Privacy policy

Mesa is a project of Tecnología Jibara and Seis Cero Tres / 603 Media Point. Mesa is operated by Juan Acevedo, who is responsible for your data. If a company takes over operating Mesa, we'll update this page to say which one.

For any privacy question, write to paluco@jibaro.tech.

This policy applies to three groups of people:

• Customers: people who join the loyalty program of a business that uses Mesa.
• Owners and managers: people who run the business's program over WhatsApp.
• Staff: people who stamp cards at the counter.

The customer list belongs to the business, not to Mesa. Each business owns its customers' data and can ask for a copy at any time. Mesa stores and uses it on the business's behalf, only to run its program.

If you're a customer, the business where you have your card is your first contact for anything about your data. You can also write to us directly.

When you join a business's program, we store:

• Your name and your mobile number. The number keeps you from having duplicate cards at the same business and lets staff find you if you don't have your phone with you.
• Your birthday month, if you choose to give it. Only the month, never the day or year.
• Your preferred language (Spanish or English).
• Your visits: every stamp, reward or offer you redeem, with the date and time, which staff member recorded it, and whether it was in the store or on a home delivery.
• Your card: whether it's in Apple Wallet, Google Wallet or the web version, a random serial number, and whether it's active or you removed it. For Apple Wallet we also store the identifier your phone gives us to send it card updates.
• The offers and campaign notifications the business has sent to your card.
• The privacy notice you accepted when you joined (and, if it applies, your permission to receive campaign notifications), with the version of the text and the date.

We don't ask for your email, address, full date of birth or payment details. Mesa doesn't receive your location. The QR code on your card carries only a random serial number, never your phone.

• To create your card and keep it up to date with your stamps, rewards and offers.
• So the business's staff can stamp your card and redeem your rewards. When they scan your card, they see your first name, your stamps and the rewards or offers you have available.
• So the business can send campaigns to your card, always with the owner's approval (the limits are explained below).
• To give the business reports on its program, such as how many people joined or how many came back. These numbers come from recorded visits.
• So the business can download its customer list when it asks for it.
• If the business turns on birthday offers, to send you an offer in your month.

We don't sell your data, we don't use it for ads, and we don't share it between businesses. If you join two businesses that use Mesa, each one has its own record and they are never combined.

Mesa doesn't send you text messages (SMS), WhatsApp messages, emails or calls. The only thing you receive is updates to your card in Apple Wallet or Google Wallet: your stamps, your rewards, offers and the business's campaign notifications.

• No campaign goes out unless the business owner approves that specific campaign. The only exception is automatic birthday offers, if the owner turns them on.
• By default, you get at most one campaign notification a day, and each business can send at most four campaigns a month.
• Campaigns only go out between 8:00 a.m. and 9:00 p.m., Puerto Rico time. A business that opens earlier can start earlier, but never before 6:00 a.m.
• If you remove the card from your wallet, Mesa stops sending it updates. You can also turn off notifications for that card in your Apple Wallet or Google Wallet settings.

To give you access to Mesa we receive and store:

• Your phone number, your name, your role (owner, manager or staff) and the business you belong to.
• Your messages with the Mesa assistant on WhatsApp: texts, voice notes and the buttons you tap, plus what WhatsApp sends us with each message, such as your number and profile name.
• The campaigns the assistant drafts with you, and who approved or cancelled them and when.
• The business information you give us (hours, products, style) and notes the assistant keeps about the business to do its job better.
• Temporary records of the approval cards we send you on WhatsApp, for up to 7 days, so a button can only approve the campaign it showed you.
• If you're staff: you sign in to the scanner with your number and a one-time code we send you on WhatsApp. Your session stays saved on your phone so you don't have to sign in every time. Every visit you record is linked to your profile.
• A history of important actions (customer list downloads, staff changes, program changes) and each business's usage (how many messages and notifications were sent and what the assistant cost).

We use this data to recognize you when you write, know which business you belong to, answer you, prepare and send the campaigns you approve, give you reports and protect the account. If your number isn't registered with a business, the assistant gives you access to nothing.

On WhatsApp we only write to you about running the program: replies to your messages, codes to sign in to the scanner, and business notices such as the weekly summary. We never send you SMS.

