Privacy Policy

The data controller is Vanta Peru S.A.C., taxpayer number 20615895386, operator of VantaCard, domiciled at Calle Zela B-31, Urbanización La Rinconada, Yanahuara, Arequipa, Perú. Privacy requests may be sent to emilio.lizarraga@vantacard.pe.

Depending on how you use the service, we may collect:

• Account and contact data: name, email, phone, city, encrypted password, birth date when needed for benefits or verification, and communication preferences.
• Affiliated business data: business name, category, address, Google Maps links, benefits, logos, colors, authorized users, and operational settings.
• VantaCard and Wallet data: member identifier, card serial, pass status, available benefits, redemption history, scan events, and permitted transactional or promotional messages.
• Payment review data: claimed payer name, last four phone digits, amount and time, the 3-digit transaction security code, and a private screenshot of the receipt when a member voluntarily submits payment proof. We do not request or collect the member's Yape PIN.
• Technical data: IP address, device or installation identifiers, push tokens, security logs, access timestamps, pages used, and error logs.
• Location data: approximate or precise location only when enabled by the user, and business location data used for nearby benefits, maps, or geofencing.

We collect data when a person creates an account, requests or saves a VantaCard, completes forms, logs in, scans or redeems benefits, allows notifications or location access, uses the portal, or contacts Vanta. We also receive business data when affiliated businesses configure locations, benefits, campaigns, or authorized users.

We use personal data to:

• Create, authenticate, and manage member, business, staff, and administrator accounts.
• Issue, recover, and update VantaCards in Apple Wallet or Google Wallet.
• Show benefits, nearby locations, maps, member QR codes, and redemption status.
• Validate scans, record redemptions, prevent fraud, and protect the service.
• Review renewal claims by having an authorized person compare submitted proof with the corresponding recipient-side Yape movement. A screenshot by itself never activates or renews a membership.
• Send transactional messages about access, verification, redemptions, card updates, or security.
• Send service-related campaigns or promotional notifications when permitted and relevant to Vanta or an affiliated business.
• Provide support, improve operations, maintain security, and comply with legal obligations.

Transactional push and Wallet updates are used for card updates, redemptions, payments and security. Promotional messages are sent only through channels the member has expressly enabled and may be withdrawn free of charge in My Account. Operating-system permission alone is not treated as promotional consent.

Location is requested once when the app opens and is processed transiently to calculate distances and nearby benefits; the radar flow does not save the member's exact coordinates to the member profile. VantaCard does not use precise location for third-party advertising or to track users across third-party apps or websites.

Biometric authentication is performed by the device. Vanta does not receive or store a face or fingerprint template.

We do not sell personal data. We share data only as needed to operate the service, comply with law, or protect users and affiliated businesses.

• Affiliated businesses: receive information needed to operate benefits, validate redemptions, administer campaigns, and support members.
• Technical providers: DigitalOcean (hosting, database and object storage), Resend (email), Plausible when configured (operational analytics), and configured security/backup providers may process data for Vanta.
• Wallet and platform providers: Apple, Google, or related platforms may process data needed to issue, update, or display passes according to their own policies.
• Authorities or authorized third parties: when required by law, valid order, audit, legal defense, or fraud prevention.

Providers processing data for us must apply protections compatible with this policy and applicable requirements.

Payment screenshots and recipient-side Yape movements are visible only to authorized personnel who need them for human review, fraud prevention, dispute handling, or audit.

VantaCard does not sell personal data and does not use app data to track users across third-party apps or websites for advertising. If we later add technology that Apple considers tracking, we will request consent through App Tracking Transparency and update this policy and App Store privacy disclosures.

While an account is active, we retain the data needed to operate the card, benefits, redemptions, security, and support. When account deletion starts, access is disabled immediately. Wallet cleanup normally completes after the 24-hour Apple pass-invalidation period and may take longer while Apple or Google Wallet is unavailable.

Identity data held only for that cleanup is then erased. A non-identifying deletion-job record is kept for up to 30 days for retry and audit purposes. Complaint Book records and other records required by Peruvian law are independent statutory records and may be retained for the applicable legal period.

Payment claims, private proof screenshots, review decisions, and anti-fraud fingerprints may be retained for the period reasonably necessary to detect duplicate or fraudulent submissions, resolve disputes, support audits, and meet legal obligations. Access remains restricted and the records are then deleted or anonymized when appropriate.

We use reasonable technical and organizational measures, including access controls, password hashing, role separation, activity records, secret protection, and operational monitoring. No system is completely risk-free, but we work to reduce unauthorized access, loss, alteration, and disclosure.

Members can permanently delete their account from the VantaCard member area. You may also request access, correction, cancellation, opposition, information about processing, or account deletion through the privacy-rights form or by writing to emilio.lizarraga@vantacard.pe. We may request reasonable information to verify identity before completing a request.

We answer information requests within 8 business days, access requests within 20 business days, and correction, cancellation, or opposition requests within 10 business days, subject to any legally permitted extension that is properly communicated.

Deletion disables the account and revokes app sessions immediately. Google Wallet is marked inactive. An Apple Wallet pass is invalidated and its server data is later removed, but the inactive visual card may remain on the device until the user removes it from Apple Wallet.

VantaCard registration is currently limited to people aged 18 or older. The registration date of birth is validated on the server. Vanta does not offer an under-18 parental-consent registration path. If we learn that an underage account was created, we will restrict it and assess deletion or legally valid remediation.

Some technology providers may process or host data outside Peru. In those cases, we use providers with contractual, technical, and organizational safeguards intended to protect information according to this policy.

We may update this policy to reflect legal, technical, or operational changes. The current version will remain available on this page with its update date and version. Material changes may be communicated through reasonable service channels. This is version 2026-08-25.