DealNoty Privacy Policy

When this Policy uses the term "the merchant", it refers to the natural or legal person who registers with DealNoty to keep the records of their business. When it uses "the merchant’s customer" or "their customers", it refers to the natural persons about whom the merchant records information within DealNoty.

• the DealNoty mobile application for iOS and Android;
• the website https://dealnoty.com (the "Site");
• the public account-deletion page available at https://dealnoty.com/delete-account and its localized variants;
• the synchronization, storage, support and customer-care services associated with the above.

DealNoty is not directed at minors. The Service is intended for adult merchants. We do not knowingly collect personal data from minors. If you believe we have received data from a minor, please write to the privacy address listed in the "Contact" section so that we may delete it.

Merchant account data and device data. DealNoty acts as data controller. DealNoty determines the purposes and means of the processing of this data. This category includes the merchant’s email address, password, name, account identifier, device identifier, device data and the payment information derived from the app store.

Data the merchant records about customers. DealNoty acts as data processor. The merchant is the controller: the merchant decides what data is recorded, on what legal basis, and who responds to the customer when the customer requests the exercise of rights. DealNoty processes this data only on behalf of the merchant, in accordance with the purposes of the Service described in this Policy and in the Terms and Conditions.

DealNoty processes the personal data described in section 4 for the following purposes:

• Provision of the Service. Creating and maintaining the merchant account, authenticating the user, synchronizing data across linked devices, storing the merchant’s notes, sales, products, customers and other records, enabling data export and responding to support requests.
• Security and fraud prevention. Verifying the merchant’s identity on sensitive operations (password change, account recovery, account deletion, sign-in from a new device), detecting unauthorized access, notifying the merchant of sensitive activity in their account, and protecting the infrastructure.
• User care and support. Responding to the merchant’s queries and requests, diagnosing and resolving technical issues, and managing post-deletion feedback when the merchant voluntarily provides it.
• Compliance with legal obligations. Retaining data that applicable laws require us to retain, and responding to lawful requests from competent authorities.
• Improvement of the Service. Analysing errors and operational metrics from the crash reports sent to Sentry, in order to detect and fix application defects.

DealNoty does not use personal data for marketing, advertising, profiling, data sale or any other commercial purpose beyond those listed above.

DealNoty processes personal data on the following legal bases, as applicable:

• Performance of the contract for the provision of the Service entered into with the merchant upon acceptance of the Terms and Conditions. This basis covers the processing of account data, synchronization across devices, subscription billing through the app store, and user support.
• Legitimate interest of DealNoty in maintaining the security of the platform, preventing fraud, detecting and correcting errors, and protecting the integrity of the Service. This legitimate interest is balanced on a case-by-case basis and, where appropriate, measures are applied to minimise the impact on the privacy of the merchant and their customers.
• Consent where required, particularly for processing that is not necessary for the performance of the contract. When consent is required, DealNoty will request it in advance, in a specific and informed manner, and the merchant may revoke it at any time without affecting the lawfulness of the prior processing.
• Compliance with legal obligations when an applicable law requires DealNoty to retain or disclose certain data, or to respond to requests from competent authorities.

For the specific case of data the merchant records about customers, the legal basis for the processing must be determined by the merchant themselves, in their capacity as controller. DealNoty, as data processor, processes this data only on behalf of the merchant and in accordance with the instructions the Service enables the merchant to give.

• The merchant may request deletion at any time from within the mobile application or by visiting https://dealnoty.com/delete-account (or its localized variants).
• The process requires the account password and a one-time eight (8) digit code sent to the associated email, with a five (5) minute lifetime.
• If the account was created only with Google and no password was ever set, DealNoty will ask the merchant to set a password from within the mobile application before continuing.
• After confirmation, DealNoty performs the destruction of the data in a single transactional operation, retains the amounts, dates, quantities and statuses of the sales notes in anonymised form, and retains the records of linked devices marked as revoked until the other devices receive the deletion notification.

Some of the service providers listed in the "Third-party service providers" section may process personal data in countries other than the merchant’s country of residence. In particular, diagnostic reports from the mobile application are sent to Sentry, transactional emails are sent through Resend, the perimeter network infrastructure relies on Cloudflare, and when the merchant uses Google Sign-In, validation of the "id_token" takes place against Google services — all of which may process data in the United States of America or other regions.

These transfers are carried out under the safeguards required by applicable law. Where the law so requires, DealNoty will enter into the agreements and, where applicable, the standard contractual clauses necessary to guarantee a level of protection equivalent to that required by the law of the merchant’s country of residence.

