NextUp! ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the NextUp! mobile application and associated web services (collectively, the "Service").
By using the Service, you consent to the data practices described in this policy. If you do not agree with the terms of this Privacy Policy, please do not use the Service.
When you create a Merchant account, we collect:
When you subscribe or make in-app purchases, the following data is processed:
We do not directly collect, process, or store your payment card details, billing address, or other financial account information. All payment processing is handled by Apple, Google, and RevenueCat.
When Customers join a queue through the Service, they may provide:
The specific data collected from Customers varies based on what each Merchant configures for their queue. Merchants are responsible for ensuring their data collection practices comply with applicable laws.
Some Merchants turn on a location check for the QR code guests scan to join their queue. When a Merchant has done so, the join page asks your browser for your device's current location at the moment you tap Join (never when the page loads). The same location check also applies on the page that opens WhatsApp for that Merchant: the WhatsApp button is shown only after you tap "Share my location to continue" and the check passes. Your coordinates are sent once to our servers over an encrypted connection, compared against the Merchant's business location to confirm that you are within roughly 200 to 300 metres of the Merchant's location, depending on the accuracy your device reports, and then immediately discarded. We do not store, log, share or profile customer location data; only the outcome of the check (allowed or refused), the business and the time are recorded, without coordinates, and neither page keeps your coordinates in your browser. If you decline to share your location you will not be able to join that Merchant's queue (or open WhatsApp for that Merchant) from your phone, but the Merchant's staff can add you in person. Merchants who enable this feature save their own business location in their account; it is used solely for this check and is deleted with the account.
For Merchants who have the paid Analytics add-on, a guest's phone number is used to recognise returning guests at the same business. When a guest joins that Merchant's queue with a phone number, we convert the number to a standard international format and store it with that Merchant's analytics visit records (the date and time of each visit, the queue, and whether the visit was completed or a no-show). When the guest's queue entry is created, we look up that same Merchant's earlier visits for the same phone number and attach a short summary (visit dates, outcomes and counts, without the phone number) to the entry while it is active, so the Merchant's staff can see, for example, a gold star next to frequent guests, the date of the last visit and the visit history. A phone number is never used to match guests across different businesses, is never shared with other Merchants, and is visible only to the signed-in staff of the business the guest visited. This information is never shown to guests, is not shared with any third party other than our infrastructure provider (see Third-Party Services), and is never used for advertising. No automated decisions are made about guests; how the information is used is up to the Merchant. For this feature, the Merchant decides why and how its guests' data is used and is responsible for that use (as the data controller), and we process the data on the Merchant's behalf (as its processor or service provider). These visit records are kept as described in the Data Retention section and may be purged periodically; when a Merchant deletes or reports an entry, that entry is no longer linked to the guest's phone number. Guests who want to see, correct or delete their visit history can ask the Merchant they visited, or contact us at info@stea.cr; we will pass the request on to the Merchant or act on it as the Merchant instructs.
SMS alerts. Merchants who have the SMS alerts add-on can have the Service send a text message to the phone number given with a queue entry when the Merchant calls that guest's turn. The message contains only the business name and a short "your turn" notice; in the United States it reads, for example, "[Business] (via NextUp!): Your turn! Please come forward to be served. Reply STOP to opt out." We do not send marketing or promotional text messages. In the United States, when the join page or the Merchant's in-store kiosk asks for a phone number, you must agree to receive these SMS queue notifications before you can join with a phone number, and your agreement is recorded with your queue entry. Message frequency varies. Message and data rates may apply. In the United States, reply STOP to any of our text messages to stop receiving them, or HELP for help. Messages to United States numbers are sent through Amazon Web Services (AWS End User Messaging) from a registered number; messages to numbers in other countries, including Canada, are sent through Twilio. To deliver a message, we give these providers the phone number and the message text (which includes the business name). Our own logs record only the last four digits of the phone number. We do not sell or share mobile phone numbers or SMS consent with third parties for their marketing purposes.
