Privacy policy

Last updated: November 11, 2026 · Version for Costa Rica

This policy explains what personal data Repitoo processes, what for, who it shares it with, how long it keeps it and how to exercise your rights. It is written under Costa Rica's Law for the Protection of Individuals with regard to the Processing of their Personal Data (Law No. 8968) and its regulations (Executive Decree No. 37554-JP), and fulfils the duty to inform before asking for consent set by article 5 of that law.

1. Who we are and who this applies to

Repitoo is a loyalty card platform for businesses, the trade name of Raul Armando Gonzalez Urbina, an individual with Costa Rican identity card 801540401, domiciled in Costa Rica. You can write to support@repitoo.com. This policy applies to three groups of people, and our role is different for each:

Owners and teams of the businesses that use the Repitoo panel. For their data, Repitoo is the controller.
Customers of those businesses, who carry a card on their phone or on the web. For their data, the controller is the business that gave them the card, whose name appears on it and on the page where they joined, and Repitoo acts as processor: it processes the data on behalf of the business and only to provide the service. For the "My cards" account and invoice details, which work across every business, the controller is Repitoo.
People who visit our pages, request an invitation, write to us or see a demo. For their data, Repitoo is the controller.

If you are a customer of a business, the business decides what data it asks for and why; this policy explains how we look after it at Repitoo.

2. What data we process

About owners and their teams:

Name, email, language and app preferences (theme and color), and the password if they set one (stored encrypted) or Google sign-in.
The business: name, business type, location of its premises, opening hours, currency, logos and card designs.
Each person's role in each business and the invitations sent.
Subscription data: plan, dates, amounts and status of charges. The card number is received by the payment provider, not Repitoo.
Technical security data: sessions, IP address and logs of access and changes, to limit attempts and prevent abuse.

About each business's customers, whatever that business decides to ask for or load:

Name and, if given, email and phone number with its country.
Day and month of birth, without the year.
Other data the business adds, such as address, notes or custom fields.
Card activity: stamps, rewards, coupons, gifts, balances and movements of gift or cashback cards, amounts and invoice numbers of the purchases the business records, messages received and visit dates.
If they said yes to the business's news: when and how they said it, whether they unsubscribed and, for each marketing email, whether it arrived, whether they opened it and whether they tapped a link.
If Apple Wallet is used, a device identifier to notify them when the card changes; if Google Wallet is used, whether the card is saved.
If they tap a button on a business's link page with their email already confirmed on that phone, which button they tapped.
If they pass stamps or give a gift card, the email of the person who receives it.
If they create a "My cards" account: email and password (stored encrypted) or Google sign-in.
If they save their details for electronic invoices: name or company name, type and number of identification (individual or corporate ID, DIMEX or NITE), email and the other details the tax authority requires.

About people who visit our pages or contact us:

What they write in the contact, invitation or founding partner forms: name, email, phone or WhatsApp, business and message.
The visit measurements explained in section 12, without cookies.
If a Repitoo salesperson prepared a demo for them: what they do in it (opening it, joining, adding the card to their wallet), without IP or cookies.

What we do not process: we do not receive customers' location (the phone works out on its own whether it is near the premises), we do not use third-party analytics or advertising tools, we do not ask for sensitive data and we do not sell personal data.

3. What we use it for

To provide the service: create and update cards, add stamps, deliver rewards and coupons, record balances and show the panel. This is why the data is requested, and it rests on your consent when joining and on the contract with the business.
To send service emails: the sign-in link, the customer's card, invitations, receipts and notices about charges or account changes.
To send to cards the program's notices and the messages the business schedules, with a cap per card and only during its opening hours.
To send marketing emails, only to people who said yes (section 5).
To charge the subscription, issue receipts and keep the accounts.
To provide support, handle invitation requests and contact messages, and follow up commercially with businesses that asked to learn about Repitoo.
To improve Repitoo with internal metrics on platform usage.
To protect the platform: prevent fraud, unauthorized access and abuse.
To comply with legal obligations.

We do not use a business's customers' data for our own commercial purposes, nor do we combine it with another business's data. The only exception is the customer's own choice: their "My cards" account and invoice details work at every business where they have a card.

