Privacy Notice

For a business's account data (name, email, billing, platform usage), Bond acts as the data controller. For the data a business collects from its own customers through its loyalty program (name, phone number, visit and reward history), Bond acts as a data processor: we process that data following the business's instructions and only to provide it the Service. The business is the one responsible for informing its customers and obtaining their consent as required by applicable law.

When you use Bond, we automatically collect certain information from your device, such as your browser, approximate IP address, and time zone, through functional cookies that keep your session active and analytics cookies that help us understand how the platform is used.

If you own a business, we also collect the data you give us when you sign up, such as your name, email, phone number, your business's logo and brand elements, and your billing details, which are processed by our payment provider. If you're a customer of a business that uses Bond, we collect the name, phone number, and visit and reward history that business logs about you, and, only if you expressly authorize it, your approximate location to receive proximity alerts near the store.

We only process the data necessary to operate Bond and each business's loyalty service. Your device information helps us identify potential abuse, diagnose errors, and measure the platform's performance and usage; where possible, we analyze it in aggregated or de-identified form.

Your loyalty card data (visits earned, rewards redeemed, and, if you authorized it, your approximate location) is used to give you the loyalty service of the business you have a relationship with, to send you the notifications that business sets up, to provide support, keep the Service secure, and generate aggregated analytics that help us improve Bond. Inactivity notifications are based only on the date of your last logged visit, never on your location, and proximity notifications only work while that authorization stays active; you can turn them off anytime from your device settings or by removing the card from your Wallet.

We also collect and analyze information about overall platform usage (browsing events, feature interactions, errors, performance, digital card activity, and Apple Wallet or Google Wallet installs) to operate, protect, diagnose, and improve Bond, and to build new features.

Businesses that use Bond keep their rights to the information about their business and loyalty program; by using the platform, they authorize us to host, process, and analyze that information as needed to provide them the Service, give them support, keep it secure, prevent abuse or fraud, and improve Bond.

We don't sell personal data. To operate and improve Bond, we work with outside providers that may receive part of your information: Google Firebase handles the platform's authentication and data storage; PostHog receives product usage events, such as page views and interactions, for statistical analysis and error detection; our payment provider processes businesses' subscriptions; and Apple and Google receive the information needed to issue cards in Apple Wallet and Google Wallet. Each of these services operates under its own privacy policy.

We may also disclose information when required or permitted by law, such as to respond to a competent authority, or when we believe in good faith it's necessary to protect our rights, your safety or that of others, or to investigate fraud.

Bond operates out of Mexico and serves businesses across Latin America. Some of the providers listed above process data on servers outside your country, including the United States; in every case we require them to apply adequate security measures to protect your information.

We keep the information you give us on servers within a controlled environment protected against unauthorized access, use, or disclosure, and we maintain reasonable administrative, technical, and physical safeguards to protect it. Even so, no system is completely secure and we can't guarantee the security of data transmitted over the internet or wireless networks; if we detect an incident that compromises your data, we'll notify you as required by applicable law.

We keep data for as long as the business's account is active and, after it's canceled, for as long as needed to meet legal or tax obligations or to resolve disputes. If you're a business's customer, you can ask that business to delete your data directly, or write to us so we can forward the request.

Under Mexico's Federal Law on Protection of Personal Data Held by Private Parties, you have the right to know what data we hold about you, to ask us to correct data that's outdated or inaccurate, to request that we delete it, and to object to it being used for specific purposes.

If you own a business, you can exercise these rights from the admin dashboard or by writing to us. If you're a business's customer, you can exercise them directly with that business or by writing to contact@bond-cards.com, stating your name, the right you want to exercise, and the details we need to identify your account; when we're acting as a data processor, we'll forward your request to the relevant business. If you live outside Mexico, we also honor any data protection rights your country grants you on a non-waivable basis.

The Service isn't intended for anyone under 18 as the holder of a business account. We don't knowingly collect data from customers we know to be minors without the consent of a parent or guardian.

Bond may contain links to other websites that we don't own or control, and we're not responsible for their privacy practices. We recommend reading the privacy notice of any site you visit outside of Bond.

We may update this Privacy Notice from time to time. We'll post the current version on this page along with its last-updated date, and if the change is significant, we'll notify you by email or within the admin dashboard.

For any question or request related to your personal data, write to us at contact@bond-cards.com.