Last updated April 24, 2026
Privacy policy
At Cuadra we take the privacy of your data and your customers' data seriously. This policy explains what we collect, how we use it, and the rights you have over that information.
Data we collect
We collect data you give us (name, email, business info), data generated using Cuadra (sales, appointments, products) and basic technical data (IP, browser) to prevent abuse and improve the product. In our mobile apps we also measure basic usage data, such as installs and sessions, to see how many people use them. You can turn analytics off anytime. On Android, first-party install and session counts are always collected, because the app opens the site inside the browser and has no toggle of its own.
How we use your data
We use your data to operate Cuadra, send you essential communications (billing reminders, security alerts) and improve the service. We never sell data to third parties.
Sign in with Google
If you choose to sign in with your Google account, we receive from Google only the following basic profile fields: your name, your email address, your Google unique identifier (sub) and your profile picture. We use that data solely to create and authenticate your Cuadra account and to display your name inside the app. We do not read your Gmail, Drive, Calendar, Contacts or any other Google API outside of the standard OpenID Connect sign-in flow. We do not share that data with third parties, do not use it to train AI models, do not use it for advertising, and do not sell it. You can revoke access at any time from your Google account (myaccount.google.com → Security → Third-party apps with account access) or by deleting your Cuadra account from Settings → Account.
Retention and deletion
We keep your personal data while your account is active. If you delete your account we erase your personal data within 30 days, except where the law requires us to retain it (accounting and FEL records for the applicable legal period). You can request immediate deletion by writing to privacidad@cuadra.gt.
Data of a business's customers
When a business uses Cuadra, it stores data about its own customers: name, phone, email, tax ID, notes, appointment and purchase history, photos (profile and before and after), signatures, file attachments and WhatsApp, Messenger and Instagram conversations. For that data Cuadra acts as a processor: we store and process it on behalf of the business, and the business decides what to do with it.
When a business anonymizes a person
A business can anonymize one of its customers. Doing so replaces their name, phone, email, tax ID and notes, and deletes the details on their profile (date of birth, gender, pronouns and occupation); it deletes their addresses, contacts and emergency contacts; the details of their insurance policies, their intake form answers and the notes on their appointments and reservations, the notes on their waitlist entries and communication consents, the reason typed for their message opt-outs (the opt-out itself is kept so they are not written to again) and the note behind a medical clearance are erased too. The data that identifies their dependents (pets, children or other household members: name, date of birth, microchip and notes) is redacted, and the history of those dependents (appointments and vaccinations) is kept with no data that identifies them. Their reviews stop being published and their text is deleted, along with any reply the business gave to them; the same goes for the product reviews they wrote about their purchases, whose name and text are deleted. The treatment records of their appointments are kept as clinical history: their photos and attachments are deleted, and the clinical notes the business wrote are kept as they are; the same goes for the notes and target outcome of their treatment plans. If they bought a gift certificate for someone else, their name and the message they wrote are deleted; that certificate remains valid for the person who received it. Their files are also erased (photos, attachments, receipt, quote and gift certificate PDFs, shipping labels and WhatsApp media), including resized copies, along with the text of their messages. By default, the technical logs of WhatsApp, Messenger and Instagram that carry their phone or contact identifier are cleaned in the background, only the part that is theirs: if one delivery includes someone else, theirs is not touched. The Wallet passes they hold stop working. File deletion starts as soon as the anonymization is confirmed; if something fails, Cuadra retries automatically until it succeeds.
What is kept
By default, the business keeps signed consents, medical records and prescriptions, payment proofs, and the attachments of payments and of membership discounts, because it may need them later; each business can choose to erase those as well. Tax documents (FEL invoices, with their XML and PDF) are always kept, because the law requires it, and an invoice already issued keeps its recipient data. The name, email and phone of whoever paid by card in a Recurrente charge are also kept, as evidence of the payment for chargebacks and refunds, and loyalty balances and movements are not deleted. The audit log is not rewritten: copies of earlier versions of a record are deleted after 30 days, and the audit action log is kept for as long as the account exists.
How to ask for your data to be deleted
If you are a customer of a business, ask that business to anonymize you: it decides and carries it out. You can also write to privacidad@cuadra.gt and we answer within 30 days. Note that Meta keeps media sent over WhatsApp (photos, audio, documents) under its own rules, currently around 30 days, which is outside Cuadra's control.
Your rights
You can access, export, correct or delete your data anytime. Write to privacidad@cuadra.gt and we respond within 30 days.
Subprocessors
We share limited data with the service providers that help us operate — for example, payment processing and SAT-certified electronic invoicing. Each is contractually required to protect it. If the business you buy from enables advertising measurement tools, purchase information may be shared with that platform in hashed form; we tell you and ask your permission on that store before it happens.