We process data with the informed, express and written (including electronic) consent of its owner, or when the law allows it without consent, for example to comply with a legal obligation. When a customer joins a program, the page tells them which business is the controller and what it will use their data for before they send it, and the customer accepts this policy with a checkbox.

The data the form marks as required is required because the card cannot be issued without it (for example, the name and a way to find the card). If it is not given, the card cannot be issued; nothing else about the service changes.
The data the form does not mark is optional, and refusing it has no consequence.
Receiving news by email is always optional and is asked separately, with an unticked box.

The business is responsible for having the consent of the customers it loads itself, for example when importing a file. Anyone who passes stamps or gives a gift card states that the other person agrees to our using their email to deliver them.

Consent can be withdrawn at any time, without retroactive effect.

5. Marketing emails and card messages

We keep the emails people need (signing in, charges, notices about their card) separate from marketing emails, which come from another address and always include a one-click unsubscribe link.

A business can only send marketing emails to people who said yes to its news: with the box when joining, which comes unticked, with the "News by email" switch on their card or by accepting an invitation from the business. That yes applies only to that business and that address, and we record when it was given. Joining a program never requires receiving advertising.
Repitoo sends owners and their teams service notices and, with an unsubscribe link, Repitoo news.
To know whether a marketing email arrived, was opened or had a link tapped, the email carries an image and tracking links from the delivery provider. The business that sent it sees those results. Service emails carry no tracking.
The messages a business puts on the card appear in the phone's wallet, with a cap per card. To stop seeing them, switch off the card's notifications on the phone or remove the card.

This is how we meet the prior consent for commercial communications required by article 44 of the General Telecommunications Law (Law No. 8642). Anyone who unsubscribes stops receiving them immediately.

6. Artificial intelligence

Some features use an artificial intelligence model (currently Claude, by Anthropic) to suggest texts, designs and how to read an imported file. When reading a file, the model receives only the column headers and the shape of the values (for example, "8 digits"), never customers' data. In the other assistants, it receives what the owner writes about their business. Under the provider's commercial terms, that data is not used to train its models.

Assistants you connect. From Settings → Your AI, an owner or team member can connect to Repitoo an assistant from another company, such as Claude (by Anthropic) or ChatGPT (by OpenAI), which they use with their own account. The connection only exists if that person signs in with their Repitoo account and allows it on a screen of ours that tells them what it will be able to see and do. From then on, the assistant can look up the same things that person sees in the panel according to their role in each business (businesses, programs, customers, insights and settings; in searches, customers' email and phone are hidden) and, when the person confirms it in the conversation, make the changes their role allows. What the assistant receives is subject to the terms and privacy policy of its provider, which the person chose; Repitoo does not send data to any assistant nobody connected. For each connection we keep the assistant's name, when it was connected and last used, and its access keys as a cryptographic digest, not in clear text. We do not keep conversations with the assistant. The person removes the connection whenever they want in Your AI and access ends instantly; if it is not used for 90 days, it expires on its own.

Only with those we need to provide the service, and each receives the minimum necessary:

The business that owns the program, which sees the data of its own customers. If a customer saved their invoice details, the cashier of each business where they have a card sees them when scanning it, to issue the invoice. The business's owner and Administrators can download the list of its customers as Excel or CSV; from then on the business answers for that copy and may not sell it or hand it over to third parties (section 17 of the Terms).
Providers that work on our behalf as processors and may only use the data to provide their service to us: Fly.io (hosting and database), Cloudflare (file storage and network), Resend (email delivery), Stripe and ONVO (payments), Anthropic (artificial intelligence), Sentry and Better Stack (error logging and monitoring, which may include technical data from a request) and HubSpot (commercial follow-up of businesses that asked to learn about Repitoo; it never receives a business's customers' data).
The artificial intelligence assistant that an owner or team member connects themselves, only with what that person can see (section 6).
Apple and Google, to issue and update the passes in their wallets and, if the person chooses, for Google sign-in.
Authorities, when a law or a court order requires it.
A buyer or successor of Repitoo, if the company is sold or merged, with the same protections as this policy and notifying the data owners beforehand.

The maps of the premises in the panel are requested from OpenStreetMap by our servers, without data about who views them. The approximate country and city of a visit come from a database we keep on our own server; the IP is not sent to anyone.