The messages owners and managers write to Mesa are processed by an artificial intelligence model (Anthropic's Claude models, through Vercel AI Gateway). To answer you, the model receives your message and the business information it needs: the profile, the program, statistics from the last few weeks, the saved notes and, sometimes, the first names of some customers.

• The assistant drafts campaigns, but never sends anything to customers on its own. Every campaign needs the owner to tap "Confirmar" (Confirm) on that campaign. Typing "yes" doesn't approve it.
• Sending limits, allowed hours and content rules (no health or weight-loss claims, no business-opportunity or recruiting offers) are enforced by Mesa's system, not just by the model.
• The numbers the assistant gives you come from recorded visits. If something is an estimate, it says so.
• Mesa doesn't train artificial intelligence models with your data. The AI providers we use don't use your data to train their models either.

The business's customers don't talk to the assistant.

To work, Mesa uses these providers. Each one only gets what it needs for its part:

• Meta (WhatsApp Business Cloud API): the messages between Mesa and owners, managers and staff, and the codes to sign in to the scanner. Using WhatsApp is also subject to WhatsApp's policies.
• Vercel: hosts Mesa's pages, server and assistant, and stores their technical logs and the assistant's work history. Vercel AI Gateway connects the assistant to the artificial intelligence model.
• Anthropic: the provider of the Claude models that process owners' and managers' messages, through Vercel AI Gateway.
• Supabase: the database where everything above is stored, the staff sign-in, and files (logos, card images and customer list downloads).
• Upstash: stores the state of WhatsApp conversations, such as pending approval cards and messages already processed.
• Apple and Google: receive what's shown on your card (for example your first name, your stamps and offers) to keep it in your wallet and notify you of changes. Google tells us when you save or remove the card.

Beyond this, we would only share data if the law requires it.

Our servers are in the United States. Meta, Apple, Google and Anthropic may process data in other countries under their own policies.

• Each business can only see its own data. The database enforces this on every query, and we test it.
• Staff sign in with a one-time code, and the assistant recognizes owners and managers by their WhatsApp number on every message. If a business removes someone, the assistant stops recognizing them from their next message.
• We check that WhatsApp messages really come from Meta before processing them.
• Your card's code is a random number that doesn't reveal who you are, and Apple card keys are never stored in readable form (only a hash).
• Customer list downloads are delivered with a link that expires in 24 hours, and each one is logged.
• System keys and passwords are never in the code and the assistant never sees them.
• Everything travels encrypted over HTTPS.

No system is perfect. If something happens that affects your data, we will notify you as the law requires.

• Customer data: while the business uses Mesa, or until you ask us to delete it. If the business leaves Mesa, it can download its customer list before it goes; after that: we delete it after 90 days.
• Visits: the visit history is never edited or deleted, because the business's numbers come from it. If you ask us to delete your data, see what is kept.
• Consent records: kept even if the business leaves Mesa, as proof of what you accepted: for up to 3 years after your last visit.
• Conversations with the assistant: up to 12 months.
• WhatsApp approval cards: up to 7 days.
• Customer list download links: expire after 24 hours.
• Technical logs: up to 30 days.
• Backups: up to 30 days.

You can ask us to:

• Show you what data we have about you.
• Correct data that's wrong.
• Delete your data. We explain how in Delete your data.
• Give you a copy of your data.
• Stop notifications: remove the card from your wallet or turn off its notifications.

If you're a customer, ask the business or write to us at paluco@jibaro.tech. If you're an owner, manager or staff member, write to that same address. We answer within 7 days.

Mesa is only for people 18 or older. If we learn that we have data from someone younger than that, we delete it.

These pages don't use cookies or analytics tools. The staff scanner saves your session on your phone so you don't have to sign in every time. Our hosting provider keeps technical logs of every visit, such as the IP address, for security and to fix errors, and the join page limits attempts per IP address and per phone number to prevent abuse.

If we change this policy, we update this page and the date at the top. If the change is important, we tell the businesses that use Mesa before it applies.

• Email: paluco@jibaro.tech
• Governing law: the laws of Puerto Rico; any dispute is handled in the courts of Puerto Rico