Privacy Policy and Terms of Use

1. Who operates the platform

"TBP", "we" or "the Company" operates Sella (sellapp.com.co, the business dashboard, the customer sign-up pages and the related digital passes; the "Platform"). This document is issued under Colombian data-protection law (Law 1581 of 2012 and related regulations). For users outside Colombia, applicable local privacy laws also apply where relevant. In case of discrepancy, the Spanish version prevails.

2. Definitions

• Business: a person or company that creates a Sella account to offer a loyalty program (including shopping centers, associations and their member stores).
• Customer: a person who gets a stamp card, passport or shopping-center card by scanning a Business's QR code.
• Cashier: a person authorized by a Business to record stamps and redeem rewards from Register mode.
• Reward: any product, service, discount, gift, access or advantage a Business promises its customers through the Platform.

By creating a Business account, signing up as a Customer, using Register mode or browsing the Platform, you accept this document.

3. Our role regarding personal data

1. Customer data (name, mobile, birthday, stamps, visits): the Business is the data controller, since it decides why the data is used (its loyalty program, its promotions). TBP acts as a data processor on the Business's behalf and under its instructions, for the purposes built into the Platform, and gives the Business the tools to honor its customers' rights. Each Business is responsible for obtaining its customers' consent and for lawful use of the data.
2. Business and Cashier account data (name, email, billing details) and technical usage data: TBP is the controller.

When a Business belongs to a shopping center within Sella, the shopping center receives only aggregated, anonymous information (visit counts, stores visited, hours, cross-visits). No Business ever sees another Business's customer contact details.

4. Data we process

• Customers: first and last name, mobile number with country code, birthday; email and gender are optional; gender is only used for the Business's aggregated statistics. Program data: business and location where the card was created, stamps, date and time of each stamp and redemption, rewards delivered, shopping-center tier, passports and progress. Technical data: anonymous session identifier, language, and whether the pass was saved to Google Wallet. We do not access device location or contacts.
• Businesses and Cashiers: business name, sign-in email, password (hashed, never visible to us) or Google sign-in, country and time zone, uploaded logos and images; billing details for the plan; activity data (stamps, redemptions, promotions, statistics). Card payments are processed by the payment gateway; we never store card numbers.
• Technical: IP address, browser type and access logs for security and fraud prevention. We use browser local storage for preferences and session; we don't store the sign-up form's personal data on the device. On our website we use the Google Ads tag to measure our ad campaigns only if you accept cookies in the notice shown on entry.

5. Purposes

• Creating and operating stamp cards, passports and shopping-center cards; recording stamps; validating redemptions; showing Customers their progress.
• Issuing and updating the pass in the Customer's digital wallet (Google Wallet on Android, Apple Wallet on iPhone), including pass notifications. For Apple Wallet, the device registers with Sella using an anonymous identifier used only to tell it the pass changed.
• Sending, on the Business's behalf, automatic alerts (new stamp, reward ready, one stamp to go, birthday, we-miss-you) and promotions to that Business's customers, within the frequency limits set by the Platform.
• Bring a friend (if the Business turns it on): each customer's card carries an invite link with a random code that does not reveal their identity. If a friend signs up with that link, Sella records who invited whom to deliver the free stamp, and the inviter is only shown the friend's first name in their wallet notice.
• Providing the Business with its customer list (name, birthday, tier and activity in its program) and statistics; the Customer's mobile number and email are held by TBP and used only to run the program, send wallet notifications and honor the data subject's rights. The shopping center receives aggregated statistics only.
• Managing accounts, cashiers, plans, payments and invoicing; support.
• Security, fraud and abuse prevention, legal compliance and responding to lawful requests from authorities.
• Improving the Platform using aggregated, anonymous information.

6. Sharing

We do not sell, rent or trade personal data. We share data only with: the Business a Customer signed up with (name, birthday, tier and activity in that Business's own program; not the mobile number or email, and messages from the Business reach the customer through the Platform); the shopping center a Business belongs to (aggregated data only); Google LLC (Firebase infrastructure, App Check/reCAPTCHA, Google Wallet) under the Google Privacy Policy; Apple Inc. (Apple Wallet: issuing and updating passes on iPhone, including pass notifications) under the Apple Privacy Policy; ePayco S.A.S. (Colombian payment gateway) to process Business plan payments by card, PSE or Nequi; it receives the payment details you enter in its checkout, which Sella never sees or stores; Alegra (Soluciones Alegra S.A.S.) to issue the plan's electronic invoice with the Business's billing data; Anthropic PBC for the dashboard's AI features, receiving only aggregated program statistics and the profile the Business writes about itself (goal, slow days, tone, star product and promotion limits), never customers' name, mobile, email or birthday; goQR.me (api.qrserver.com) to render some QR images, receiving only the public web address; Google Ads, on our website only and only with your consent; and authorities when legally required. Google may store and process data in the United States or other countries; by accepting this policy you consent to that international transfer.

