Privacy policy

1. Who we are

Kambak (“Kambak”, “we”) is an online service that allows businesses to create loyalty, membership, coupon and gift cards for Google Wallet and Apple Wallet, distribute them via QR and NFC and send notifications to their customers. The owner of the service is Javier Bagdadi, domiciled at Av. del Libertador 6199, CABA (C1428), Argentina (“the Owner”). Contact for privacy matters: jabagdadi@gmail.com.

This policy is governed by Law 25,326 on the Protection of Personal Data, its Regulatory Decree 1558/2001 and the rules of the Agency for Access to Public Information (AAIP), the supervisory authority in the Argentine Republic.

2. Our role depending on whose data it is

• Data of businesses and their users (owners and staff who use the dashboard): Kambak is the data controller of the database and decides what it is used for, in accordance with this policy.
• Data of each business’s end customers (the people who add a business’s card to their wallet): the data controller is each business, and Kambak acts as data processor (provider of data processing services, section 25 of Law 25,326). We process that data only to provide the service to that business and according to its instructions; we do not use it for our own purposes, we do not share it with other businesses and we delete it when the contract ends, unless there is a legal obligation to keep it.

If you are an end customer and want to access, correct or delete your data, ask the business or use My data: we verify your email and forward the request to the business with the legal deadline. Each business has its own policy at /en/legal/privacidad/<business> (linked from the sign-up form) and the rules between Kambak and businesses are set out in the data processing agreement.

3. What data we process

3.1 Businesses and dashboard users

• Account data: name, email, password (stored encrypted with a hash) or Google account.
• Business data: name, industry, locations and addresses, logo, colors, contact details and tax details for invoicing.
• Payment data: processed by Mercado Pago. We store the subscription status and receipts, never the full card number.
• Usage data: actions in the dashboard, scans performed, IP address, browser and technical logs.
• If the business’s Mercado Pago account is connected to collect membership fees: the access tokens, encrypted.

3.2 End customers of each business

• Name, email and, if the business requests them, phone number and date of birth.
• Card data: stamps, points, balance, membership and expiration date, visits and redemptions (date, location and staff member who scanned).
• Consent to receive promotions (the checkbox is shown unchecked).
• Technical pass data: identifiers generated by Google Wallet or Apple Wallet to update it and send notifications (they do not include your location or your contacts).
• If the business enables location-based notifications, the phone’s wallet uses the coordinates of the locations to show the notification near the store; that detection is done by your phone and it does not send us your location.

The pass’s QR code contains a random identifier and never your email or other personal data.

4. What we use it for

• Providing the service: creating and updating cards, recording visits, sending notifications and collecting membership fees.
• Managing accounts, invoicing and billing for plans.
• Providing support and communicating with businesses about their account.
• Security, fraud prevention and compliance with legal obligations.
• Improving the product with aggregated, anonymous statistics. We do not sell personal data or use it for third-party advertising.
• Sending Kambak news to businesses (you can unsubscribe in every email). End customers only receive notifications from the business they joined.

The legal basis is the performance of the contract with the business, the data subject’s consent where applicable (for example, promotions) and compliance with legal obligations.

5. Artificial intelligence

Some features (building the card, writing and reviewing notifications, reading the photo of a sheet to import customers, the dashboard copilot and the help chat) use the Claude API from Anthropic, PBC (United States). We send it aggregated data, the business’s texts or identifiers; emails and phone numbers are masked before sending. The copilot may receive an end customer’s first name when the business asks about them. The only exception is the photo a business uploads to import customers: it is sent to be read and we do not store it. Anthropic processes the information on our behalf and, under its commercial terms, does not use it to train its models.

6. Who we share data with (processors)

To operate, we use providers that process data on our behalf, with confidentiality and security obligations. Some are located outside Argentina, which means there is an international transfer of data:

When the destination country does not have an adequate level of protection according to the AAIP, we apply contractual clauses or other safeguards provided for by the regulations. We may also share data if required by a competent authority.

7. How long we keep it

• Business data: while the account is active and then for the period required by tax and accounting rules.
• End customers’ data: while the business uses the service. When the contract ends, we deliver it to the business if requested and delete it within 90 days.
• Technical and security logs: up to 12 months.

8. Your rights

You can request access, rectification, updating and deletion of your data, and withdraw your consent at any time, by writing to jabagdadi@gmail.com, from My data (customers of a business) or using the cancellation button. Access is free of charge at intervals of no less than six months, unless there is a legitimate interest (section 14, Law 25,326). We respond to access requests within 10 calendar days and to rectification or deletion requests within 5 business days.

The AAIP, in its capacity as the Supervisory Body of Law 25,326, has the power to handle the complaints and claims filed by those whose rights are affected by non-compliance with the regulations in force on personal data protection. Website: argentina.gob.ar/aaip.

To stop receiving notifications from a business: turn off the pass notifications in your wallet, delete the card or ask the business (see help).

9. Cookies

We only use the cookies necessary for the service to work:

• Session (kambak.session_token): keeps you logged in to the dashboard for up to 30 days. It is strictly necessary.
• Technical browser preferences (for example, local storage for the interface).

We currently do not use advertising, measurement or third-party tracking cookies: that is why the cookie notice is informational only. You can view it again from “Cookie preferences” in the footer. If in the future we add measurement tools, we will say so here and ask for your consent where applicable. You can delete or block cookies from your browser; if you block the session cookie you will not be able to log in to the dashboard.

10. Security

We use encrypted connections (HTTPS), hashed passwords, encryption of credentials and sensitive tokens, separation of each business’s data and access restricted to the staff who need it. No system is infallible: if we detect an incident affecting your data, we will inform you.

11. Minors

The dashboard is for people over 18 who represent a business. End customers who are minors must have the authorization of their parents or guardians to join a card.

12. Changes to this policy

If we change something important, we notify businesses by email and on this page at least 15 days in advance. The date of the last update is shown above.

13. Database registration

The business database is in the process of being registered with the AAIP’s National Registry of Databases.