Privacy Policy

The controller of personal data processed through Winkels is Martin Gabriel Alturria, domiciled at Río Cuarto, Provincia de Córdoba, Argentina.

For any inquiry or request regarding your personal data, please write to support@winkelsapp.com

When registering an account as an owner or collaborator, we process:

• Identity data: name, email, password (hashed), phone, country, preferred language.
• Store contact data: business name, address, social networks.
• Store configuration: catalog, prices, hours, accepted payment methods.
• Billing data: contracted plan, payment history (card data is processed by MercadoPago; we do not store it).
• Technical and usage data: IP, device type, browser, pages visited, actions within the panel.

If you buy from a Winkels store, we process:

• Data you enter at checkout: name, phone, optional email, delivery address, order notes.
• If you create a buyer account: email, password, phone and preferences (favorites).
• Order history in stores where you have purchased.
• An anonymous browser identifier (wk_visitor cookie) to deduplicate visits and attribute orders to the source channel.

When you buy from a Winkels store, the store is co-controller of your data along with Winkels, with differentiated roles: the store decides what to do commercially with your data (own marketing, credit accounts, etc.), and Winkels processes it on behalf of the store to be able to provide the service.

We use the data solely for the following purposes:

• Provide and maintain the contracted service (POS, public catalog).
• Invoice and charge the owner's subscription to the Winkels plan.
• Send operational notifications (email, WhatsApp when enabled): order confirmations, stock alerts, billing notices, product updates.
• Prevent fraud, abuse, unauthorized access and protect service integrity.
• Aggregated and anonymous metrics to improve the product (usage patterns).
• Comply with legal, tax or judicial obligations.

We share data only with the following third parties and only to the extent necessary to provide the service:

• MercadoPago — to process subscription payments and, if the owner enables it, payments from their own sales.
• Kapso (WhatsApp) — WhatsApp provider for owner 2FA and buyer notifications.
• Anthropic / Google / OpenAI — for optional AI-assisted product loading. Only strictly necessary data is sent.
• Amazon Web Services — application hosting and image storage (private or public S3 buckets depending on file type).
• Amazon SES — transactional email delivery.

We do not sell personal data. We do not transfer it to third parties for their own marketing purposes.

We apply reasonable technical and organizational measures to protect your data, including:

• Mandatory encrypted communication (HTTPS/TLS) between browser and our servers.
• At-rest encryption of sensitive third-party credentials (MercadoPago tokens, etc.) with rotatable keys.
• Role-based access control (RBAC) and separation of duties within the Winkels team.
• Audit logs of critical actions and monitoring of unauthorized access attempts.

We keep your data while the account is active. When you cancel, or if you request deletion through the contact channel, we delete or anonymise your data, except what we must retain under legal obligations (tax, accounting, or defence against claims). Deletion is processed on request: it is neither automatic nor instant.

As a personal data subject, you have the right to:

• Access the data we process about you.
• Rectify inaccurate or incomplete data.
• Request deletion of your data when it is no longer necessary for the stated purposes or has been unlawfully processed.
• Object to certain processing or withdraw consents granted.

To exercise these rights, write to

If you believe your rights have been infringed, you may file a complaint with the supervisory authority in your country:

• Argentina: Agencia de Acceso a la Información Pública (AAIP).
• Brasil: Autoridade Nacional de Proteção de Dados (ANPD).

Winkels is not directed to children under 13. We do not knowingly collect data of minors. If you detect that a minor has created an account, please notify us and we will proceed to delete it.

Some of our providers (e.g., Amazon Web Services, Anthropic) have infrastructure outside Argentina. These transfers are made under contractual clauses guaranteeing a level of protection equivalent to that required by applicable law.

We may update this Policy; the last-updated date appears at the top. Material changes are notified by email or a prominent notice in the panel.