Record of Processing Activities — Softcrum as PROCESSOR

⚠️ INFORMATIVE TRANSLATION — NOT BINDING. The Spanish version at ../../legal/ is the authoritative text and the only one that may be signed, published or presented to a third party. This English rendering exists so that non-Spanish readers can review the content; where the two differ, Spanish governs. Like its original, it is an unreviewed working draft — nothing here is legal advice, and nothing is final until a Chilean data-protection lawyer has signed off.

#	Activity	Controller (client)	Data categories	Data subjects	Purpose	Sub-processors	Transfers	Retention	Measures
1	Contact management (CRM)	Each tenant	Identification, contact, identity document (optional), commercial attributes	Tenant’s end customers	CRM operation	Supabase, Vercel	See public list	Term + plan retention policy	Annex TOMs
2	Behavioural events	Each tenant	Transactional and usage events, amounts	End customers	Segmentation, loyalty	Supabase, Vercel, Upstash	See list	13/25/37 months per plan + export	TOMs
3	Loyalty program	Each tenant	Points, redemptions, tiers, referrals	Members	Program operation	Supabase, Vercel	See list	Ledger anonymizable, not deletable	TOMs
4	Communications	Each tenant	Email/phone/push tokens, consents, delivery statuses	End customers	Campaigns and transactional	Resend, Google FCM	See list	Detail per plan; suppressions permanent	TOMs
5	Member authentication	Each tenant	OTP credentials, tokens	Members	Portal access	Supabase, Vercel, Resend	See list	Sessions per policy	TOMs

(Activities as controller — accounts, billing, telemetry — in a separate record.)

⌘I

Drafts — lawyer review pending

Record of Processing Activities — Softcrum as PROCESSOR — DRAFT v0.1