Privacy Policy

Last updated: 16 October 2026. Effective immediately.

This Privacy Policy explains how DIGITALIZALIA, SOCIEDAD LIMITADA (trading as Rewer, “we”, “us”) processes personal data when you visit rewer.io, when a business uses the Rewer panel at app.rewer.io (the “Service”), and when an individual creates or uses a loyalty card issued through Rewer by a business. It is written to comply with the EU General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 (LOPDGDD), the UK GDPR, and, to the extent they apply, other privacy laws such as the California Consumer Privacy Act (CCPA/CPRA), the Brazilian LGPD and Swiss data protection law.

1. Who we are and how to contact us

Data controller: DIGITALIZALIA, SOCIEDAD LIMITADA, tax ID (NIF) B13933296, registered at the Registro Mercantil de Ciudad Real (Ciudad Real Companies Registry), registered office at [REGISTERED ADDRESS], Ciudad Real, Spain. For any question or request about personal data write to privacy@rewer.io or hello@rewer.io. We have not appointed a Data Protection Officer because we are not legally required to; the same address reaches the person responsible for privacy.

2. Three situations, three roles

(a) Visitors of rewer.io. We are the controller of the little data the website receives.

(b) Businesses that use the Service. We are the controller of the account, billing and usage data of the business and of the people who represent it.

(c) Customers of those businesses (loyalty cards). The business that issues the card is the controller. Rewer acts as its processor under Article 28 GDPR and processes the customer’s data only on the business’s documented instructions and to provide the Service. If you are such a customer, the business is your first point of contact; we will nonetheless help you exercise your rights and forward your request to the business without delay (see section 9).

3. Data we collect

Website (rewer.io). The website is static. It uses Google Analytics 4 (analytics and, if you accept, personalised advertising) only if you accept cookies in the notice shown on your first visit (see section 10); until then, and if you decline, no such cookie is set and Google receives no identifier that could single you out. The only cookie the site sets by itself is rewer_lang (one year), which remembers the language you pick with the EN/ES switch so the home page opens in that language next time; otherwise the home page is served in Spanish when your browser is set to Spanish. To show prices in your currency (euros in the euro area, pounds in the United Kingdom, US dollars elsewhere) and, as a fallback, to offer the Spanish version to visitors from Spanish-speaking countries, the pricing section asks our own server (app.rewer.io) which country your IP address belongs to; the lookup is done locally on that server with an offline country table, the IP address is not sent to any third party and is not stored for this purpose. Our hosting provider keeps standard server logs (IP address, date and time, requested URL, user agent) for security and abuse prevention, retained for a limited period. If you email us, we keep your message and address to reply.

Business account. Business name, type and stores; name, email address and password (stored as a one-way hash) of the account holder and of any team member invited; the Google account identifier, name and profile picture if you sign in with Google; language and settings; the cards, rewards, notifications and campaigns you configure; the reviews and replies synchronised from your Google Business Profile if you link it; billing status and invoices. Card payments are processed by Stripe; we never receive or store full card numbers. We also keep technical logs of the panel (IP address, timestamps, actions) for security.

Customers’ loyalty cards (processed on behalf of the business). The data the customer chooses to provide when creating the card: name, email address and/or mobile number, preferred language and, optionally, birthday (day and month), postal code and preferences the business asks about; the visits recorded at the counter, stamps, points, balances and rewards redeemed; answers to the post-visit survey and private feedback; whether a review request was sent and opened; email open and click events; and, if the customer adds the card to Apple Wallet or Google Wallet, the technical identifiers those services need to deliver updates to the pass. If the customer signs up with Google, we receive the name, email address and profile picture from the Google account, and—only if the customer expressly grants it—the birthday held in the Google account.

We do not knowingly collect special categories of data (health, religion, etc.) and we do not knowingly collect data from children under 16. If you believe a child has provided data, contact us and we will delete it.

4. Why we use the data and on what legal basis

To provide the Service and the loyalty cards (create accounts, issue and update cards and passes, record visits, calculate rewards, send the notifications the business configures, ask for reviews, show statistics): performance of a contract (Art. 6(1)(b) GDPR) with the business; for customers, the business’s contract with the customer and, for email or push communications, the customer’s consent given when creating the card and revocable at any time.

To bill and keep accounts: performance of a contract and compliance with legal obligations (tax and accounting law, Art. 6(1)(c)).

To keep the Service secure, prevent abuse and fraud, and improve it using aggregated usage data: our legitimate interests (Art. 6(1)(f)), balanced against your rights; you may object at any time.

To send product and service messages to businesses (important changes, security notices, onboarding tips): legitimate interest and, where required, consent; every marketing message includes an unsubscribe link.

To draft replies to reviews and the text of notifications with artificial intelligence: performance of the contract with the business. Only the text needed for the draft (the review, the business name and tone, the goal of the message) is sent to the AI provider; the customer database is never shared, and the business always reviews and approves what is published.

We do not sell personal data and we do not use it for our own advertising. We do not make automated decisions with legal or similarly significant effects.

5. Who receives the data

We share personal data only with providers that help us run the Service, under written contracts that bind them to confidentiality, security and the instructions required by Article 28 GDPR:

hosting and email infrastructure (servers located in the European Union); Stripe for payments; Google (Google Sign-In, Google Business Profile, Google Wallet, Google People API when the customer opts in); Apple (Apple Wallet); an AI language-model provider for drafting text as described in section 4; and professional advisers (accountants, lawyers) where necessary. We may also disclose data when required by law, a court order or a competent authority, or to protect our rights, our users or the public. If Rewer is involved in a merger, acquisition or asset sale, data may be transferred to the successor under this Policy.

