Privacy Policy

1. Who we are

Kulto is a software-as-a-service (SaaS) platform that lets businesses create and run digital loyalty programs. It is made by Bonsai, a team based in Ecuador. Subscribed businesses (which we call "businesses") issue digital stamp, points, prepaid or gift cards to their own customers (which we call "end customers") through Apple Wallet and Google Wallet.

In this policy, the words "Kulto", "we" and "our" refer to the Kulto service, available at kultoapp.com.

2. Scope of this policy and roles

This policy applies to:

• The public website kultoapp.com.
• The Kulto web application used by businesses and their authorized staff (panel and scanner).
• The public pages where end customers obtain, activate or check their card.
• Passes issued in Apple Wallet and Google Wallet.
• The public API and the connections to the business's billing system.
• The emails Kulto sends and the internal tools with which it serves businesses and authorized sales representatives.

3. Data we collect

3.1 Business and staff data

• Account data: business name, user's first and last name, email, password (stored hashed, never in plain text), phone, country, address and city, billing currency, time zone and language. Until the sign-up is confirmed with the code sent by email, this data is held in a provisional record that stops being valid within a few hours and is deleted in the daily cleanup.
• Staff data: name, email, role, assigned location, invitation status and last access dates of each user the business invites to its panel.
• Billing data: contracted plan and period, payment history and payment requests; the image of the bank transfer receipt the business uploads; the identifiers of the charge agreement in PayPal or Stripe and the notifications those processors send us about each charge (which may include the email of the paying account); and, for USDT payments, the network, amount, transaction identifier and origin address. We never receive or store card numbers.
• Operational data: programs and their configuration, card designs and images, locations (address and coordinates), notification and campaign texts, API keys (stored as hashes), integrations with the billing system (encrypted credentials, progress marker and log of each synchronization) and the progress of the account's initial setup.
• Technical and usage data: IP address, browser type and operating system, access logs, and an audit log of critical actions (logins, credits and redemptions, voids, plan changes, staff and key management) with the IP and browser of whoever performed them.
• Communications and follow-up: the emails we send you and your replies, and the notes our team records when assisting you (calls, messages, meetings, account status, outcome of a receipt review).

3.2 End-customer data

Kulto does not require end customers to create an account or have a password. The data collected is what the business decides to request when configuring its program and what card usage generates:

• Pass identifiers: unique identifier and serial number assigned by Kulto, the Apple Wallet or Google Wallet identifiers and the records of the devices on which the card is saved, needed to update it.
• Sign-up data: first and last name, and the custom fields the program requests (text, number, license plate, date —including date of birth—, option from a list, email or phone). One of those fields may be the key with which the business's billing system identifies the customer (national ID or tax ID, phone, license plate, email). We also store the date and time the customer accepted the business's program terms, the browser used to sign up and, if they arrived through an invitation, the referral code of the person who invited them.
• Program activity: stamps, points and balances earned and spent, rewards redeemed, bonuses received, date and location of each movement and, when the business records them or its billing system sends them, the purchase amount and invoice number. In programs with balance expiration, the expiration date of each batch of points or stamps.
• Gift cards: recipient's name, giver's name and message, balance and movements, and link deliveries.
• Email address for card delivery: when the business sends the card by email from the panel or the counter, or when the buyer of a gift card sends it to its recipient, we use that address only for that delivery. We do not store it in the database; it remains only in technical logs for a limited time.
• Derived data for the business: from the activity we compute indicators the business sees in its panel: segments by recency, frequency and spend, visit cycle, churn risk and customer ranking. We also store the notes the business itself records about a card (for example, the reason for a quarantine).

What we do not collect from the end customer: their location (see section 5), payment data or financial information. The money of a prepaid program or a gift card is collected by the business through its own means; Kulto only records the balance.

