Privacy policy

1. Who are we?

Fidélité (the “Service”) is a loyalty programme service published by Save Time and available at https://fidelite.savetime.es. The controller of the data described here is: Mickael Heitor Cardoso Do Patrocinio, autónomo (“Save Time”), NIF Z3326380X, Conjunto Los Opalos, 13, 29720 Rincón de la Victoria (Málaga), España. Contact: mickael@savetime.es.

The Service is aimed at three groups: customers of the shops who hold a loyalty card, merchants who use the tool and, for merchants who wish to do so, the social media accounts they connect to it.

2. Customers of the shops (loyalty card)

Data collected:

• your first name and a means of contact (email address or phone number), as well as your language;
• the history of your programme: visits, stamps or points credited, rewards earned and used, and the purchase amount when the shop credits according to the amount;
• the technical identifier of your card in your phone's wallet (Apple Wallet or Google Wallet);
• whether or not you have agreed to receive the shop's offers, and the date;
• your participation, if any, in prize draws organised by the shop.

If you choose “Continue with Google” on the sign-up form, Google sends us only your first name and your email address, to pre-fill the form. They are stored only if you confirm the sign-up; no token and no access to your Google account is kept.

Purposes: to manage your loyalty card, credit you and give you your rewards, send you the notifications related to your card and, if you have agreed to them, the shop's offers. If you sign up with an email address, we send you a single email at sign-up containing the link to your card, so that you can add it to your wallet or view it later.

Transfer of a previous loyalty card: when a shop that used another loyalty programme moves to the Service, it may entrust us with its customer list (first name, email address or phone number, points or stamps balance and, where applicable, language and date of birth) so that you keep your balance. The shop certifies that it has obtained your agreement to be contacted. If your record includes an email address, we send you an invitation email containing the link to your card, followed by at most one reminder 7 days later if you have not yet added it to your wallet. No other email is sent to you on this basis, and you may ask for your card to be deleted at any time.

Legal basis: your consent, collected at sign-up or, where a previous card is transferred, by the shop, and the performance of the programme you have joined. You may withdraw your agreement to receive offers at any time.

Retention period: for as long as you take part in the programme. A card that has been inactive for more than 6 months is deleted automatically, after 15 days' notice. The history of rewards given is kept as an accounting record of the shop; your first name and contact details are erased from it when your card is deleted.

Recipients: the shop that runs the programme, and Save Time for the technical operation of the Service.

3. Merchants

Data collected: the email address of the account, information about the shop (name, logo, colours, programme settings), the display preferences of the merchant area and, for paid subscriptions, the billing information processed by our payment provider (we never store bank card numbers).

Purposes: to provide the Service, the management area, the statistics and the monthly report sent by email, and to handle billing and support.

Legal basis: the performance of the contract between the merchant and Save Time, and our legal obligations regarding invoicing.

Retention period: for the whole life of the account, then, for billing data, for the time required by accounting and tax obligations.

Support assistant: the questions put to the assistant in the merchant area and its answers are kept for 30 days, to limit daily use and improve the help offered, and are then deleted automatically. The answers are generated by an artificial intelligence (Anthropic); do not enter your customers' personal data in the assistant.

Support requests: requests sent from the Support tab of the merchant area and the exchanges that follow are kept for as long as they are being handled, then for one year after they are resolved, before being deleted automatically.

4. Social media accounts connected by a merchant

A merchant may connect the professional accounts of their business to the Service: Facebook page, Instagram professional account, Google Business Profile listing, as well as their personal LinkedIn profile or their company's LinkedIn page. The connection is made only on the merchant's own initiative, from their merchant area, through each platform's official authorisation window. We never receive their password.

Data received from the platforms, and only for the accounts the merchant has chosen to connect:

• the identifier and name of the page, account or listing;
• the access tokens issued by the platform;
• aggregated audience statistics: followers, reach, impressions, interactions, listing views, calls, direction requests, website clicks;
• the account's posts and their statistics;
• for LinkedIn: the identifier and name of the profile or company page, an access token valid for 60 days (encrypted) and the posts sent from the Service; for a company page, its aggregated daily statistics (followers, impressions, interactions); LinkedIn does not provide statistics for a personal profile, so none are collected;
• for Google Business Profile: the average rating and number of reviews of the listing, the most recent public reviews (author's name and photo as published on Google, text, rating and date) and the merchant's replies, as well as the Google search keywords that displayed the listing each month and the number of times it was displayed.

Use: this data is used exclusively to show the merchant the statistics of their own accounts in their merchant area and in their monthly report, and to carry out the actions they themselves request (for example, publishing content or replying to a review on their behalf). It is not sold, rented, used for advertising purposes, shared with third parties other than the technical providers listed in section 5, or used to train artificial intelligence models.

The use of information received from Google APIs, and its transfer to any other app, adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Security: access tokens are encrypted in our database and are never displayed.

Retention period: tokens are deleted as soon as the merchant disconnects a network or withdraws the authorisation from the platform. The history of statistics, reviews, replies and keywords is kept for as long as the merchant's account exists, solely to be shown to them in their merchant area, and is deleted within 30 days on request (see our data deletion page) or when the account is closed.

The merchant may withdraw their authorisation at any time, from their merchant area or from the settings of the platform concerned. The procedure is detailed on our data deletion page.

5. Technical providers

To run the Service, we use the following processors, which act only on our instructions:

• Supabase: database and authentication;
• Vercel: hosting of the website and the application;
• Resend: sending of emails;
• Stripe: payment of merchants' subscriptions;
• PassCreator and Google Wallet: issuing and updating the cards in the phone's wallet;
• Anthropic: generation of the answers of the support assistant in the merchant area (without using the exchanges to train its models).

Some of these providers may process data outside the European Union. Such transfers are then governed by the European Commission's standard contractual clauses or by a recognised equivalent framework.

Requests from public authorities: any request for access to data from an authority is reviewed for its lawfulness before any response, challenged if it appears unlawful, limited to the data strictly necessary and documented (request received, response given and justification).

6. Cookies

The website uses neither advertising cookies nor audience measurement tools. Only technical storage, essential for signing in to the merchant area and for a few display preferences, is used in your browser.

7. Your rights

You have the right to access, rectify, erase, restrict and object to the processing of your data, the right to data portability, and the right to withdraw your consent at any time. To exercise these rights, write to mickael@savetime.es. We reply within one month.

If you believe your rights are not being respected, you may lodge a complaint with the data protection authority: the Agencia Española de Protección de Datos (aepd.es) in Spain, or the CNIL (cnil.fr) in France.

8. Changes

This policy may change, in particular when new features are added. The date of the last update appears at the top of this page.