A current list of sub-processors is available on request at privacy@rewer.io. Businesses will be informed of changes to sub-processors and may object on reasonable grounds.

6. International transfers

Our servers are in the European Union. Some providers (for example Stripe, Google, Apple and the AI provider) may process data in the United States or other countries. Where that happens we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework where the provider is certified), on the Standard Contractual Clauses approved by the European Commission, and on additional safeguards where needed. For the UK, we rely on the UK International Data Transfer Addendum. You can request a copy of the relevant safeguards.

7. How long we keep data

Business accounts: for the life of the account and up to 12 months after closure, except invoices and accounting records, which Spanish law obliges us to keep for 6 years (and tax records for 4 years). Customer cards: for as long as the business keeps the customer in its programme; customers can delete their card and data themselves at any time from the card, and businesses can delete customers from the panel. When a business closes its account, its customers’ data is deleted within 30 days unless the business exports it first. Server logs: up to 12 months. Emails: for as long as needed to handle the request. Backups are overwritten on a rolling basis within 35 days.

8. Security

All connections use HTTPS. Passwords are stored using strong one-way hashing. API keys, OAuth tokens and other credentials are stored encrypted. Each business can only access its own data. Access by our staff is limited to what is necessary to operate and support the Service. Backups are taken daily. No system is completely secure; if a personal data breach occurs that is likely to result in a risk to you, we will notify the competent authority and the affected persons as the law requires.

9. Your rights

Depending on where you live, you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, to withdraw consent at any time (without affecting prior processing), and not to be subject to solely automated decisions. Residents of California and certain other US states also have the right to know, delete and correct their personal information, to opt out of “sale” or “sharing” (we do neither) and not to be discriminated against for exercising their rights. To exercise any right, write to privacy@rewer.io from the address linked to your account or card, or use the options inside your loyalty card. We may ask for information to verify your identity and will respond within one month (extendable where the law allows). Customers of a business may also contact the business directly; we will help it respond.

You can lodge a complaint with a supervisory authority, in particular the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or the authority of the EU/EEA country where you live or work, or the UK Information Commissioner’s Office.

10. Cookies and similar technologies

Analytics and advertising cookies (optional). rewer.io uses Google Analytics 4 (Google Ireland Ltd.) to understand how the site is used (pages visited, country, device, how you arrived) and, with Google signals enabled, to show you personalised advertising for Rewer on Google services based on a profile built from your browsing habits (for example, pages visited). It runs in Google Consent Mode v2: these cookies (_ga, _ga_*, up to 2 years, plus Google’s advertising cookies) are set only after you press “Accept” in the notice shown on your first visit; if you press “Decline”, or do nothing, no such cookie is stored and only aggregated, cookieless measurement without any identifier takes place. Your choice is kept in your browser’s local storage for one year and you can change it at any time from the “Cookies” link in the footer. IP addresses are truncated by Google. See how Google uses data from sites that use its services.

Strictly necessary. Apart from that, rewer.io uses at most one strictly necessary cookie, rewer_lang, which stores the language you chose (“en” or “es”, nothing else) for one year. The business panel and the customer card pages use only strictly necessary cookies: a session cookie to keep you signed in, a security (CSRF) token, a cookie remembering the language you chose and, on the customer’s device, a cookie that remembers which card belongs to that browser. These cookies do not track you across other sites and do not require consent under Article 22.2 of the Spanish LSSI and the ePrivacy Directive. The panel stores no third-party advertising or analytics cookies.

11. Chrome extension “Local Business Reviews”

Local Business Reviews is a free browser extension published by Rewer that adds a “Reply with AI” button next to the reviews of your Google Business Profile. It has no user accounts and no servers of its own, and this section describes everything it does with data.

Data stored in your browser. The settings you enter (AI provider, API key, model, business name, signature, language, tone and prompt) are stored in chrome.storage.sync, which lives in your browser and, if you have Chrome sync enabled, is synchronised by Google with your Chrome account. Rewer never receives them.

Data sent to your AI provider. When you press “Reply with AI”, the text of that review (author name, star rating, date and content) is sent, together with your prompt and settings, directly from your browser to the provider you configured (OpenAI, Google or Anthropic) using your own API key and under that provider's terms and privacy policy. Nothing is sent to Rewer.

No collection, no tracking. The extension does not collect, store, sell or transmit any personal data to Rewer or to anyone other than the provider you chose. It contains no analytics and no remote code. Links to rewer.io include a “ref=ext” parameter so we know a visit came from the extension; once on rewer.io, the cookie rules in section 10 apply.

Permissions. The extension asks for access to google.com, business.google.com, search.google.com and maps.google.com only to detect the reviews you manage and add the button; and to the API domains of OpenAI, Google Gemini and Anthropic only to send your requests. It cannot publish a reply: publishing is always Google's own button.

Deleting your data. Clear the fields in the extension's settings or uninstall the extension: everything it stored is removed from your browser. For anything sent to your AI provider, their retention rules apply.

12. Changes to this Policy

We may update this Policy to reflect changes in the Service or in the law. The date at the top tells you when it was last revised. For material changes affecting businesses we will give notice in the panel or by email at least 15 days before they take effect.