8. International transfers

Several of those providers store or process data outside Costa Rica, mainly in the United States. We only work with providers that contractually offer adequate security and confidentiality guarantees, and we require them to process the data only to provide their service to us. By accepting this policy, you consent to your data being stored and processed in those countries for that purpose, as required by article 14 of Law No. 8968.

9. How we protect data

Every connection is encrypted (HTTPS) and passwords are stored encrypted.
Each business's data is kept separate: a business never sees another's customers.
API keys, download links and PINs are stored as a cryptographic digest, not in clear text.
Uploaded files are stored in private storage and images are processed before they are shown.
Our team members with administrative access sign in with a second authentication factor, and every action they take in an account is logged.
Only the people on our team who need it for their work access the data, with a duty of confidentiality that continues after their relationship with Repitoo ends.

No system is completely secure. If a breach affecting personal data occurs, we will inform those affected and the Agency for the Protection of Inhabitants' Data (PRODHAB) within the following 5 business days, with what happened, the data affected and the measures taken, as the law's regulations require. If the data belongs to a business's customers, we will tell the business so it can inform together with us.

10. How long we keep it

We keep data only while it serves the purpose it was given for:

The data of the business's account and its customers, while the account is active. If the business closes its account, we delete or anonymize it within the following 90 days, except balances of gift or cashback cards that can still be claimed.
The data of a "My cards" account and its invoice details, until the person deletes it.
Imported files are deleted as soon as the import finishes; customer downloads, after 7 days.
Visit measurements use a digest that changes every day; invitation requests and contact messages are kept while there is follow-up.
Accounting records of charges, for the period required by tax law; technical security logs, for as long as their purpose requires.

In no case do we keep data that may affect its owner for more than 10 years after its purpose ended, as article 6 of Law No. 8968 provides, unless a special law requires otherwise.

11. Your rights

Everyone has the right to know what data about them we process and to request access, rectification, updating or deletion, to withdraw their consent and to object to receiving commercial messages. Exercising them is free.

If you are a customer of a business, you can ask the business directly or write to us; we will pass the request on to the business and help it handle it. You can unsubscribe from news with the link in each email or on your card, remove the pass from your wallet or delete your "My cards" account at any time.
If you are an owner or team member, you can change your data in the panel or write to us.

To exercise them, write to support@repitoo.com with the subject "My data", saying what you are asking for and, if you are a customer, the business and the email or card. We reply within the 5 business days set by article 7 of Law No. 8968. We may ask you to confirm your identity before handing over or changing data. If you believe we did not handle your request properly, you can file a complaint with PRODHAB (www.prodhab.go.cr).

12. Cookies and visit measurement

We only use the cookies needed for Repitoo to work, never advertising or third-party analytics cookies:

Session cookies, to keep the panel or "My cards" session open.
Preference cookies, to remember the language, light or dark theme, brand color and screen settings, such as the step of the buttons when adding stamps.
Device cookies, so the phone remembers who already joined on it, to recognize a counter phone or tablet the business paired, and so visits by the Repitoo team are not counted.

If your browser blocks them, you will not be able to sign in, but the cards in your wallet will keep working.

To learn how people find us, we measure visits to our public pages (the home page, features, sign-in, invitation request, contact and these texts) with our own tool, without cookies and without third parties: the approximate country and city based on the IP, which we do not store; the site or campaign you came from; the type of device; how far you scrolled down the page and where you tapped. If you then request an invitation or open an account, we keep only the campaign that brought you. To count a person only once a day, we use a digest of their connection and browser that changes every day and does not allow them to be identified. If your browser asks not to be tracked (Global Privacy Control or Do Not Track), we measure nothing. We do not use these measurements in the panel, on cards or in "My cards".

13. Minors

Repitoo is a service for businesses and is not aimed at minors. A minor needs the authorization of their mother, father or legal guardian to get a card, and a business that offers its program to minors must have that consent. If we discover data of a minor processed without it, we will delete it.

14. Changes to this policy

If we change this policy, we will publish the new version with its date. If the change is significant, we will notify owners by email in advance. If we want to use data for a new purpose that requires consent, we will ask for it first.

15. Contact

For any privacy question or to exercise your rights, write to support@repitoo.com (also our address for receiving notices), stating the business and the card or the account email.