Privacy Policy

To use your account’s benefits, you declare your full legal name as shown on your DNI and its eight-digit number in My VantaCard details. These details are separate from your display name and billing data; we do not import them from billing records.

Staff signed in with permission for the business can consult your membership and available benefits by entering only your exact eight-digit DNI or scanning your own VantaCard QR. They can see your declared name and DNI for that private lookup and must compare them with your physical DNI before generating an operation code. Knowing your DNI or the operation code does not grant access to your account.

DNI lookup uses a protected exact-match index and shared attempt limits. It is not a public directory and does not support name searches or partial DNI searches. If a lookup cannot identify one account safely, use your own VantaCard QR or contact support. Legal identity details are cleared from the scanner view when it goes into the background or the signed-in account changes; displaying a recovered operation requires current authorization.

This is member-declared information, not government or RENIEC verification or biometric identity validation. Document comparison does not guarantee that fraud will be eliminated.

The declared name and DNI are stored encrypted with restricted access and limited display. We do not copy these identity fields into redemption ledgers, business reports, notifications or Wallet passes. They are retained for use with your account. Once registered, the name and DNI cannot be changed directly from your account. Account deletion removes this declared identity, its lookup index and validation grants when deletion starts, while other account and transaction records follow the retention rules below.

You can review your registered details in My VantaCard details, or request correction, access or deletion through the existing privacy-rights channels below. An access/export request opens a support case for authorized private fulfillment; it does not immediately generate a downloadable bundle.

This dated explanation does not change earlier notice acknowledgements or consent records. Declaring these details is not marketing consent and does not alter billing consent.

The data controller is Vanta Peru S.A.C., taxpayer number 20615895386, operator of VantaCard, domiciled at Calle Zela B-31, Urbanización La Rinconada, Yanahuara, Arequipa, Perú. Privacy requests may be sent to contacto@vantaperu.com.

Depending on how you use the service, we may collect:

• Account and contact data: name, email, phone, city, encrypted password, birth date when needed for benefits or verification, and communication preferences.
• Affiliated business data: business name, category, address, Google Maps links, benefits, logos, colors, authorized users, and operational settings.
• VantaCard and Wallet data: member identifier, card serial, pass status, available benefits, redemption history, scan events, and permitted transactional or promotional messages.
• Technical data: IP address, device or installation identifiers, push tokens, security logs, access timestamps, pages used, and error logs.
• Location data: approximate or precise location only when enabled by the user, and business location data used for nearby benefits, maps, or geofencing.

We collect data when a person creates an account, requests or saves a VantaCard, completes forms, logs in, scans or redeems benefits, allows notifications or location access, uses the portal, or contacts Vanta. We also receive business data when affiliated businesses configure locations, benefits, campaigns, or authorized users.

We use personal data to:

• Create, authenticate, and manage member, business, staff, and administrator accounts.
• Issue, recover, and update VantaCards in Apple Wallet or Google Wallet.
• Show benefits, nearby locations, maps, member QR codes, and redemption status.
• Validate scans, record redemptions, prevent fraud, and protect the service.
• Send transactional messages about access, verification, redemptions, card updates, or security.
• Send service-related campaigns or promotional notifications when permitted and relevant to Vanta or an affiliated business.
• Provide support, improve operations, maintain security, and comply with legal obligations.

Transactional push and Wallet updates are used for card updates, redemptions, payments and security. Promotional messages are sent only through channels the member has expressly enabled and may be withdrawn free of charge in My Account. Operating-system permission alone is not treated as promotional consent.

Location is requested once when the app opens and is processed transiently to calculate distances and nearby benefits; the radar flow does not save the member's exact coordinates to the member profile. VantaCard does not use precise location for third-party advertising or to track users across third-party apps or websites.

Biometric authentication is performed by the device. Vanta does not receive or store a face or fingerprint template.

We do not sell personal data. We share data only as needed to operate the service, comply with law, or protect users and affiliated businesses.

• Affiliated businesses: receive information needed to operate benefits, validate redemptions, administer campaigns, and support members.
• Technical providers: DigitalOcean (hosting, database and object storage), Resend (email), Plausible when configured (operational analytics), and configured security/backup providers may process data for Vanta.
• Google Maps Platform · October 18, 2026: In the Android app, opening the nearby benefits map activates Google Maps Platform. Its Android SDK collects technical request and device metadata, IP address, an SDK-specific pseudonymous identifier, crash traces and metrics and, depending on map use, interaction events such as panning or zooming. Google states that it uses this data to measure usage, maintain and improve its services and their stability, also under its own Privacy Policy. The map is not initialized until you open this feature; you can use the other VantaCard features without opening it. The approximate or precise location you authorize is used to calculate and display nearby benefits as described in section 5. See the Maps SDK for Android data disclosure. This dated explanation does not change earlier notice acknowledgements or consent records.
• Wallet and platform providers: Apple, Google, or related platforms may process data needed to issue, update, or display passes according to their own policies.
• Authorities or authorized third parties: when required by law, valid order, audit, legal defense, or fraud prevention.

Providers processing data for us must apply protections compatible with this policy and applicable requirements.

VantaCard does not sell personal data and does not use app data to track users across third-party apps or websites for advertising. If we later add technology that Apple considers tracking, we will request consent through App Tracking Transparency and update this policy and App Store privacy disclosures.

While an account is active, we retain the data needed to operate the card, benefits, redemptions, security, and support. When account deletion starts, access is disabled immediately. Wallet cleanup normally completes after the 24-hour Apple pass-invalidation period and may take longer while Apple or Google Wallet is unavailable.

Identity data held only for that cleanup is then erased. A non-identifying deletion-job record is kept for up to 30 days for retry and audit purposes. Complaint Book records and other records required by Peruvian law are independent statutory records and may be retained for the applicable legal period.

We use reasonable technical and organizational measures, including access controls, password hashing, role separation, activity records, secret protection, and operational monitoring. No system is completely risk-free, but we work to reduce unauthorized access, loss, alteration, and disclosure.

Members can permanently delete their account from the VantaCard member area. You may also request access, correction, cancellation, opposition, information about processing, or account deletion through the privacy-rights form or by writing to contacto@vantaperu.com. We may request reasonable information to verify identity before completing a request.

We answer information requests within 8 business days, access requests within 20 business days, and correction, cancellation, or opposition requests within 10 business days, subject to any legally permitted extension that is properly communicated.

Deletion disables the account and revokes app sessions immediately. Google Wallet is marked inactive. An Apple Wallet pass is invalidated and its server data is later removed, but the inactive visual card may remain on the device until the user removes it from Apple Wallet.

VantaCard registration is currently limited to people aged 18 or older. The registration date of birth is validated on the server. Vanta does not offer an under-18 parental-consent registration path. If we learn that an underage account was created, we will restrict it and assess deletion or legally valid remediation.

Some technology providers may process or host data outside Peru. In those cases, we use providers with contractual, technical, and organizational safeguards intended to protect information according to this policy.

We may update this policy to reflect legal, technical, or operational changes. The current version will remain available on this page with its update date and version. Material changes may be communicated through reasonable service channels. This is version 2026-10-18.