Back to Home

    Privacy Policy

    Last updated: July 2026

    1. Introduction

    Guarapo Media LLC (“we,” “us,” or “our”) operates Wantap, a digital loyalty card platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services. We are committed to protecting your privacy and complying with applicable data protection laws including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA/CPRA), and other regional privacy regulations.

    2. Data Controller & Processor

    For End Customers: When you join a business’s loyalty program through Wantap, the business is the Data Controller and Guarapo Media LLC acts as a Data Processor on their behalf.

    For Business Users: Guarapo Media LLC is the Data Controller for your account information and platform usage data.

    Contact: Guarapo Media LLC, privacy@wantap.co

    Registered address: Guarapo Media LLC, 3050 La Spezia Cir, Apt 343, Kissimmee, FL 34741-1165, United States

    3. Information We Collect

    We collect the following categories of personal information:

    A. Information You Provide

    • Identifiers: Name, email address, phone number (optional)
    • Account Information: Login credentials, profile settings
    • Commercial Information: Points earned, rewards redeemed, transaction history
    • Demographic Data: Date of birth (optional, for age verification)

    B. Information Collected Automatically

    • Device Information: Browser type, operating system, device identifiers
    • Usage Data: Pages visited, features used, timestamps
    • Log Data: IP address, access times, referring URLs

    4. Legal Basis for Processing (GDPR)

    We process your personal data under the following legal bases:

    • Contract Performance: To provide loyalty program services you’ve requested
    • Legitimate Interests: To improve our services, prevent fraud, and ensure security
    • Consent: For marketing communications and optional data collection
    • Legal Obligation: To comply with applicable laws and regulations

    5. How We Use Your Information

    • Manage your loyalty card and track points
    • Process reward redemptions
    • Send transactional notifications about your rewards
    • Send marketing communications (with your consent)
    • Improve and personalize our services
    • Prevent fraud and ensure platform security
    • Comply with legal obligations

    6. Data Sharing & Third Parties

    We may share your information with:

    • Business Partners: The businesses whose loyalty programs you join (as their customers)
    • Service Providers: Supabase (database hosting), Vercel (web hosting), and other infrastructure providers who process data on our behalf
    • Legal Requirements: When required by law, court order, or governmental authority

    We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising as defined by the CCPA/CPRA and other U.S. state privacy laws.

    7. International Data Transfers

    Your data may be transferred to and processed in the United States and other countries where our service providers operate. For transfers from the EEA, UK, or Switzerland, we rely on:

    • Standard Contractual Clauses approved by the European Commission
    • Data processing agreements with our service providers
    • Your explicit consent where applicable

    8. Data Retention

    We retain your personal data for:

    • Active Accounts: As long as your account is active and for 2 years after closure
    • Transaction Records: 7 years for tax and legal compliance purposes
    • Marketing Preferences: Until you withdraw consent

    9. Your Privacy Rights

    A. Rights for All Users

    • Access: Request a copy of your personal data
    • Correction: Request correction of inaccurate data
    • Deletion: Request deletion of your data
    • Opt-Out: Unsubscribe from marketing communications

    B. Additional Rights (GDPR - EU/EEA/UK)

    • Portability: Receive your data in a portable format
    • Restriction: Request restricted processing
    • Object: Object to processing based on legitimate interests
    • Withdraw Consent: Withdraw consent at any time
    • Lodge Complaint: File a complaint with your supervisory authority

    C. United States State Privacy Rights (California and Other States)

    Residents of California (CCPA/CPRA) and of other states with comprehensive privacy laws (including Texas, Colorado, Connecticut, Virginia, Oregon, Montana, and others) have additional rights:

    • Right to Know: Categories and specific pieces of personal information collected
    • Right to Correct: Request correction of inaccurate personal information
    • Right to Delete: Request deletion of personal information
    • Right to Opt-Out: We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of; if that ever changes, we will provide a “Do Not Sell or Share My Personal Information” link first
    • Non-Discrimination: Exercise rights without discriminatory treatment

    We honor Global Privacy Control (GPC) and similar universal opt-out signals. Because our analytics cookies are opt-in by default, browsers sending a GPC signal are never tracked unless you explicitly accept cookies, and GPC signals are treated as a valid opt-out of any “sale” or “sharing” of personal information.

    D. Latin America

    We comply with the data protection laws of the Latin American countries where our users are located:

    • Mexico (LFPDPPP, 2025): This policy serves as our privacy notice (aviso de privacidad). You may exercise your rights of Access, Rectification, Cancellation, and Opposition (ARCO), limit the use or disclosure of your data, and oppose decisions made solely by automated means, by writing to privacy@wantap.co. We will respond within 20 business days. If unsatisfied, you may complain to the Secretaría Anticorrupción y Buen Gobierno.
    • Brazil (LGPD): You have the rights to confirmation of processing, access, correction, anonymization, portability, deletion, and information about sharing and about the consequences of refusing consent. Our data protection officer (encarregado) can be reached at privacy@wantap.co. You may also lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).
    • Argentina (Law 25,326): You may exercise your rights of access, rectification, and deletion free of charge at intervals of no less than six months. The Agencia de Acceso a la Información Pública (AAIP) is the supervisory authority for data protection claims.
    • Chile (Law 21,719): From December 2026, Chilean users will have expanded rights of access, rectification, deletion, opposition, and portability under Chile's new data protection law, which we are prepared to honor.

    E. Asia-Pacific Users

    Users in Singapore, Japan, South Korea, and other Asia-Pacific jurisdictions may have additional rights under local data protection laws. We comply with applicable regulations including PDPA (Singapore), APPI (Japan), and PIPA (South Korea).

    10. Automated Decision-Making & Profiling

    We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects on you. Loyalty points and rewards are calculated by deterministic rules configured by each business (for example, one point per visit) — no profiling, scoring, or machine-learning models are applied to your personal data. If we ever introduce such processing, we will update this policy and, where required, request your consent first. Our services also do not include artificial-intelligence systems that interact with you or generate content, as covered by the EU Artificial Intelligence Act.

    11. Cookies & Tracking

    We use essential cookies to keep the site working (session, language, and your cookie choice) and, only with your consent, analytics cookies from Google Analytics and PostHog to understand how the site is used. We do not use advertising cookies. You can accept or reject analytics cookies in the consent banner, change your choice at any time via “Cookie settings” in the footer, and read the full list in our Cookie Policy.

    12. Data Security

    We implement industry-standard security measures including:

    • Encryption in transit (TLS/SSL) and at rest
    • Access controls and authentication
    • Regular security assessments
    • Incident response procedures

    13. Children’s Privacy

    Our services require users to be at least 14 years old, and we verify this when a date of birth is provided. We do not knowingly collect personal information from children below this age (or below 16 in the EEA where that higher threshold applies without parental consent). If you believe we have collected information from a child, please contact us immediately.

    14. Changes to This Policy

    We may update this Privacy Policy periodically. We will notify you of material changes by posting the new policy on this page and updating the “Last updated” date. Continued use of our services after changes constitutes acceptance of the updated policy.

    15. Contact Us

    For privacy-related inquiries or to exercise your rights:

    • Email: privacy@wantap.co
    • Privacy Officer / LGPD Encarregado: privacy@wantap.co
    • Company: Guarapo Media LLC

    We will respond to requests within 30 days (or as required by applicable law).