Privacy policy

Who we are

Passito ("we") runs the loyalty platform available at passito.app, which lets businesses issue loyalty cards, coupons and rewards in Apple Wallet and Google Wallet. For anything about privacy you can write to us at hola@passito.app.

Data we collect

From businesses: business name, contact details and access credentials. From the customers who join a program: name, phone, email and date of birth when the business asks for them, along with program activity (stamps, points, redemptions). From visitors to this site: the usage and browsing data described in the analytics section.

What we use them for

To run the loyalty programs: issue and update passes, credit stamps and points, deliver coupons and rewards, and share program news. We use site usage data to understand what works and improve the product. We do not sell personal data to third parties.

Cookies

This site uses a single first-party cookie, a technical one that protects the forms (such as sign-up) against forged submissions and expires after a year. We do not use advertising or tracking cookies, and our analytics tool is set up to work without cookies or persistent identifiers in your browser. You can block or delete cookies from your browser settings; the site keeps working, though forms need the technical cookie in order to be sent.

Analytics and session recording

We use a product analytics tool to measure how the site is used: pages visited, clicks and navigation path. We also record browsing sessions (movements and interactions inside the page) to spot usability problems and improve the site; in those recordings, what you type into form fields appears masked. This analytics works without cookies and without persistent identifiers, so it does not follow you across visits or across sites. Analytics data is processed on our analytics provider's servers in the United States.

Where the data is stored

Loyalty program data is hosted with cloud infrastructure providers, encrypted in transit. Access is scoped by business: each business only sees the data of its own customers. Analytics data is hosted with our analytics provider, in the United States, as described above.

Retention

Program data is kept while the business account is active or while the customer keeps their card. Session recordings are deleted automatically after a short period (around 30 days). When an account is deleted, the personal data attached to it is deleted or anonymized within a reasonable time.

Your rights

You can request access to, correction of or deletion of your data by writing to hola@passito.app. Customers can also delete their account from the customer portal. If you are enrolled in a business's program, that business decides what data it asks for; we process it on their behalf.

Changes

If this policy changes, we will publish the updated version on this page with its update date.