01

1. Data controller

The controller for the proprietary processing described in this policy is Alejandro García Martínez, which operates Vuelvy as a commercial brand.

02

2. Scope and applicable law

This policy applies to website visitors, commercial contacts, customers, account users, people who book meetings and, subject to the qualifications below, passholders and contacts managed by Vuelvy customers. Processing is primarily governed by Regulation (EU) 2016/679, Spanish Organic Law 3/2018 and Law 34/2002, together with any applicable sector-specific rules.

03

3. When we are controller and when we are processor

Alejandro García Martínez acts as controller for the website, lead acquisition, contracting, billing, accounts, support, security, fraud prevention, proprietary analytics and Vuelvy communications. Where a customer uses the platform to manage contacts, segment audiences, issue passes or run campaigns, that customer determines the purposes and is normally the controller; Alejandro García Martínez processes the data as processor under the customer's instructions and the data-processing agreement. This policy does not replace the customer's duty to inform its own users.

Data processing agreement: record and formalisation
04

4. Data subjects and sources

Data may come directly from the individual, the organisation they work for, a Vuelvy customer that lawfully imports it, authorised integrations such as Shopify or a CRM, Apple Wallet or Google Wallet when a pass is installed or updated, a Cal.com booking, and consented browsing. We may also use public professional data where a valid legitimate interest supports proportionate B2B outreach, without relying on that basis for unsolicited electronic marketing prohibited by Spanish law.

05

5. Categories of data

We process only the categories required for each purpose and contracted configuration.

  • Identity and contact: name, email, professional phone number and organisation
  • Professional and commercial profile: role, website, sector, need, volume, timing and relationship notes
  • Account and contract: organisation, members, roles, authentication, billing, support and audit
  • Wallet data: internal identifier, pass class and object, status, points, tier, benefits, redemption, change history and preferences
  • Provider configuration: contracted model, issuer and project identifiers, service account, roles, permissions, publishing status and, under BYOC, credentials or tokens required to operate the customer's account
  • Device and delivery: technical registration identifiers, update tokens, Wallet system and observable save, use or removal signals made available by the provider
  • Browsing and measurement: IP address, cookie identifiers, browser, device, URL, referrer, campaign, events, clicks and scrolling
  • Security: access logs, transformed IP where appropriate, user agent, incidents and consent evidence
06

6. Purposes and legal bases

Each processing operation relies on a specific legal basis; consent is not made a condition for functionality that does not require it.

  • Answer enquiries, prepare proposals and enter into services: pre-contractual steps or contract
  • Create accounts, provide the platform, issue, maintain and withdraw passes, integrate systems, support and bill: performance of contract
  • Handle onboarding, review, audits and security or compliance requests from Apple, Google and other providers: contract, legal obligation or legitimate interests, as applicable
  • Meet accounting, tax, consumer, data-protection or valid authority requirements: legal obligation
  • Protect the platform, prevent abuse, retain minimum records and defend claims: legitimate interests
  • Send non-essential news or content: consent or another documented legal permission
  • Enable GA4, Microsoft Clarity and equivalent technologies: analytics consent
  • Enable Google Ads, Meta Pixel, TikTok Pixel, audiences or advertising measurement: advertising and marketing consent
07

7. Forms, diagnosis and commercial relationship

When a form is completed, we process the submitted data, source page, UTM parameters, language, referrer, consent evidence and technical security signals. We use them to reply, qualify the request, prepare the diagnosis and perform related follow-up. Cal.com manages bookings. An enquiry is not subscribed to recurring marketing unless the separate checkbox is selected or another documented legal permission applies.

08

8. Accounts, contracting, support and billing

To provide the SaaS, we process administrator and member data, permissions, account activity, settings, tickets, communications, contracted use and administrative records. Support requests and service incidents can be sent to soporte@vuelvy.com. Once payments are enabled, the payment provider or Shopify Billing will process payment methods depending on the model; Vuelvy does not need to store complete card numbers. Audit records are used for security, traceability and compliance.

09

9. Customer-managed data in Vuelvy

The customer decides which contacts to import, the purpose of its programme, pass content and communications. Vuelvy may process identifiers, contact data, segmentation attributes, loyalty status, points, coupons, redemptions, events, consents and technical tokens needed to update a pass. The customer must have a lawful basis, provide its own notice and honour opt-outs, objections and minimisation. Instructions, term, safeguards, assistance, return, deletion and subprocessors are detailed in the data-processing agreement.