3.3 Authorized sales representatives and prospects

• Authorized sales representatives: name, email, password (hashed), commission terms and the agreed payout notes, plus the commissions accrued from the businesses they referred.
• Prospects: sales representatives record in Kulto's CRM the businesses they are in contact with: business name, contact person, email, phone, city, industry, source of the contact, follow-up status and notes from their conversations.
• Referred businesses: if a business signs up through a sales representative's link, it is linked to that representative. The representative sees the business name, its plan, subscription status, period end date, sign-up date and the charged amount on which their commission is calculated. They do not see end customers or the business's operations. The plan price is the same for referred and non-referred businesses.

3.4 Visitors to the public site

On the informational pages of kultoapp.com and on the sign-up form we collect technical data (IP address, browser, pages visited) in our access logs and, through the Meta pixel, the events described in section 12.

4. How we use the data

We use the collected data for the following purposes:

• Operate the platform and deliver the service contracted by the business.
• Issue, update, close and, when applicable, void passes in Apple Wallet and Google Wallet.
• Send to cards the notifications the business decides (messages to all its customers, to a program or to an audience) and those it configures to be sent automatically (birthday greeting, balance-about-to-expire notice), and credit the automatic bonuses the business enables (welcome, referral, birthday).
• Credit stamps, points and balances from the scanner, from the public API or from the sales recorded by the business's billing system.
• Compute, for the business, the metrics, reports and indicators of the Customers window, and prepare the daily report email which, in the plans that have it, includes suggestions of customers to win back.
• Process subscription payments, review bank transfer receipts and verify USDT payments on the blockchain.
• Send account and service emails to the business (sign-up code, invitations, password recovery, payment status, renewal, grace period and suspension reminders, daily report, alerts about its integrations) and onboarding emails during account activation (see section 7).
• Assist the business: answer questions and review incidents, which may include our team accessing its account in read-only mode (see section 11).
• Prevent fraud and abuse, apply request limits and protect the security of the platform.
• Attribute referred businesses to authorized sales representatives and calculate their commissions.
• Comply with legal and accounting obligations.
• Generate aggregated and anonymous statistics about service usage.

Kulto does not write to end customers on its own initiative. The only email an end customer receives from Kulto is the one carrying their card or gift card, and it is originated by the business that issues it or by the person giving the gift. We do not send SMS or WhatsApp messages to end customers.

5. Apple Wallet and Google Wallet integration

Kulto uses the official Apple PassKit and Google Wallet APIs to issue loyalty cards on end customers' devices. For this purpose:

• The pass contains the business name, the program name, the balance, the rotating QR code, the design configured by the business and, if the business so configured it, the customer's name and up to four custom fields. On the back it carries the activity detail, the program's terms and links, an invitation link with the customer's referral code, the serial number and the business's contact details.
• In Apple Wallet, the pass file is generated by Kulto and the phone downloads it from Kulto. When something changes, Apple receives only a content-free notification so the phone downloads it again. If the customer removes the card from their Wallet, the phone notifies us and we delete that device's record.
• In Google Wallet, the pass is registered on Google's servers at issuance, so the "Add to Google Wallet" button works, and each update is sent to Google.
• We do not transmit to Apple or Google end customers' passwords, payment data, emails or phone numbers, unless the business has configured a field of that type to be displayed on the card.
• Proximity alerts: in the plans that include it, the pass carries the coordinates of up to ten of the business's locations. The phone itself detects proximity and shows the card; Kulto never receives the customer's location. In Google Wallet this feature also depends on the customer having it enabled on their device.
• The use of the passes within Apple Wallet and Google Wallet is additionally subject to the privacy policies of Apple and Google.

6. Connection to the business's billing system

A business may connect its billing or point-of-sale system so sales are credited automatically to its customers' cards. There are two modes:

• The business's system sends the sale to Kulto through the public API: we receive the program, the invoice number and amount and the identifier with which the business recognizes the customer (for example, their ID number or phone), and we match it against the external key of their card.
• Kulto queries the business's system with the credentials the business provides. On each query we read only new sales (invoice number, date, status and amount) and the customer data needed to find their card (their identifier and, depending on the system, their name or phone). In some systems, to recognize customers, we temporarily store a copy of the customer directory reduced to code and phone (and email, only if the business sells gift cards through that channel), refreshed every day.

