Privacy Policy

• We collect what we need to run loyalty cards, and not more.
• We do not sell personal information and we do not run advertising or tracking cookies.
• The app uses your location only if you allow it, to show businesses near you.
• A business only sees your details once you join one of its cards.
• You decide, business by business, who may send you promotions. Messages about your own cards (a welcome, a reward nearly ready, a gift) come with the card.

Perks (“we”, “us”) operates perksnperks.com and the Perks mobile app, and is responsible for the personal information described here.

When you join a business’s card, that business also becomes responsible for how it uses your information to run its programme and to contact you. Our Terms limit what businesses may do with it.

We collect:

• Account details. Your email address, and if you choose to give them, your name, phone number, gender and date of birth. If you sign in with Apple or Google, we receive that account’s identifier and verified email (with Apple, possibly a private relay address).
• Card activity. The cards you join, and each collection, reward and redemption with its time, the business, the branch and the tag you tapped. Where a shop’s till is connected to Perks, also the purchase amount and the name the till gives for the cashier. This history is the record of what you have earned, so it is not edited after the fact.
• Your device. Whether it is iPhone or Android, the model, the operating system version, the app version and when the app was last opened. If you allow notifications, a push token so messages can reach your phone.
• Your location, if you allow it. With your permission, the app uses your phone’s location to show businesses near you in Discover. We do not keep it.
• Your choices. Which businesses may send you promotions.
• App checks. When you tap a tag or join a card, a token from Apple (DeviceCheck) or Google (Play Integrity), through Firebase App Check, showing the request comes from the genuine app.

Location is off until you say yes, and the app works without it: collecting and redeeming never need it. You can switch it off at any time in your phone’s settings. We do not collect your contacts or anything from other apps.

You can join some cards from a web page and keep them in Apple Wallet or Google Wallet without the app. Then we collect your email address and name, your card activity as above, and for your wallet pass the identifiers Apple or Google use to deliver updates to it. Signing in on the web sets one cookie that keeps you signed in on that browser for up to a year; signing out removes it.

Businesses can ask for feedback on a Perks form, from a QR code or on a tablet at their counter. Your answers, any details the form asks for and you give (name, email, phone number), the branch where you answered and when, go to that business and are kept until it deletes them. You don’t need an account to answer. If the business offers a thank-you gift and you ask for it, we email you a code to confirm the address is yours, then create a Perks customer account with that email so the gift can be redeemed; you can delete it like any other account.

We collect:

• Sign-in details. Your email address and a hashed password, or your Google account identifier. The same applies to team members you invite.
• Business details. Name, email, phone, country, address, time zone, category, branch addresses, opening hours, map locations, logos and card designs.
• Billing. Your plan, invoices, payment and refund history, and the brand and last four digits of your card. Full card details go directly to Stripe and never reach our servers.
• Activity. An audit trail of important actions in your account, such as team changes, manual gifts and billing changes.

We use personal information to:

• run your account, record collections and issue rewards (to perform our agreement with you);
• send service emails such as sign-in codes, receipts and billing reminders (our agreement with you);
• deliver promotions from businesses you have opted in to hear from (your consent);
• send messages about your own cards, such as a welcome, a reward nearly ready or a gift, in the app or on your wallet pass (to run the card you joined);
• send birthday rewards, if you gave a date of birth (your consent);
• show an offer on your wallet pass while a business runs one near its branches, if you agreed to its promotions (your consent);
• prevent fraud and abuse, fix problems and understand how the service is used in aggregate (our legitimate interest in a safe, working product);
• keep tax and accounting records (legal obligation).

We do not use your information for advertising, and we do not make automated decisions that have legal effects on you.

A business can see you only after you join one of its cards. It then sees your name, contact details, date of birth if provided, and your activity with that business only. It never sees your activity with other businesses, and it never sees your location. A business can send you promotions only if you switched them on for it, and you can switch them off in the app at any time. Messages about your own card (a welcome, a reward nearly ready, a gift) are part of the card and reach every holder.

We share information with the companies that help us run Perks, and only as far as each needs it:

• Stripe: payments and invoices for businesses.
• Resend: sending email.
• Google Firebase: delivering push notifications, and App Check, which confirms requests come from the genuine app.
• Apple and Google: Wallet passes, if you add a card to your wallet; Sign in with Apple and Google sign-in, if you use them; and Google Maps, when a business looks up its address.
• Cloudflare: protecting and delivering our website, and storing images such as logos.
• Hostinger: hosting our servers and database.

We may also disclose information if the law requires it, or to a buyer if Perks is sold, in which case this policy continues to protect it. We never sell personal information.

Some of these providers process information outside the United Kingdom and the European Economic Area, including in the United States. Where they do, we rely on recognised safeguards such as adequacy decisions and standard contractual clauses.

• Account details: for as long as your account is open.
• Card activity: for as long as the business’s programme runs, because it is the record of what was earned and redeemed. When an account is deleted we delete it or strip it of anything that identifies you.
• Location: used at the moment it is needed to decide whether to send a notification. We do not keep a history of where you have been.
• Feedback answers: until the business deletes them or closes its account.
• Billing records: six years, as tax law requires.
• Deletion requests are completed within 30 days. See how to delete your account.

Our website uses only the cookies needed to keep people signed in and secure: business users, and customers who joined a card on the web. We do not use advertising cookies or third-party analytics, which is why you do not see a cookie banner. The Stripe checkout page sets its own cookies to prevent fraud. To show prices in your currency, we read the approximate country your connection comes from, as reported by our network provider Cloudflare. We use it for that page view only and do not store it.

Traffic is encrypted in transit. Passwords are stored only as salted hashes. The app keeps your sign-in in your phone’s secure keychain. Each business’s data is separated from every other’s, and API keys are stored hashed. No system is perfectly secure; if a breach affects you, we will tell you and the regulator as the law requires.

You can ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, or to move it elsewhere. Where we rely on consent, you can withdraw it at any time. Much of this you can do yourself in the app or dashboard. For anything else, including deleting your account, email help@perksnperks.com from the address on your account and we will respond within one month.

If you are unhappy with how we have handled your information, you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local data protection authority.

Perks is not meant for children under 13, and we do not knowingly collect their information. If you believe a child has an account, tell us and we will remove it.

When we change this policy we will update the date at the top, and for significant changes we will tell you by email or in the app before they take effect.

Privacy questions and requests: help@perksnperks.com.