WhatsApp. Some Merchants let guests join their queue over WhatsApp. You start the conversation yourself by sending a message to the NextUp! WhatsApp number, usually by scanning the Merchant's code or tapping its WhatsApp link. We never start a WhatsApp conversation with you: we message you only after you have written to us first. Our automated assistant then asks for your name and any information the Merchant requires, adds you to the queue, and sends you a WhatsApp message when the Merchant calls your turn (either a standard "your turn" message or a short message written by the Merchant). WhatsApp messages are sent and received through Twilio and the WhatsApp platform operated by Meta; WhatsApp's own terms and privacy policy apply to your use of WhatsApp. For this we process your WhatsApp number, the messages you send and receive, your name and your answers. An unfinished conversation is set to expire one hour after it was last updated; the queue entry itself, including your WhatsApp number, is kept like other Customer queue data (see Data Retention). You can leave the conversation at any time by not replying; if you have already joined, the Merchant's staff can remove you from the queue.
We automatically collect certain technical information:
We collect aggregate usage information:
| Data | Purpose |
|---|---|
| Business name | Display to Customers when they scan your QR code or access your queue |
| Device timezone | Accurate timestamps and daily usage limit resets |
| Subscription data | Determine feature access and entitlements |
| Customer queue data | Manage queue positions, notify Customers, display information to Merchants |
| Guest phone number (Merchants using Analytics) | Recognise returning guests at the same business and show that Merchant's own visit history for the guest (Section 2.3.2) |
| Phone number given with a queue entry (Merchants with SMS alerts) | Send a text message when the Merchant calls the guest's turn (Section 2.3.3) |
| WhatsApp number and messages (guests who join by WhatsApp) | Add the guest to the queue through WhatsApp and tell them when it is their turn (Section 2.3.3) |
| Push notification tokens | Deliver real-time queue status updates |
| Usage data | Enforce usage limits, provide analytics, improve the Service |
| Language preference | Display the Service in your preferred language |
We use the following third-party services that may collect and process your data in accordance with their own privacy policies:
| Service | Purpose | Data Processed |
|---|---|---|
| RevenueCat | Subscription and purchase management | Customer ID, purchase history, subscription status, entitlements |
| Firebase Cloud Messaging | Push notifications for Merchants | Device token, platform identifier |
| Apple App Store | App distribution and payment processing (iOS) | Purchase and subscription data per Apple's privacy policy |
| Google Play Store | App distribution and payment processing (Android) | Purchase and subscription data per Google's privacy policy |
| Amazon Web Services (AWS) | Backend infrastructure and data storage | All Service data is stored on AWS servers |
| AWS End User Messaging (Amazon Web Services) | Text message (SMS) delivery to United States phone numbers | Phone number, message text (business name and "your turn" notice) |
| Twilio | Text message (SMS) delivery to phone numbers outside the United States; WhatsApp messaging | Phone number or WhatsApp number, message content |
| WhatsApp (Meta) | WhatsApp messaging platform, for guests who choose to join by WhatsApp | WhatsApp number and message content, per WhatsApp's privacy policy |
We use the information collected by these services solely for the purposes described above and do not share your personal data with any other third parties for marketing or advertising purposes.
We implement reasonable technical and organizational security measures to protect your personal information, including:
However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.
We retain your information only as long as necessary to provide the Service and fulfill the purposes outlined in this policy:
Depending on your jurisdiction, you may have the following rights regarding your personal data:
To exercise any of these rights, please contact us at info@stea.cr. We will respond to your request within 30 days.
Under the California Consumer Privacy Act, California residents have the right to know what personal information is collected, request its deletion, and opt out of its sale. We do not sell personal information. To exercise your rights, contact us at the email above.
If you are in the EEA, you have additional rights under the General Data Protection Regulation, including the right to lodge a complaint with your local data protection authority. Our legal basis for processing your data is your consent (provided when you use the Service) and our legitimate interest in operating and improving the Service.
The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly. If you believe we have collected information from a child under 18, please contact us at info@stea.cr.
Your information may be transferred to and processed in countries other than your country of residence, including the United States (where our cloud infrastructure provider operates and our messaging provider, Twilio, is based) and Costa Rica (where we are based). These countries may have data protection laws that are different from the laws of your country. By using the Service, you consent to the transfer of your information to these countries.
The Service does not respond to Do Not Track signals. We do not use third-party advertising tracking. We do not track users across third-party websites.
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Your continued use of the Service after we post changes constitutes your acceptance of the updated policy.
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:
NextUp!
Costa Rica