Credentials are stored encrypted with a dedicated key, are never shown back through the API or the panel, and Kulto uses them only to read: it does not modify data in the business's system. Connections go out only to public addresses and over encrypted channels.

7. Email communications

Kulto sends businesses three kinds of emails, all through Amazon SES:

• Account and service: sign-up code, invitations, password recovery, payment and receipt status, renewal reminders, start of the grace period, suspension, trial start and integration alerts. They are necessary to operate the account and are sent for as long as the account exists.
• Operational: the daily program report, available in plans with advanced analytics. The business can turn it off or change its time from Settings.
• Onboarding and follow-up: during activation, the trial and grace periods, our team may write to you to help you get started or regularize your account, manually or through automatic sequences with a minimum wait between emails. You can ask us to stop sending them by replying to any of them with "do not contact" or by writing to [email protected]; account and service emails continue to be sent.

We keep a copy of the emails we send you so we can handle your inquiries. If an address bounces, we may stop writing to it until the business corrects it.

8. Service providers and international transfers

To operate the service we share strictly necessary data with providers that act on behalf of Kulto or as independent payment processors:

• Amazon Web Services, Inc. — hosting of the platform, database and files (servers in the United States) and email delivery through Amazon SES.
• Cloudflare, Inc. — delivery network and protection of traffic to kultoapp.com; it processes the IP addresses and requests of those who use the site and the application.
• Apple Inc. — issuance and update of passes in Apple Wallet.
• Google LLC — issuance and update of passes in Google Wallet; Google Maps Platform to autocomplete the address at sign-up and place locations in the panel (the maps library loads across the whole web application, including the public sign-up pages, which involves a technical request to Google from the browser); and Google Fonts for the typefaces of the site and the application.
• PayPal and Stripe — processing of card payments for businesses that choose that method. They collect payment details on their own pages and under their own policies; Kulto sends them the plan, the price and an internal reference, not the payer's personal data.
• TronGrid and Etherscan — blockchain queries to verify USDT payments; they receive only Kulto's receiving address and transaction identifiers.
• Meta Platforms, Inc. — measurement of our own advertising, only on the public site, the sign-up form and, until the first card, the panel's home screen (see section 12).

These providers are established in the United States and other countries, so data may be processed outside the country of the business or the end customer. We do not sell personal data to third parties. Service data — your account, your programs and your business's end customers — is never used for advertising purposes and never leaves our systems toward an ad platform.

9. Data retention

• Business account data is kept while the account is active or suspended and for a reasonable period after closure, for legal, accounting and security purposes. The movement history and the audit log are written once and are not edited, because they back the balances and the charges.
• An account sign-up that is not confirmed with the code stops being valid after at most 12 hours and is deleted in the daily cleanup. Expired or revoked session tokens are deleted daily.
• End-customer data is kept while the business's program is in force or until the business or the end customer requests its deletion. A voided or expired pass keeps its data as part of the program's history until that request. If the business removes a custom field from its program, the values customers had entered in that field are deleted from all cards.
• Payment receipts and processor notifications are kept together with the billing history.
• Temporary copies of a connected billing system's customer directory are refreshed every 24 hours. Public API responses are kept for up to 24 hours to prevent duplicate credits.
• Application and server access logs are kept for a limited period, in the order of two weeks, sufficient to detect and respond to security incidents.
• We back up the platform on Amazon Web Services infrastructure so it can be recovered after a failure. Deleted data may remain in those copies until they are replaced according to their retention cycle, and is not used for any other purpose.

10. Your rights

Regardless of your location, we offer you the following rights over your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Deletion: request the erasure of your data.
• Objection and restriction: object to certain processing or request that it be restricted.
• Portability: receive your data in a structured, readable format.
• Withdrawal of consent: when processing is based on your consent.

