; we receive an identifier, never the card number.
- IONOS SE (Germany): outbound email infrastructure for operational messages (sign-up recovery, subscription notices).
- Astral Restaurant Systems (Mexico): operator of the platform, responsible for processing the data related to your PunchyPass Pro account.
These international transfers are necessary to fulfill the purposes described in section 3 and do not require your additional consent under article 37 of the LFPDPPP. We do not sell, rent, or share your data with third parties for purposes other than those described here.
5. ARCO rights and revocation of consent
You have the right to Access your personal data, Rectify it when it is inaccurate, Cancel it when it is no longer necessary, and Object to its processing (the "ARCO" rights). You can also revoke your consent at any time.
To exercise any of these rights, send a request to contacto@punchypass.com stating:
- Your name and a contact email.
- The right you wish to exercise and, where applicable, the data it concerns.
- Any document supporting your request.
We will respond to your request within a maximum of 20 business days from its receipt. If the request is granted, we will have 15 additional business days to make it effective.
If you are only on the waitlist or on the Pro sign-up contact list: revocation is equivalent to unsubscribing and your email will be deleted from Brevo.
If you already have a PunchyPass Pro account: you can cancel your subscription and request the deletion of your data. We will keep only the minimum records the law requires us to retain (for example, issued invoices) for the applicable period; the rest is permanently deleted.
6. Changes to this privacy notice
We may update this notice to reflect changes in our practices, in applicable law, or in the services we use. Any modification will be published at this same URL with its new date and version number. We recommend reviewing it periodically. If the changes are substantial, we will notify you at the email you gave us.
7. Contact
For any questions about this notice or the processing of your data: contacto@punchypass.com.