This is a courtesy translation. The Spanish version is the binding one: if the two differ, the Spanish text prevails. Read the Spanish version.
Last updated: 9 October 2026.
This document brings together Fidelyo’s Privacy Policy, Data Processing Agreement (DPA) and Sub-processor list.
This policy explains how Fidelyo processes personal data in relation to its website, its SaaS platform, support, subscriptions and the loyalty programmes run by the Merchants that use Fidelyo.
For Fidelyo’s own processing, the controller is:
Greenex Consulting LLC
1209 Mountain Road PL NE STE R, Albuquerque, NM 87110, United States
Privacy contact: soporte@getfidelyo.com
This contact does not imply the formal appointment of a Data Protection Officer, unless we expressly state otherwise.
Although we are a United States entity, we process data of people in the European Union (Merchants and their End Customers) and we apply GDPR principles to that processing.
Fidelyo acts in two distinct ways:
If you have joined a business’s loyalty card, the main controller of that programme’s information is the Merchant, not Fidelyo.
| Identification | First name, surname, company, role, email, phone |
| Invoicing | Address, tax ID/VAT number, subscribed plan, billing history |
| Payment | Tokenised data handled directly by Stripe (we do not store the full card number) |
| Support | Communications with soporte@getfidelyo.com |
| Technical | IP, device, browser, logs and security events |
| Identification | Name, email and/or phone, depending on what the Merchant asks for |
| Programme | Card identifier, associated location/merchant, stamps, points, rewards, visits, redemptions |
| Technical | Basic data needed for the digital card to work and stay secure |
By default, Fidelyo does not need special categories of data (health, beliefs, etc.). Merchants must not enter this kind of data into their programmes.
We process data in order to: create and manage accounts and digital cards; manage stamps, points and campaigns; process payments and invoicing; provide support; keep the platform secure and detect fraud or abuse; improve the service; and comply with legal, tax and accounting obligations.
We do not sell personal data to third parties. We share strictly the data needed with the providers that allow us to operate the Service — see the full detail in the Sub-processor list: Supabase (database, EU), Vercel (hosting), Stripe (payments), Resend (transactional email), and Apple Inc. / Google LLC (delivery of the card to Apple Wallet / Google Wallet).
We also share with Google LLC and Meta Platforms Ireland Ltd. just what they need to recognise your sign-up or your payment as the conversion for their ad: your email address and, with Meta, also your phone number, name, city, country, postcode and an internal identifier for the business, hashed and never in the clear, plus your IP address and your browser, which are not hashed. It is only sent to Google if you accepted the cookie notice. For Meta it depends on where you are: from the European Economic Area, the United Kingdom or Switzerland you also have to accept; from the rest of the world it is sent unless you press “Reject”.
Fidelyo is provided by a company based in the United States, and some providers (Stripe, Resend, Apple, Google) process data from the US. Where transfers take place outside the European Economic Area and European data protection rules apply, we put appropriate safeguards in place: Standard Contractual Clauses approved by the European Commission or other valid mechanisms recognised by the applicable rules. Greenex Consulting LLC is not certified under the EU-U.S. Data Privacy Framework; we do not claim otherwise on any channel.
You can exercise your rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent by writing to soporte@getfidelyo.com.
If your request concerns a loyalty programme run by a specific Merchant (you are an End Customer), we may forward your request to that Merchant, who is the controller of your data in that context. If you are in the European Union, you may also lodge a complaint with your data protection authority.
We apply reasonable technical and organisational measures: access control, encryption in transit, backups, monitoring and incident response procedures. No system is absolutely secure; if you are a Merchant, you are responsible for protecting your own credentials and those of your team.
Fidelyo is not aimed at minors. Merchants must not set up programmes aimed at minors or collect their data without complying with the applicable rules.
We may update this policy to reflect legal or Service changes. If the change is significant, we will let you know by email or through a notice in the panel.
For any privacy enquiry: soporte@getfidelyo.com.
Last updated: 26 June 2026.
This Agreement forms part of the Fidelyo subscription and governs the processing of personal data that Fidelyo carries out on the Merchant’s behalf in respect of its End Customers and the users associated with the loyalty programme. It applies automatically to every Merchant that uses Fidelyo to process End Customer data, with no separate signature needed, unless otherwise agreed in writing.
Data processor: Greenex Consulting LLC, a New Mexico LLC, with registered address at 1209 Mountain Road PL NE STE R, Albuquerque, NM 87110, United States.
Data controller: the Merchant that subscribes to Fidelyo and decides the essential purposes and means of its loyalty programme.