10

10. Google Analytics 4 and Microsoft Clarity

With analytics consent, we may use Google Analytics 4 to measure users, sessions, campaigns, journeys and conversions, and Microsoft Clarity to understand experience through behavioural metrics, heatmaps and session replay. GA4 may process client identifiers, device, browser, events and approximate geolocation; Google states that it discards European users' IP addresses before logging them. Clarity records visible page structure and interactions such as clicks, movements and scrolling; form fields remain masked and we do not deliberately configure capture of passwords or entered content. Consent can be refused or withdrawn through Cookie settings.

  • GA4: aggregate measurement, attribution and improvement; configured retention up to 14 months
  • Clarity: ordinary replays up to 30 days; aggregate data, heatmaps and selected sessions up to 9 months
  • Names, emails and phone numbers are not sent as ordinary analytics parameters
  • Microsoft and Alejandro García Martínez act as independent controllers for Clarity under the provider's terms
11

11. Google Ads, Meta Pixel and TikTok Pixel

Only with advertising consent may we activate conversion, remarketing or audience tags from Google Ads, Meta Pixel and TikTok Pixel. These technologies may receive the URL and referrer, event and time, campaign or advert, IP, user agent, cookie or device identifiers and conversions such as a confirmed enquiry. We do not send free-text form content, passwords or special-category data. Advanced matching or audience uploads using email or phone are enabled only where expressly configured, disclosed and supported by a sufficient lawful basis.

  • Google uses Consent Mode signals to respect accepted categories
  • Meta may act as joint controller for collection and transmission through its tools and as controller for subsequent processing
  • TikTok may act as joint controller, independent controller or processor depending on the configured feature and regional terms
  • Rejecting marketing prevents Vuelvy from loading these advertising pixels in the browser
12

12. Communications and Klaviyo

Klaviyo is used to synchronise commercial profiles, record relationship events and send communications. A lead may generate an operational profile to handle the request, but marketing subscription is requested only where separate consent or another applicable legal permission exists. Every commercial message provides an unsubscribe method. Withdrawal does not affect transactional messages required for an enquiry, account or contract.

13

13. Service subprocessors

We use providers bound by contract, confidentiality, instructions and security measures to operate Vuelvy. Access is restricted to the required function. Some integrations depend on the contracted service model. Vuelvy directly operates object and brand-asset storage using Versity on its Mac mini in Spain (European Union); S3 compatibility does not mean storage in Amazon Web Services. This location does not extend to every external provider, whose transfers are explained in Section 17.

  • Vercel Inc.: Next.js website and application hosting, delivery network, functions and technical logs. Production functions are configured in the United States (iad1); delivery and other processing may be global
  • OVHcloud (OVH Hispano S.L.): PostgreSQL database server and its backups in Milan, Italy (European Union)
  • Cloudflare Inc.: DNS, network, security, abuse mitigation and Turnstile
  • Resend (Plus Five Five, Inc., United States): account invitations, recovery, security alerts, transactional email and enabled campaigns. Its metadata, logs and account/API records are stored in the United States; choosing a European sending region does not change that residence
  • Klaviyo Inc.: CRM, profiles, events, lists and consented communications
  • Cal.com Inc.: meeting booking and management
  • Google Cloud and Google Wallet: infrastructure and Google pass integration when enabled
  • Apple and APNs: distribution and updates for Apple Wallet passes
  • Shopify: app, API, webhooks and billing for customers that connect a store
14

14. Measurement providers and other recipients

Google Ireland Limited and Google entities, Meta Platforms Ireland Limited, TikTok Technology Limited and its regional entities, and Microsoft Ireland Operations Limited or Microsoft Corporation may receive data when their technologies are enabled. Depending on the product and terms, they may act as processors, joint controllers or independent controllers. We may also disclose data to advisers under confidentiality, auditors, insurers, buyers in a corporate transaction and authorities where a valid duty or request applies.

