Privacy Policy — SHUPU App

Version: 2026-10-03-v0.7 Last updated: 3 October 2026

0. Controller

• Service: SHUPU
• Privacy contact: shupucompany@gmail.com
• Supervisory authority: Spanish Data Protection Agency (AEPD), www.aepd.es

The controller’s tax identity and registered office will be published when sole-trader or company registration is in place. A private home address is not published.

This Policy applies to the mobile app (iOS/Android) and the merchant web panel (owner.shupu.ai), for the two profiles in the Terms: Client User and Merchant User (owner / manager / staff).

1. Purpose

It explains which personal data SHUPU processes, for what purpose, on which legal basis, for how long, with whom it is shared, and what rights you have.

2. What data we collect

2.1 Client User

• Sign-up: nickname and email. Client registration does not require a phone number. You can also sign in with Google or Sign in with Apple; in that case we receive that account’s identifier and, if the provider sends them, email and display name.
• Profile and activity: profile photo if you upload one, favourites, offer subscriptions, viewed offers, redemptions, local events, points and reputation level.
• Location: for Neighborhood, Explore and distances, the app may read the device GPS (with system permission) and send it in one-off server queries (e.g. nearby merchants or neighborhood resolution). We do not store a continuous coordinate history. The zone we persist is the neighborhood or district, not the street or building number.
• BLE proximity: detected beacon identifier, signal strength (RSSI) and timestamp, for the detection session (typical expiry 8 hours). Beacon lookup audit stores a hash of the IP, not the IP in the clear.
• Community: chat messages, group membership, group photos and content you post. Chat messages (direct, group and support) are encrypted in transit over the network. That protection covers the transmission; it is not end-to-end encryption. SHUPU’s administration team can access a conversation and intervene when needed to handle a support request or to enforce SHUPU’s community standards (courtesy and respect for other people), which are set out in the Terms.
• Technical: device push token, device type and session identifier.

2.2 Merchant User (owner / manager / staff)

• Business identification: trade name, address, venue coordinates, activity, ownership and, when provided, tax ID.
• Merchant contact: phone number (required when creating a merchant) and details of people with panel access (owner, manager, staff roles).
• Holder phone (sign-up): a number, in international format, which may be verified with an SMS code (OTP). It is distinct from the business’s public contact phone and from any optional client-profile phone. It shows that the person completing sign-up controlled that line at that moment; it is not civil-identity KYC. The record is tied to that account and may be reused on later merchants of the same account; each sign-up stores a snapshot on the merchant.
• Sign-up traces (fraud / litigation): source IP of merchant creation, Terms-acceptance timestamp, and, if the OTP completes, IP and time of that verification. These IPs are stored in the clear (not hashed), unlike BLE audit.
• Billing: plan and subscription status. SHUPU does not store card data; Stripe processes payments.
• Merchant content: photos, logos, texts and videos on listings and offers (licence in §9 of the Terms).
• Analytics for their own business: views, redemptions and offer performance. The merchant can see, in aggregate and without identifying anyone, how their own customers' loyalty points are distributed.
• Beacons you configure: technical device identifiers (for example the Bluetooth identifier the phone sees when programming) and encrypted configuration codes, so only the authorised merchant or SHUPU staff can reprogram them. They are not sent to a client walking past the beacon.

2.3 What we do not do

• We do not use a client’s phone number as a way to search for or invite other users.
• We do not sell data to advertising intermediaries.
• We do not continuously track GPS position on our servers.

3. Purposes and legal bases

You can revoke location, Bluetooth and notification permissions in the phone settings. That does not delete the account; it may block features that depend on those permissions (consistent with §4.4 of the Terms).