7. Security

All traffic is encrypted (HTTPS/TLS). Stamps, redemptions, plan changes and other sensitive operations are validated on our servers, not on the user's device. Access rules prevent any user from reading or modifying data that is not theirs; cashiers can only record stamps and redemptions. Third-party credentials are stored in a secrets manager. We keep daily backups with limited retention. No system is infallible: if we detect a security incident affecting personal data, we will notify affected individuals and the competent authority as required by law.

8. Retention and deletion

Customer data is kept while the Customer has a card at any Business; a Business can delete a customer from its program from the dashboard. Business data is kept while the account is active; a Business may request deletion of its account, which permanently removes its business, cards, customers, history, cashiers and images. Backups are purged within 30 days after production deletion. Billing and transaction records are kept for the periods required by Colombian accounting and tax law.

9. Your rights

You may access, update, correct and delete your data, request proof of consent, be informed about how your data is used, withdraw consent where no legal or contractual duty to retain exists, and file complaints with the Colombian Superintendence of Industry and Commerce (SIC). Customers may contact the Business they signed up with (the controller) or write to us at admin@tbpconsulting.com.co stating the registered mobile number and the Business name. Businesses and Cashiers write to the same address from the registered email. Queries are answered within 10 business days and complaints within 15 business days, extendable as permitted by law. We may request additional information to verify identity. Residents of other jurisdictions (for example, California or the European Union) may exercise the rights granted by their local laws through the same address.

10. Minors

The Platform is intended for adults. We do not knowingly collect data from children under 14; minors between 14 and 18 are deemed to act with their legal guardian's authorization. A guardian may request deletion through the channels above.

11. Terms of use

11.1 Purpose

TBP provides Businesses with a technology tool to run digital loyalty programs and communicate with their customers. TBP does not sell products or services to Customers and is not a party to the commercial relationship between a Business and its customers.

11.2 Accounts and credentials

The Business is responsible for the accuracy of its account information, for safeguarding its credentials and those of the cashiers it creates, and for everything done through them. Unauthorized use must be reported to us immediately.

11.3 Business obligations

• Obtain its customers' consent and use their data solely for its loyalty program, in line with this policy and the law.
• Honor the rewards, promotions and perks it announces through the Platform, as announced.
• Not send promotions that are illegal, misleading, offensive, discriminatory or unrelated to its activity, nor use the Platform for purposes other than building loyalty among its own customers.
• Not manipulate stamps or redemptions or attempt to bypass the Platform's controls.
• Pay for the contracted plan on time.

11.4 Plans, payments and renewal

Plans, limits and prices are those published at sellapp.com.co and in the dashboard. Paid plans activate when payment is confirmed for the contracted period and do not auto-renew unless the Business opts in; on expiry without renewal the account returns to the free plan and keeps its data. No pro-rated refunds are made for unused periods unless required by law. We may change prices with at least 30 days' notice, effective from the next renewal.

11.5 Availability

The Platform is provided "as is" and "as available". We make reasonable efforts to keep it running but do not guarantee uninterrupted availability. Features that depend on third parties (Google Wallet, Apple Wallet, payment gateways, mobile networks) may be affected by changes or failures outside our control.

11.6 Intellectual property

The Sella brand, software, design and content belong to TBP or its licensors. The Business retains ownership of its brands, logos and images and grants us a limited license to display them on passes, in the dashboard and in the print kit while it uses the Platform.

11.7 Suspension and termination

We may suspend or terminate an account, with or without notice, for fraud, abuse, unlawful use, breach of these terms or non-payment. A Business may cancel its account at any time. Termination does not waive amounts already due.

12. Rewards, promotions and perks

Messages such as "Reward ready" are shown based on the Business's configuration and the stamps recorded; they do not create any obligation on TBP.

13. Limitation of liability

To the fullest extent permitted by law, TBP is not liable for indirect damages, loss of profits, loss of customers, data loss caused by third parties or by the user, or losses arising from use of or inability to use the Platform, from a Business's configuration errors, from stamps granted or refused by cashiers, or from the relationship between a Business and its customers. TBP's total liability to a Business for any cause is limited to the amounts actually paid by that Business to TBP in the three (3) months preceding the event giving rise to the claim. Nothing herein limits liability that cannot be limited by law.

14. Changes

We may update this policy and these terms. The current version and its date are published on this page; material changes are announced in the Business dashboard. Continued use of the Platform after a change constitutes acceptance.

15. Governing law

This document is governed by the laws of the Republic of Colombia. Disputes are subject to the competent courts of Bogotá D.C., without prejudice to non-waivable consumer rights in the user's place of residence.

16. Contact