Privacy notice

Who is responsible

Luuply (NIMUS, S.A. de C.V., located at Calle 18 No. 239 D, between Calle 17 A and Calle 19, Fraccionamiento Residencial del Arco, C.P. 97138, Mérida, Yucatán, Mexico) is responsible for Luuply accounts: those of the businesses that use Studio and those of the customers who sign in at luup.ly/me. It is also responsible for the identity that recognizes the same person across businesses.

Each business is responsible for its customers' data in its program: it decides what to ask for at sign-up and which messages to send. Luuply stores and processes that data on the business's behalf, only to provide the service.

What data we handle

From businesses: name, email, business and public profile details, and their plan. Payments are processed by Stripe; Luuply doesn't store card numbers.

From customers who join a program: name, phone, email if they give one, any extra answers the business asks for, their stamps, points and redemptions, and their Apple Wallet or Google Wallet card if they add it.

From people who visit a profile: which pages they open and what they scan, to give the business metrics. We keep an encrypted fingerprint of the IP address, never the address itself, to stop abuse.

Data we receive from Google

If you sign in to Luuply with Google, Google sends us the basic profile data you authorize: your name, your email and your profile photo. We only ask for Google's basic sign-in permissions (profile and email). We don't access your Gmail, your contacts, your calendar or your Google Drive files.

We store your name and your email with your Luuply account. We don't show or use your Google profile photo in Luuply.

How we use Google data

We use your name and your email to create and protect your account, recognize you when you come back, send you service emails (verification, invitations and plan notices) and address you by name. If you use Luuply AI, your first name is included in the conversation so it can greet you.

Luuply uses Google in two other places: Google Maps, to find your business listing when you build your page (we send what you type in the search), and Google Wallet, for the stamp cards your customers add.

We don't use Google data for advertising, we don't sell it, we don't transfer it to ad platforms, data brokers or information resellers, and we don't use it to train artificial intelligence models. We also don't use Google APIs to create or share non-consensual intimate imagery, with AI or in any other way.

Who we share Google data with

We only share it with the providers that run your account, and only for that: Neon (hosts sign-in and the database), Resend (sends the service emails) and Stripe (if you buy a plan, it receives your email for billing). Beyond them, we only disclose it if the law requires it or to investigate abuse or fraud.

How we protect your data

All connections to Luuply use HTTPS. We keep the access keys to our systems in a secrets manager (Google Secret Manager), never in code, and we limit database access to Luuply's services.

How long we keep it and how to delete it

We keep your account data while you have an account. To delete it along with your Google data, write to hola@luuply.app: we delete it and remove your name, your email and your photo, except what the law requires us to keep, such as payment records.

You can remove Luuply's access to your Google account at any time at myaccount.google.com/permissions. If you do, you can no longer sign in with Google, but your Luuply account stays until we delete it.

One identity across businesses

Luuply keeps one global identity per person that can span businesses. If you join several businesses' programs, you see all your cards and preferences at luup.ly/me with one account.

We only recognize you with strong evidence: your email, verified when you sign in, or a code we text to your phone. Never by your name or look-alike details. A phone number only links your programs with a recent code, because numbers change hands.

A business only sees its own relationship with you. It can't see which other businesses you belong to, or your activity, rewards or preferences there.

Messages from businesses

A business only sends you promotions on the channels you accepted: email, WhatsApp, SMS or notices on your card. Each one is a box that starts unticked and applies to that business only. We keep the date, the space and form where you accepted, and the version of the text you saw.

Card notices about your stamps, a reward that's ready or an expiry are part of the program.

You can unsubscribe anytime: from the message, from the link on the back of your card, at luup.ly/me, or by asking at the business. It applies from the moment it's recorded.

Aggregate data

If Luuply offers comparisons across businesses, it only uses anonymous statistics that pool many businesses. No business sees another's data or its customers.

Who we share data with

We don't sell personal data. We only share it with the providers that run Luuply: Neon (database and gateway to Studio's AI), Google Cloud (servers), Anthropic (Studio's AI models), Cloudflare (website and abuse checks), Resend (email), Twilio (SMS), Stripe (payments), PostHog (measurement), and Apple and Google (Wallet cards).

Your rights

You can ask to access, correct or delete your data, object to its use, or withdraw your consent by writing to hola@luuply.app. If the data belongs to a business's program, you can ask the business or us, and we'll pass it on. We reply within the time limits set by Mexico's personal data protection law.

Changes to this notice

If it changes, we publish the new version here with its date. If a change affects what you agreed to, we'll ask you again, and if it changes how we use Google data, we'll email you first.