15

15. Apple Wallet, Google Wallet and integrations

When a pass is saved, Apple or Google processes information under its own policy and the individual's account settings. A pass may contain visible information, an identifier and venue coordinates; the device may provide Vuelvy with technical identifiers and tokens needed to install, manage or update it. For proximity activations, Apple or Google evaluates the device location and decides pass relevance or a nearby alert under its permissions and rules. Configuring venues does not by itself let Vuelvy receive a precise location or continuous location history for the holder. Apple and Google operate their platforms as independent controllers. Shopify, CRM and other integrations are enabled on the customer's instruction and may exchange the minimum data defined by that configuration.

16

16. Google Wallet under the aggregator or BYOC model

The applicable model is identified in the Vuelvy contract and does not alter the roles imposed by law: the business customer is normally the controller for its passholder data and communications; Alejandro García Martínez acts as processor when operating the programme under the customer's instructions and as controller for records strictly required for security, billing, legal claims and its own compliance; Google processes account, device and platform data under its own terms and privacy policy.

  • Aggregator: where Google authorises Vuelvy to do so, Alejandro García Martínez uses Vuelvy-managed infrastructure and credentials to create or administer issuers, classes and objects for multiple customers, submit the required content and data to Google, and receive lifecycle signals made available by the API
  • BYOC: the customer controls its Google issuer account, project and credentials; Vuelvy accesses them with minimum permissions to carry out instructions, keeps access traceability, and protects, rotates or deletes secrets under the contract and data-processing agreement
  • Google may receive issuer, class and object identifiers, brand features and visual assets, visible pass fields, links, configured locations, issuance or update data, and signals required to save, use or remove the pass
  • Providing this service does not give Vuelvy access to the general contents of a holder's Google Wallet account or their payment methods. Vuelvy processes only data included in the programme or returned by authorised APIs, and does not sell Wallet data or use it for third-party advertising
  • Changing model or issuer requires documented authorisation. Migration, export, permission revocation and data deletion or retention will be performed under the contract, the data-processing agreement, Google's capabilities and legal duties
17

17. International transfers

Some providers or their subprocessors process data outside the European Economic Area. Before enabling them, we use the mechanism appropriate to the case: an adequacy decision, the EU–US Data Privacy Framework where the entity is certified, Standard Contractual Clauses approved by the European Commission and, where required, a transfer assessment and supplementary measures. For Vercel, Resend and Cloudflare, we document the Standard Contractual Clauses incorporated in their data-processing agreements, with required assessments and supplementary measures; these services are not described as having exclusive EU residence. You can consult the Vercel (https://vercel.com/legal/dpa), Resend (https://resend.com/legal/dpa) and Cloudflare (https://www.cloudflare.com/cloudflare-customer-dpa/) agreements, or request information about applicable safeguards from privacy@vuelvy.com.

18

18. Retention and deletion

We retain data only for as long as required for each purpose and to address liabilities.

  • Inactive enquiries and opportunities: normally 12 months after the last interaction
  • Marketing: until unsubscribe; consent and objection evidence is retained for applicable limitation periods
  • Minimum contractual, tax and accounting evidence: during the relationship and applicable statutory periods; generally four years for tax duties from each statutory starting point and six years for commercial records from the last accounting entry. Evidenced interruptions or special periods apply only to the necessary evidence
  • Account and service data: during the contract. Comprehensive closure is handled manually under verified instructions, with ordinary primary return or deletion within thirty days of effective termination or a valid instruction; statutory rights-request deadlines still apply
  • Customer and passholder data: under the customer's instructions, retention settings and DPA; use of the service does not mean keeping the entire dataset for four to six years. Essential legal evidence is separated with restricted access and its own expiry
  • BYOC credentials and access: while required to provide the service; on termination they are revoked, returned or deleted under the contract, except for minimum audit records or legally required retention
  • Security and support logs: the minimum period required by risk, normally 30 to 180 days unless an incident occurs
  • Own backups: rotation with maximum ages of fourteen days for daily, forty-two for weekly and sixty for monthly copies. In ordinary closure, affected copies are deleted no later than ninety days after effective termination or a valid instruction. They are not used for ordinary activity and deletions are reapplied before a restoration resumes. Noncurrent object versions expire through a dedicated job; current passes and assets do not expire because of their age
19

19. Segmentation and automated decisions

We may calculate a lead score to prioritise attention and create segments for campaigns or analytics. Advertising providers may build audiences or attribute conversions where consent exists. Vuelvy does not make solely automated decisions producing legal or similarly significant effects on visitors or leads. If a customer configures profiling for its contacts, it must assess it, inform individuals and provide the required safeguards.

