esen

Last updated: October 10, 2026

Privacy policy

This policy explains what data tappi processes, what for, and the rights each person has, in accordance with Argentina’s Personal Data Protection Law No. 25,326. This is a translation of the Spanish version; if the two differ, the Spanish version prevails.

1. Who is responsible for the data

  • Customers of a business. When someone joins a business’s card, that business is the data controller. tappi processes the data on its behalf, as a processor, so the card works.
  • Businesses and their staff. tappi is the controller of the account data of owners and employees.

2. What data is processed

  • From customers: name, mobile number, email, birthday (if provided), stamps, redemptions and the branch where they happened.
  • From businesses: business name, industry, branches, card design, name and email of owners and employees, and the subscription status.
  • Technical data: access and error logs, and a cookie to remember the customer’s card in their browser and the business’s session.

tappi does not store credit or debit card details: payments are processed by Mercado Pago.

3. What it is used for

  • Running the loyalty card: recording stamps, rewards and redemptions.
  • Showing the card in Apple Wallet or Google Wallet and keeping it up to date.
  • Sending notices about the card (stamp added, reward available) and the news the business decides to share.
  • Billing the business’s subscription, providing support and keeping the service secure.

Data is never sold or used for third-party advertising.

4. Who it is shared with

Only with the providers needed to deliver the service:

  • Supabase and Vercel, to host the database and the application.
  • Apple and Google, when the customer chooses to save the card in their wallet.
  • Mercado Pago, to bill business subscriptions.

Some of these providers process data outside Argentina. By joining a card or creating an account, the person consents to that transfer, which is carried out under each provider’s security measures.

5. How long it is kept

For as long as the card or the business account remains active. When a business closes its account or a customer asks for their data to be deleted, it is erased within a reasonable period, except for what must be kept by legal obligation.

6. People’s rights

Anyone may ask to access, correct, update or delete their data, and to stop receiving news. Customers of a business can ask at the shop or by writing to tappi; they can also remove the card from their wallet at any time, which stops the notifications.

The Agency for Access to Public Information (Agencia de Acceso a la Información Pública), as the supervisory authority of Law No. 25,326, is empowered to hear complaints and claims from those whose rights are affected by a breach of the data protection rules in force.

7. Security

Data travels encrypted, each business can only access its own, and staff access is logged. No system is infallible: if an incident affecting personal data occurs, tappi will notify the businesses affected.

8. Changes

If this policy changes significantly, businesses will be notified in the dashboard before the change takes effect.