4. Who we share data with

SHUPU uses these processors or providers to run the service. Data is not sold for advertising:

• MongoDB Atlas — main database (accounts, profiles, chat, offers, beacons, configuration).
• Google Cloud (Cloud Run and file storage) — backend and images (offers, merchants, chat).
• Cloudflare (Workers and Pages) — api.shupu.ai, go.shupu.ai and the owner.shupu.ai panel.
• Upstash (Redis) — cache and short-lived session data.
• Stripe — merchant subscription payments and billing.
• Resend — transactional email (verification, account notices).
• Firebase Cloud Messaging (Google) — push notifications.
• Firebase Authentication — Phone (Google) — sending the SMS/OTP that verifies the holder’s phone at merchant sign-up, when that flow is used. SHUPU does not use that Firebase session as app identity; it extracts the verified number and does not keep the Firebase account as a login.
• Mapbox — Neighborhood maps; the SDK may process on-device location and map telemetry (adjustable from the map ℹ️ button).
• Google Sign-In and Apple — if you sign in with those accounts, the identity provider confirms your identifier.

5. International transfers

Some of these providers may process data outside the European Economic Area (in particular the United States). That is covered by their own mechanisms (standard contractual clauses and, where applicable, the EU–US Data Privacy Framework). You can ask for more detail at shupucompany@gmail.com.

6. How long we keep data

• Active account: for as long as the account exists.
• After closure or an erasure request: we block access immediately or as soon as we handle the request. We keep only what is needed for claims and legal duties, typically up to 12 months, unless the law requires longer.
• Merchant billing: tax and commercial retention (in practice 4 to 6 years).
• BLE session detections: expire around 8 hours.
• Captured-offer wallet: typical expiry 48 hours.
• Product analytics events: at most 24 months.
• Merchant sign-up traces (holder phone, IPs, OTP and Terms timestamps): for as long as the merchant exists and, after take-offline, rejection or freeze, up to 12 months, unless a claim or proceeding is open (then until it closes and any applicable limitation periods). Not used for marketing.
• Technical beacon inventory (device identifier and encrypted configuration codes): for as long as the device is in the SHUPU fleet (on loan to the merchant). Deleted when the asset is written off (return, loss or retirement), not when an inventory slot goes inactive or when QA release is used.

7. Your rights

You can exercise access, rectification, erasure, objection, restriction and portability by writing to shupucompany@gmail.com. We will respond within the one-month legal deadline. If you disagree with the outcome, you may complain to the AEPD (www.aepd.es).

Taking a merchant offline: the owner can take the merchant offline from the app. It disappears from the map and Explore; SHUPU can restore it, the owner cannot.

Deleting a User account: there is no “delete my account” button in the app today. A SHUPU admin can block access. To delete your account, email shupucompany@gmail.com. If you own a merchant, it must be taken offline or transferred before the personal account is deleted.

8. Bluetooth beacons and location

Beacon detection means near a merchant, not an exact street address. GPS is used on the phone for the map and to resolve neighborhood or nearby offers; we do not build a movement history. SHUPU may analyse, in aggregated and anonymous form, proximity information collected by users to verify that hardware installed at merchants is working and located correctly.

9. Loyalty and reputation

Points, stamps and level are computed from your activity on SHUPU. A merchant does not see your reputation or your activity at other merchants, nor personal data of other merchants’ customers in a joint offer or Shupu Day, beyond what is already visible in normal use of the app (§7.5 of the Terms).

10. Chat and content you post

Group messages and photos are kept while the account is active or until you delete them. SHUPU may moderate or remove content that breaks the rules, and provides reporting. We do not pre-screen all content (§5 of the Terms).

11. Children

SHUPU is for people aged 18 or over (§4.1 of the Terms). We do not intentionally process data of younger people. If we detect a minor’s account, we may suspend or cancel it.

12. Security

Access is authenticated with signed JWT tokens. Traffic is encrypted (HTTPS/TLS). We take periodic backups; you remain responsible for data you manage as a merchant (catalogue, offers), consistent with §17 of the Terms.

13. Merchant web panel

The panel (owner.shupu.ai) uses browser local storage to keep you signed in. It is not used for advertising or cross-site tracking.

14. Maps (Mapbox)

Map views use Mapbox and OpenStreetMap data. The Mapbox SDK may send anonymous usage data; you can manage that telemetry from the map ℹ️ button or on Mapbox’s website. Details are also in Settings → About in the app.

15. Changes to this Policy

We may update it if the law or the service changes. Substantial changes to how we process data will be communicated expressly, in line with §19 of the Terms.

16. Contact

Questions about this Policy: shupucompany@gmail.com.

Terms