20

20. Individual rights

You may request access, correction, deletion, objection, restriction and portability, withdraw consent at any time and avoid automated decisions where the law provides. Email privacy@vuelvy.com, identifying the right and enough information to locate the data. We may request proportionate identity verification. Where Vuelvy processes data for a customer, we will forward or coordinate the request with that controller. You may also complain to the Spanish Data Protection Agency at aepd.es.

21

21. Security and incidents

We apply risk-appropriate measures including TLS, role-based access, environment separation, encrypted secrets, traceability, input validation, abuse controls, backups, vulnerability management and log minimisation. No system is infallible. Vulnerabilities or incidents can be reported confidentially to seguridad@vuelvy.com without including credentials or unnecessary personal data. Following a personal-data breach, we assess the risk, document the response and notify customers, authorities or affected individuals where required by law or contract.

22

22. Children, sensitive data and changes

Vuelvy is a business service and is not directed at children under 14. Special-category data, financial credentials, identity documents or children's data must not be added to passes, forms or free-text fields without Vuelvy's prior written approval, a specific assessment, appropriate safeguards and, for private passes or sensitive information in Google Wallet, Google's express permission where required. We will update this policy when processing, providers or legal requirements change and will communicate material changes where required. The Spanish version governs where legally permitted.

23

23. Sign in with Google

Where available, you can create your account, sign in or link your Google Account to a Vuelvy account using Sign in with Google. It is optional: you can also use email and password. We use Google solely to authenticate you and protect your account. We request only the openid, email and profile permissions; we do not request access to Gmail, Google Drive, Google Calendar, Contacts or any other data in your Google Account, nor any sensitive or restricted permissions. Choosing Google does not give consent to marketing communications and does not merge identities automatically: we accept only Google-verified emails, and an existing Vuelvy account is linked only when you request it while signed in.

  • Data we receive from Google: your Google Account's stable identifier, your verified email, your name and, if present, the address of your profile image. They are stored in your Vuelvy user record and in the record of the Google connection
  • Tokens: when sign-in completes, Google issues OAuth tokens. Access tokens and, should Google issue one, refresh tokens are stored encrypted in our database. The Google-signed identity token, which repeats that basic data, is stored with the connection protected by the database's access and security controls, without additional encryption of its own. We request access only while you sign in and do not use these tokens to query other Google services
  • Purpose and legal basis: creating and maintaining your account, signing in, linking this sign-in method, preventing unauthorised access and handling security incidents, based on the contract or pre-contractual steps and our legitimate interest in security. Staff access this data only for support you request, security, abuse investigation or legal compliance
  • Providers: Vercel runs the application and the authentication process; OVHcloud hosts the PostgreSQL database and its backups; Cloudflare provides network and security services; Resend sends transactional account emails such as access recovery and security notices. They act as processors with access limited to their function. Google processes your sign-in as an independent controller under its privacy policy: https://policies.google.com/privacy
  • Excluded uses: we do not sell data received from Google or use or share it for advertising, remarketing, building or enriching audiences, commercial profiling or training artificial-intelligence or machine-learning models. Sections 10, 11, 12 and 19 on analytics, pixels, communications and segmentation do not apply to this data and do not override this exclusion
  • Vuelvy's use of information received from Google APIs, and any transfer of it to another app, follows the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements where applicable. We share this data only with the providers listed above, where required by law or with your consent
  • Retention and disconnection: we keep the connection while you maintain your account and afterwards only the minimum needed for security, legal obligations or defending claims. You can remove Vuelvy's access at https://myaccount.google.com/connections: the grant to Vuelvy is revoked and you can authorise it again when signing in. This does not close existing Vuelvy sessions, delete its records or close your account. To request deletion, email privacy@vuelvy.com; we may verify your identity proportionately and retain what the law requires. Deleting your user also removes the connection and its tokens, which then remain only in backups until rotation
  • New uses: if we wanted to use this data for another purpose or request additional Google permissions, we will inform you first and ask for your consent where required. A notice that this policy has been updated does not replace that consent