Personal data policy

1. Who is responsible

Rondel is operated by Johan Armando Villamil Gaitán, an individual holding Colombian citizenship ID 1.013.646.891 ("Rondel"). Write to hola@rondelapp.com about anything to do with your personal data.

This policy follows Colombia's Law 1581 of 2012, Decree 1377 of 2013 (compiled in Decree 1074 of 2015) and the other Colombian rules on personal data. The Spanish version is the binding one.

2. Two different roles

For the data of the businesses that use Rondel (owners, managers and staff), Rondel is the data controller.

For the data of each business's customers (the people collecting stamps on its card), the business is the controller and Rondel acts as its processor, handling that data on the business's behalf and following its instructions. When a customer creates their own account in the Rondel app, Rondel is also the controller of that account's data.

3. What data we handle

From businesses: name, email, mobile number, business details (name, locations, address, hours, logo), their team and their subscription. Payments are processed by Polar as merchant of record; Rondel never receives or stores your card details.

From businesses' customers: name, email or mobile number, date of birth if given, and the visits, purchases, stamps and rewards recorded at each business, plus how they joined. If you use "Near me", your location is used at that moment to sort results and is not stored.

From everyone: technical usage data (device, browser, pages viewed, errors) to keep the service working and to improve it.

4. What we use it for

To provide the service: creating and running accounts, recording stamps and rewards, showing cards, sending sign-in links and verification codes, and charging subscriptions.

To contact you about the service (security notices, changes, support). We do not sell personal data or use it for third-party advertising.

To measure and improve the product from usage data, and to prevent fraud and abuse.

5. Who we share it with

With providers that help us run Rondel and only process the data for that: Vercel and Cloudflare (hosting), Turso (database), Upstash (cache), Resend (email), Twilio (SMS), PostHog (product analytics), Trigger.dev (background jobs), Polar (payments) and Google (Google sign-in, if you choose it).

Each business sees its own customers' data. A business never sees another business's customers.

We may hand over data when a competent authority lawfully orders it.

6. International transfer

Several of these providers store data outside Colombia, mainly in the United States. By using Rondel you authorize that transfer, which we make with providers offering adequate protection.

7. Your rights

You may know, update and correct your data; ask for proof of your authorization; be told how we use it; revoke the authorization or ask us to delete it where no legal or contractual duty requires keeping it; access it free of charge; and complain to Colombia's Superintendence of Industry and Commerce (SIC).

You can delete your account yourself from the app or the dashboard at any time. If you are a business's customer and want your data deleted, ask that business or write to us.

8. How to exercise them

Write to hola@rondelapp.com with your name, the data or request, and how to reach you. We answer queries within ten (10) business days and claims within fifteen (15) business days, extendable as the law allows.

9. How long we keep it

While your account is active, and afterwards as long as needed to meet legal or accounting duties or settle disputes. When you delete your account, your personal data is deleted or anonymised; a business's aggregate figures (for example, a month's total sales) may be kept without identifying you.

10. Security

We use encrypted connections, role-based access and providers with recognised security controls. No system is infallible; if an incident affects your data we will tell you, and the authority where required.

11. Cookies

We use cookies needed to keep you signed in and remember your language, and analytics cookies to understand how the product is used. You can block them in your browser, though without the session ones you cannot sign in.

12. Minors

Rondel is not aimed at children under 14. A minor using the service must do so with their legal guardian's authorization.

13. Changes to this policy

If we change this policy in a meaningful way, we will tell you by email or in the product before the change applies. The date above marks the latest version.