In Ecuador, these rights are recognized by the Organic Law on Personal Data Protection; in Mexico, they correspond to the ARCO rights (access, rectification, cancellation and objection) of the Federal Law on the Protection of Personal Data Held by Private Parties. To exercise them, write to [email protected], from the email associated with your account if you are a business.

If you are an end customer, the controller of your data is the business that issued your card, and we recommend contacting it first; when the business configures them, its contact email and phone appear on the back of the card. You can remove the card from your Wallet at any time: that stops notifications and updates, but does not delete your data from the business's program, for which you must request deletion from the business or from Kulto. If you do not get a response from the business, we can handle your request directly.

If you are a business, you can export your programs' data from the panel in the plans that include it, or request it from us. You can also ask us to close your account and delete its data, including your end customers' data, without prejudice to what we must retain under legal or accounting obligations.

11. Security

We apply reasonable technical and organizational measures to protect the data, including:

• Encryption in transit using HTTPS/TLS on the site, the application, the API and the connections to billing systems.
• Passwords stored with strong hashing functions; verification codes and API keys stored only as hashes.
• Authentication based on short-lived tokens that are renewed and rotated, with daily purging of expired tokens.
• Per-business isolation: each business accesses only its own data, and staff with the cashier role only the data of their location.
• Billing system credentials encrypted with a dedicated key, independent from the others.
• Immutable audit log of critical actions (credits, redemptions, voids, plan changes, staff and key management, logins, support access) and a log of each request to the public API.
• Dynamic QR codes that rotate to prevent reuse, and request limits per IP address and per API key.
• Continuous monitoring of the platform's health and logs, with alerts to our team.
• Limited support access: our team may open a business's account to assist it, always in read-only mode, for a maximum of 15 minutes per access and with each access recorded in the audit log.

No system is 100% impenetrable, but we work continuously to improve our defenses. If we detect an incident affecting your data, we will notify you in accordance with applicable law.

12. Cookies, local storage and similar technologies

Kulto uses these technologies only for the following purposes:

• Application session: the web application stores your session tokens and your usage preferences (for example, the sidebar state or the scanner settings) in your browser's local storage, not in cookies. They are deleted when you log out or clear your browser data.
• Sales kit cookie: authorized sales representatives who open the sales material receive a technical cookie, limited to that section and valid for at most 12 hours, that proves their access.
• Advertising measurement (Meta pixel): we use the Meta (Facebook) pixel to learn which ads bring visitors to our site and which ones end in a sign-up, and to show ads again to people who visited us. It records the page visit, the IP address and browser, the click on our WhatsApp button, the creation of an account where it happened and, once inside the panel, the moment the business issues its first card.

The pixel loads on the public site — the informational pages, these legal pages and the sign-up form — and, inside the panel, only on the home screen and only while the business has not issued any card yet: there it records the visit to that screen and the fact that the first card exists, with no data about the card or the person who received it. It does not load in the rest of the panel or on the pages where your customers get or check their card. We do not send Meta data about your account or your business's end customers. If you are already a customer and you visit the public pages, that visit is measured like any other visitor's.

You can turn it off from the ad preferences of your Facebook or Instagram account, through your browser's cookie settings, or with any tracker-blocking extension. Doing so does not affect how Kulto works. The typefaces of the site and the application are loaded from Google Fonts, and the maps library from Google Maps Platform, which involves a technical request to Google from your browser (see section 8).

13. Minors

Kulto is not directed at children under 13. We do not knowingly collect data from children under this age. If you believe a child has provided us with personal data, please write to [email protected] and we will delete it.

14. Changes to this policy

We may update this privacy policy from time to time to reflect changes in the service or in applicable law. When changes are significant, we will notify the business by email or through a notice on the platform. The last updated date appears at the top of the document.

15. Contact

If you have questions, comments or wish to exercise any of your rights, write to:

Email: [email protected]
WhatsApp: +593 99 986 4024