The Merchant acts as data controller in respect of its End Customers’ data: it decides the purpose of the programme, the data requested, the loyalty rules and the applicable legal bases. Fidelyo acts as data processor when it processes that data on the Merchant’s behalf in order to provide the platform, and as independent controller in respect of the data arising from its own relationship with the Merchant (invoicing, support, security, legal compliance).
The subject matter of the processing is to allow the Merchant to create, manage and run its digital loyalty programme through Fidelyo. Processing lasts for as long as the Merchant’s account is active and, after cancellation, for a maximum of 90 days for export, erasure, legal compliance or defence against claims, unless there is a legal retention obligation.
Fidelyo will process the data in order to: create and manage digital cards; register End Customer sign-ups; manage stamps, points and rewards; enable communications related to the programme; provide technical support; keep the platform secure; and generate metrics for the Merchant — always in accordance with the Merchant’s documented instructions.
Data subjects: the Merchant’s End Customers, its internal users and its technical or commercial contacts. Data: name, email, phone, card identifier, associated location, stamps, points, rewards, visits, redemptions, and the basic technical data needed for security and operation. By default, Fidelyo does not process special categories of data; the Merchant undertakes not to enter them without Fidelyo’s express written authorisation.
Fidelyo will process the data solely in accordance with the Merchant’s documented instructions (these Terms, the platform configuration and support requests). If Fidelyo considers that an instruction infringes the applicable rules, it may warn the Merchant and suspend its execution until it receives valid instructions.
The Merchant authorises Fidelyo to use the sub-processors needed to provide the Service. The up-to-date list is published at getfidelyo.com/en/privacy/#subencargados. Where a new sub-processor is brought in that materially affects the processing, Fidelyo may notify the Merchant; if the Merchant objects on reasonable data protection grounds, it must say so in writing to soporte@getfidelyo.com, and if the objection cannot be resolved, either party may cancel the affected service.
The Merchant acknowledges that Fidelyo is provided by a company based in the United States and that certain data may be processed, hosted or accessed from there. Where the processing involves transfers outside the European Economic Area and European rules apply, Fidelyo will put appropriate safeguards in place (Standard Contractual Clauses approved by the European Commission or other valid mechanisms). Greenex Consulting LLC is not certified under the EU-U.S. Data Privacy Framework as at the date of this version.
Fidelyo will apply appropriate technical and organisational measures having regard to the state of the art, the costs, and the nature and risks of the processing. It will notify the Merchant, without undue delay, of any personal data breach it becomes aware of affecting data processed on the Merchant’s behalf, including the nature of the incident, the data affected and the measures taken. The Merchant will be responsible for notifying authorities or data subjects where legally required.
Once the service ends, Fidelyo will erase, anonymise or return the data processed on the Merchant’s behalf, unless there is a legal retention obligation. Fidelyo will make reasonable information available to the Merchant to demonstrate compliance with this Agreement; any audit must be reasonable, proportionate, notified in advance and subject to confidentiality.
Each party is liable for the breaches attributable to it under the applicable rules and the main contract. The Merchant will hold Fidelyo harmless against claims arising from unlawful instructions, absence of a legal basis, communications sent without consent or improper configuration of its loyalty programme.
For matters relating to this Agreement: soporte@getfidelyo.com.
Last updated: 26 June 2026.
These are the providers Fidelyo actually uses to provide the Service, in accordance with the Data Processing Agreement. We update this list whenever we add, replace or remove a provider.
| Provider | Service | Location | Data processed |
|---|---|---|---|
| Supabase | Database and authentication | EU (Ireland, AWS eu-west-1) | Account data, End Customers, technical logs |
| Vercel Inc. | Application hosting | Global network (CDN), US | Traffic data and application logs |
| Stripe | Payment processing and invoicing | EU / US | Payment and billing data (tokenised) |
| Resend | Transactional email delivery | US | Email, name, delivery events |
| Apple Inc. | Delivery of the card to Apple Wallet | US / global | Technical and pass data, depending on configuration |
| Google LLC | Delivery of the card to Google Wallet | US / global | Technical and pass data, depending on configuration |
We aim to select providers with reasonable security, confidentiality and data protection measures, and we require each of them to accept data protection obligations substantially equivalent to those in our DPA.
If we add, replace or remove a provider in a way that materially affects the processing of a Merchant’s data, we will communicate it by reasonable means in accordance with the DPA. You can write to us at soporte@getfidelyo.com if you would like us to notify you of future changes.