Privacy policy
A translation for your convenience. The Spanish text is the binding one.
1. Who we are
Grella is a digital loyalty card platform for small businesses, based in Arequipa, Peru. In this policy we explain what personal data we process, what for, who we share it with and how you can exercise your rights, in accordance with Law No. 29733, the Personal Data Protection Law, and its regulations.
For any privacy question you can write to us at hola@grella.pe.
2. Who it applies to
To the businesses that use Grella (owners and staff), to the customers of those businesses who register for a loyalty card, and to anyone who visits our website.
3. What data we process
From business owners and staff: name, email address, password (stored encrypted, never in readable text) and activity within the dashboard.
From businesses: trade name, address, phone, logo and billing details (document type and number, legal name and fiscal address).
From customers who register for a card: only name, mobile number and email address, plus the record of their stamps and redemptions. We do not ask for an ID document, date of birth, address or location.
Payment card data is captured and processed directly by our payment gateway. It never passes through our servers.
4. What we use it for
To provide the service: create and operate the loyalty cards, credit stamps, allow reward redemptions, verify each customer's contact details, charge the businesses' subscriptions, issue electronic receipts and provide support.
We do not use customers' data for advertising, we do not sell it and we do not share it with other businesses.
5. WhatsApp and Meta services
When a customer chooses to verify their number by WhatsApp, we send a message with a verification code through the WhatsApp Business platform of Meta Platforms, Inc. For this, Meta receives the mobile number and the content of that message, and tells us whether it was delivered.
We only use WhatsApp for verification messages and service notices that the customer requests. We do not send promotions or bulk messages.
We do not use Facebook Login and we do not obtain data from your Facebook or Instagram profile.
8. How long we keep it
Business data is kept while the account is active. Receipts and billing records are kept for the period required by tax regulations.
A customer's name, mobile number and email are kept while they use their card and for up to 12 months after their last activity. Then they are deleted and their stamps remain only as an anonymous record for the business.
9. Security
We protect data with encrypted connections, encrypted passwords, access separated by business and audit logs. Each business can only see its own customers' data.
10. Your rights
You can exercise your rights of access, rectification, cancellation and objection by writing to hola@grella.pe. We will respond within the time limits set by law. If you are not satisfied, you can file a complaint with the National Authority for Personal Data Protection of the Ministry of Justice and Human Rights.
To delete your data, follow the instructions on our "Data deletion" page, at grella.pe/eliminacion-de-datos.
11. Minors
Grella is not directed at children under 14 and we do not knowingly process their data. If we detect a registration by a minor under that age without the consent of their parents or guardians, we will delete it.
12. Changes to this policy
If we change this policy, we will publish the new version on this page with its update date and, if the change is significant, we will notify businesses by email.