DealNoty shares personal data with the following service providers, to the extent necessary for the provision of the Service:

• Sentry (Functional Software, Inc., United States of America). Error monitoring service. DealNoty configures Sentry not to include personally identifiable data in the reports.
• Resend (Resend, Inc., United States of America). Transactional email service (verification codes, security alerts, deletion confirmation).
• Cloudflare (Cloudflare, Inc., United States of America). Content delivery network and perimeter protection service.
• Google (Google LLC, United States of America). Authentication service, used only when the merchant chooses to sign in with Google. DealNoty receives from Google a single-use "id_token" and a public account identifier.
• Apple and Google, regarding subscription billing through the App Store and Google Play, respectively.

DealNoty does not sell personal data, does not disclose it to third parties for their own purposes, does not use it for targeted advertising, and does not build profiles for commercial purposes.

The merchant may exercise, in the terms provided by applicable law, the rights described below. To do so, write to the privacy address listed in the "Contact" section. DealNoty will respond within the time limits set by applicable law and, where appropriate, will request additional information needed to confirm the requester’s identity.

• Access. Obtain confirmation of whether DealNoty processes the merchant’s personal data and, if so, access that data.
• Rectification. Request the correction of inaccurate or incomplete personal data.
• Cancellation or erasure. Request the erasure of personal data, on the terms described in section 12.
• Objection to processing. Object to processing based on legitimate interest, on grounds relating to the merchant’s particular situation.
• Restriction of processing. Request the restriction of processing in the cases provided by law.
• Portability. Receive the personal data the merchant has provided to DealNoty, in a structured, commonly used and machine-readable format, and transmit it to another controller where technically possible.
• Withdrawal of consent. Withdraw any consent given, where the processing is based on consent, without affecting the lawfulness of the prior processing.
• Complaint to the supervisory authority. File a complaint with the data-protection authority competent in the merchant’s jurisdiction.

For merchants resident in Mexico, these rights correspond to the ARCO rights (Access, Rectification, Cancellation and Opposition) provided by the Federal Law on Protection of Personal Data Held by Private Parties and its Regulations. The data controller is the entity identified in the "Contact" section, and the department in charge of responding to requests is reachable through the privacy address listed in that same section.

DealNoty processes the personal data the merchant records about their customers in the capacity of data processor. The merchant is responsible for:

• Obtaining, where applicable, the consent or relying on the appropriate legal basis for processing their customers’ data.
• Informing their customers about the processing of their personal data in the terms required by applicable law.
• Responding to their customers’ requests regarding the exercise of rights over their personal data.
• Not using the Service to process special categories of data (for example, health data, data on religious or philosophical beliefs, data on sexual orientation, biometric data, data of minors) for which the Service is not designed.

DealNoty provides the merchant, from within the application, with the tools necessary to access, correct, export and delete the data of each of their customers, so that the merchant can respond to their customers’ requests without needing to contact DealNoty.

DealNoty is not directed at minors and is not designed to process the personal data of minors. DealNoty does not knowingly collect personal data from minors. If the operator of the Service identifies that data of a minor has been registered, it will be deleted. If you believe we have received personal data of a minor, please write to the privacy address listed in the "Contact" section.

The Site https://dealnoty.com does not use tracking cookies, does not use tracking pixels, does not integrate web analytics services and does not include third-party content that can track the visitor. The Site only uses the browser’s local storage to remember the visitor’s language preference and theme preference (light or dark). This local storage is not transmitted to DealNoty or to third parties.

To the extent that the Site incorporates cookies or tracking technologies in the future, DealNoty will update this section and, where required by applicable law, will request the visitor’s prior consent.

DealNoty may modify this Privacy Policy to reflect, among other things, changes in the Service, in applicable law or in industry practices. Where the changes are material, DealNoty will notify the merchant through the available contact channels, with reasonable advance notice before the changes take effect. The updated version will indicate the date of its last update at the top of this document.

The merchant is deemed to accept the modified Privacy Policy if they continue to use the Service after the effective date of the updated version. If the merchant does not agree with the changes, they may request the deletion of their account on the terms described in this Policy.

For any matter relating to this Privacy Policy, the processing of your personal data or the exercise of your rights, you can contact DealNoty at:

• Privacy and support email: support@dealnoty.com
• Business inquiries email: hello@dealnoty.com

• Data controller: Edain Jesús Cortez Cerón
• Country of operation: México

For security matters, please use the support channel and include the word "Security" in the subject line.