Privacy policy
Updated October 23, 2026 · Operated by Trivu, El Salvador1. Google sign in and account closure
Google sign in uses a verified Google subject, email and display name. It never links an existing password account by email alone; linking requires an authenticated password confirmation. OAuth secrets are encrypted on the server. Account closure retains protected records for 90 days and applies explicit deletion review; backups have a separate documented retention policy and may retain historical data until expiration. Payment and audit records are retained for applicable obligations.
2. Who handles your information
Trivu (El Salvador) handles business account information to operate Trivu. For customer membership data, the business whose program you joined decides the purpose and rules, and Trivu processes it to provide the service. Contact that business for program-specific requests; contact hello@trivuapp.com for Trivu account or privacy requests.
3. Information we use
Account name, email, password hash, role, business details and uploaded images; customer name, email, optional phone, identity document number, date of birth and program information; points, purchases recorded by staff, redemptions, visits, consent records and timestamps. Operational records include sessions, audit actions, request limits and service jobs. We do not store raw passwords in exports.
4. Purposes and choices
We use information to authenticate users, provide cards, calculate balances, prevent misuse, support accounts and meet legal obligations. Email confirmation and card delivery are service communications. Marketing is a separate purpose managed by the business and must have an applicable lawful basis. You can ask the business to stop marketing and withdraw consent without affecting rights already earned.
5. Providers and international processing
Hosting infrastructure, and email, payment or Wallet providers when enabled, receive the information needed for their function. Email delivery sends the address and card or confirmation link to the configured email provider. Provider location and transfer safeguards depend on the selected services and applicable law; contact us for the current provider list. We do not sell customer lists.
6. Retention and security
Data is retained while needed to provide the service, resolve requests and meet applicable record-keeping duties. Unconfirmed enrollment requests expire after 24 hours and are removed by scheduled cleanup within the following seven days. Removing a member anonymizes their profile and revokes their cards while preserving transaction and audit records where required. Access is limited by tenant and role. Keep card links private because possession allows viewing the card.
7. Your rights
Depending on applicable law, you may request access, correction, deletion, restriction or portability, object to processing, withdraw consent and complain to your supervisory authority. Send requests to the relevant business or hello@trivuapp.com; we may need to verify your identity. Business administrators can export their own tenant data through Settings.
8. Cookies and updates
Trivu uses session and language cookies and local preferences needed for the account experience. On public pages, registration and the business dashboard, Google Analytics loads only if you accept analytics cookies, to measure visits, sign-ups and purchases; your choice also applies to trivuapp.com and you can change it by clearing it in your browser. Customer cards and private links never load it. A cookieless, self-hosted counter measures aggregate visits. Updates will be dated and material changes communicated. Do not register children without the authorization and safeguards required by applicable law.