Privacy Policy

1. Controller and contact

Controller: NODO PLUS S.A.S., Tax ID 901379054, Calle 5 # 4 - 11, Tibasosa, Boyacá, Colombia. Privacy contact: support@vuelvoloyalty.com.

2. Scope

• Organization users (Staff/Admin) who create an account or use the dashboard.
• End customers registered by an Organization in programs, payments, or benefits.
• Visitors to public pages, forms, and support channels.
• Users who voluntarily connect a Google, Gmail, Microsoft, or other provider account.
• Authorized users who link an Android device to capture bank alerts from SMS or notifications.

3. Processing roles

For customer data managed by an Organization, the Organization generally acts as Controller and Vuelvo as Processor under its documented instructions.

Vuelvo may act as Controller for dashboard accounts, security, billing, support, fraud prevention, and legal compliance.

4. Data we process

• Identity and contact information: name, email, phone, country, and Organization details.
• Account and access data: UID, identity provider, roles, permissions, and security records.
• Program and customer data: memberships, stamps, gift cards, rewards, redemptions, consent, and activity.
• Payment data: amount, currency, reference, status, date, masked receiving account, and reconciliation evidence. Vuelvo does not seek to store full card numbers.
• Mobile bank alerts: sender and text of matching bank SMS; title and text of notifications from authorized bank apps; publication and capture times; bank, app package, certificate fingerprint, and opaque message, request, and device identifiers.
• Technical data: IP, browser, device, security logs, essential cookies, and preferences.
• Support data: communications, files, and evidence a user chooses to submit.

5. Google and Gmail integration

An Organization may voluntarily connect a Gmail mailbox dedicated to bank notifications. Vuelvo requests only https://www.googleapis.com/auth/gmail.readonly and cannot send, modify, or delete email.

The backend queries recent messages from configured bank senders, validates authenticity signals, and processes headers and message bodies to identify received-payment notifications. It may process sender, recipient, subject, date, message identifier, SPF/DKIM/DMARC results, a text preview of up to 1,500 characters, and extracted payment amount, reference, payer, and transaction date.

The refresh token is encrypted and stored separately from public connection metadata. Access is limited to authorized Organization personnel and backend processes needed for reconciliation.

6. Android SMS and bank-notification capture

When an authorized user activates the Android Collector, Vuelvo separately requests permission to receive and read SMS and access to notifications. These features can operate in the background while the app is not open. For SMS, the app locally examines the sender, text, and date of new messages and, only when the user chooses to recover alerts, up to 100 recent SMS from the previous 72 hours. For notifications, it first verifies that the bank app package and certificate are authorized and only then reads the title and text.

Only alerts matching the linked bank and an incoming payment are transmitted over HTTPS to Vuelvo’s backend. For SMS, the app transmits the bank, sender, text of up to 2,000 characters, publication and capture times, and an opaque message identifier. For notifications, it transmits the bank app package and certificate fingerprint, title of up to 240 characters, text of up to 2,000 characters, times, and an opaque identifier. It also transmits the configuration version, device and request identifiers, signature, and integrity data needed to authenticate the source; the Play Integrity token is verified and not retained.

The backend uses this data to detect incoming funds; extract amount, currency, reference, date and time, originating bank, and payer name when present; bind the movement to the receiving account and location; prevent duplicates; reconcile it with email or receipts; show it to authorized staff; prevent fraud; and maintain traceability. An SMS is supporting evidence and never confirms a payment by itself.

• Messages showing signs of a password, OTP, or login, authentication, or security code are discarded and not transmitted.
• Vuelvo does not sell this data or use it for advertising, marketing, lending, creditworthiness, or training artificial-intelligence models.

