Privacy Policy

Last updated: August 9, 2026

1. Data Controller & Legal Entity

DownTown ("DownTown", "we", "us", or "our") operates a digital loyalty and community platform for local businesses. The data controller responsible for processing your personal information is Juan David Alba Ramirez (Colombian C.C. 1021394042), acting as legal representative of DownTown.

If you have any questions or concerns regarding this Privacy Policy or our data practices, you can contact us directly at hello@down-town.app.

2. Information We Collect

We collect only the minimum necessary information required to operate, secure, and deliver our digital loyalty platform:

• Account Information: Name, email address, and profile details provided when creating an account or authenticating via identity providers.
• Loyalty & Pass Data: Stamp balances, reward redemption history, merchant identifiers, and digital pass state necessary to issue and synchronize loyalty cards.
• Technical & Usage Data: IP address, device type, operating system, log data, and security tokens to prevent fraud and ensure service uptime.

3. Integration with Google APIs & Services

DownTown integrates with Google Cloud Services to enable account authentication and digital wallet pass generation:

• Google OAuth (Sign-In): When you sign in using Google OAuth, we receive authorized account profile information (such as your name, email address, and profile picture) solely to authenticate your identity, create your account, and secure your session.
• Google Wallet API: We utilize the Google Wallet API to allow users and merchants to issue, save, and update digital loyalty passes directly inside Google Wallet. The data transmitted includes loyalty pass metadata (stamp progress, merchant branding, offer details, and pass IDs).

Specifically, we explicitly adhere to the following Google User Data commitments:

• No Sale of Google User Data: We do not sell, rent, or trade your personal information or Google user data to any third party or data broker.
• No Advertising Misuse: Google user data is never used, transferred, or disclosed for serving personalized, targeted, or retargeted advertisements.
• No AI Model Training: Personal data and Google user data are strictly restricted from being used to train generalized artificial intelligence or machine learning models.
• Limited Sharing: Data obtained via Google APIs is only shared with third-party service providers (such as secure cloud hosting infrastructure) strictly when necessary to provide or improve user-facing features of DownTown.

4. How We Use Your Data

We process personal data strictly for the following operational purposes:

• Provisioning and maintaining merchant dashboards and user loyalty accounts.
• Generating, updating, and synchronizing Google Wallet loyalty passes.
• Verifying account identity and preventing fraudulent activity or pass tampering.
• Providing localized loyalty insights and merchant analytics without selling individual consumer profiles.
• Responding to technical support and user requests.

5. Data Storage, Security & Retention

We implement industry-standard administrative, technical, and physical safeguards—including TLS encryption in transit and AES encryption at rest—to protect your personal information from unauthorized access, alteration, or disclosure.

We retain personal information only for as long as your account remains active or as required to fulfill the operational purposes described in this policy, comply with legal obligations, or resolve dispute proceedings.

6. User Rights & Data Deletion (Right to Erasure)

You have full ownership and control over your personal data. You have the right to access, correct, or request the deletion of your personal data at any time.

How to Request Data Deletion:

• To request full account deletion and erasure of your personal data, send an email to hello@down-town.app with the subject line "Data Deletion Request".
• Upon verification of your identity, we will permanently purge your account data, loyalty history, and technical tokens from our active databases within 30 calendar days.
• Deleting your account will also invalidate connected Google Wallet loyalty passes and halt future pass updates.

7. Third-Party Service Providers

We may engage trusted third-party infrastructure providers (such as cloud database hosts and encryption management services) to support platform operations. All third-party vendors operate under strict data processing agreements and confidentiality obligations consistent with this Privacy Policy and relevant data privacy regulation.

8. Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in our service offerings, legal obligations, or Google API policy requirements. The "Last updated" date at the top of this document indicates when revisions were published.

9. Contact Information

For privacy concerns, data deletion requests, or questions regarding our data practices:

Legal Representative & Controller: Juan David Alba Ramirez (C.C. 1021394042)
Email: hello@down-town.app
Website: down-town.app