7. Limited Use of Google user data

Vuelvo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Gmail data is used only to provide the user-facing payment reconciliation and verification feature requested by the Organization.
• We do not sell Google user data or use it for advertising, advertising profiles, lending, or determining creditworthiness.
• We do not use Gmail data to train generalized or personalized artificial-intelligence models.
• Humans do not read Gmail content unless the user affirmatively consents for specific support, it is necessary for security or legal compliance, or permitted aggregated internal operations apply.
• Data is transferred only to service providers needed to operate the feature under confidentiality, security, and limited-processing obligations.

Google API Services User Data Policy

8. Purposes and legal bases

We process data to perform the Service contract, honor consent granted for integrations, comply with law, and pursue legitimate interests in security, fraud prevention, auditing, and continuity.

• Operate programs, accounts, benefits, billing, and payment verification.
• Authenticate users, enforce permissions, and prevent abuse.
• Provide support and answer privacy requests.
• Maintain traceability, reliability, and Service security.
• Send operational notices and comply with law.

9. Sharing and service providers

We do not sell personal data. We share only what is necessary with infrastructure, storage, authentication, email, messaging, payment, and monitoring providers; under Organization instructions; to protect the Service; or when legally required. Providers operate under agreements and controls appropriate to their role.

10. International transfers

Some providers may process information outside Colombia. We apply reasonable contractual, technical, and organizational safeguards under applicable law.

11. Retention and deletion

• The Google refresh token is deleted immediately when the mailbox is disconnected; synchronization stops and access can also be revoked from the Google Account.
• Gmail message previews and operational metadata automatically expire after 90 days. A valid request may require earlier deletion.
• The encrypted local queue of Android alerts expires within 72 hours. The in-app “Revoke this phone” action removes its local identity, configuration, and queue from that phone.
• The sender and text of matching SMS, and the title, text, and metadata of bank notifications, are scheduled for automatic deletion from the backend seven days after capture.
• Normalized Android evidence—such as amount, currency, reference, date, bank, opaque identifier, and parser result—is scheduled for automatic deletion after 180 days. Minimum reconciliation, security, or audit records that must be retained do not include the complete SMS or notification.
• Minimum financial evidence derived from other sources may be retained as needed for reconciliation, fraud prevention, audit, and legal duties, without retaining the complete message when it is unnecessary.
• Account and Organization data is retained while the relationship is active and for any legally necessary period afterward.
• Logs and support data are retained for limited periods according to their security and diagnostic purposes.

12. User control and revocation

The Organization can disconnect Gmail in Vuelvo and revoke access from its Google Account security settings. Disconnecting removes the stored credential, prevents new reads, and leaves only records allowed by the retention section.

On Android, the user can separately revoke SMS permission and notification access in system settings. An authorized administrator can also revoke the device registration in Vuelvo, which prevents the backend from accepting new deliveries. The local “Revoke this phone” action additionally removes the queue and identity from that phone. Revocation stops newly accepted capture, but does not automatically erase data already transmitted, which follows the periods above or may be included in a valid deletion request.

Data subjects may request access, correction, portability, objection, restriction, or deletion by emailing support@vuelvoloyalty.com or using the public form. We verify identity and authority before acting on a request.

Request data deletion

13. Security

• HTTPS/TLS for data in transit and encryption of OAuth tokens at rest.
• Android queue encryption with AES-256-GCM and non-exportable Android Keystore keys, signed requests, and device attestation.
• Backend secrets stored in secret managers and never exposed to the browser.
• Role-, tenant-, and branch-based access with traceability for sensitive actions.
• Data minimization, limited previews, OTP filtering, bank package and certificate validation, and SPF, DKIM, and DMARC controls for email.
• Monitoring, incident response, and periodic access reviews.

14. Cookies

We use cookies and local storage essential for authentication, security, and preferences. When non-essential technologies are used, required consent will be requested. Browser controls can block or delete them, although some functions may stop working.

15. Children

The Service is not directed to children. Organizations must obtain any authorization required for children’s data they manage.

16. Changes, governing law, and effective date

We may update this Policy and will communicate material changes through the Service, email, or a new update date. Colombian law and mandatory rules where the Service is provided apply. This version is effective on the date shown above.