Privacy Policy

Who is responsible for your data

There are two kinds of data controller in this app:

• The platform operator (Zeynep Aslı Erhan, sole proprietor) is the controller for your account and device data: your account details, phone verification, notification registration, the app’s technical logs and the list of businesses you have joined.
• Each business you join is a separate controller for the data of its own loyalty programme: your points and stamps there, reward redemptions, campaign history and transactions at its tills. The platform operator processes this data on the business’s behalf and on its instructions (as a processor).

You can find a business’s identity as a controller and how to contact it on that business’s own privacy page; the app shows a link to it before you join.

What happens when you join a business

• You join a business’s programme when you tap Join on its page in the app, or automatically when you earn points there for the first time. Joining is optional.
• When you join, your profile is shared with that business: its managers and till staff can see the membership information they need for their work (for example your name and your points activity at that business).
• If the business has connected a point-of-sale (POS) system, your name, e-mail address and a hashed form of your phone number are also sent to that POS provider so that you can be recognised at the till.
• Your agreement to share data with a business is recorded with the date and the version of the notice you were shown.
• Businesses do not see each other’s data: a business only sees data from its own programme, not your memberships or points at other businesses.
• Points and stamps are only valid at the business where you earned them; they are not transferred between businesses.

What data we process

• Account details: your name and e-mail address — to create your account, sign you in and recognise you. Your password is stored only in irreversibly encrypted form by the authentication service; nobody, including the businesses, can see it.
• Phone number: Turkish mobile numbers only — verified with a code sent by SMS to keep your account secure; a hash of the number is used to match you at the till. The number itself is stored with your account by the authentication service.
• Memberships: which businesses you have joined and when.
• Loyalty activity (on behalf of the businesses you join): points and stamps earned, rewards redeemed, campaign history, and the amount and time of the purchase points were calculated from.
• Checkout QR code: a short-lived, single-use code. One code works at every business you visit.
• Notification details (if you allow them): your device’s push notification address (push token) and operating system (iOS/Android) — only to send you notifications.
• Technical and security logs: app error logs (error type, screen, app version, operating system). Passwords, session keys and e-mail addresses are masked before logging; in security logs your IP address is kept only as an irreversible hash.

Location: if you turn on location sharing to see a business’s nearest store, your location is used only on your device; it is not sent to or stored on our servers.

Data we do not process: the app does not take payments; no card numbers or other payment details are processed. The app does not ask for your date of birth.

Why we process it

• Creating and managing your account, letting you discover and join businesses.
• Running the loyalty programmes of the businesses you join (on their behalf): earning points and stamps, redeeming rewards, applying campaigns.
• Verifying your phone number by SMS for account security and matching you to the right account at the till.
• Sending campaign and announcement notifications if you allow them.
• Keeping the service secure, preventing abuse and fixing errors.
• Meeting legal obligations.

Your data is not sold or transferred to third parties for advertising.

How we collect it and on what legal basis

Your data is collected electronically through the app and when your QR code is scanned at a till, and processed under KVKK Art. 5/2 on these grounds:

• it is necessary to set up and perform your account and programme memberships (Art. 5/2-c),
• it is necessary to meet legal obligations (Art. 5/2-ç),
• the legitimate interest in keeping the service secure and preventing abuse (Art. 5/2-f).

Joining a business, allowing notifications and sharing your location are optional. Your profile is not shared with a business you have not joined.

Who we share it with

• The businesses you join (and, if connected, their POS providers) — only for their own programme, as described above.
• Infrastructure providers: database and server hosting (Supabase and Vercel — servers in the European Union, Ireland), e-mail delivery, the SMS provider that delivers your verification code (processor) and, if you allow notifications, push infrastructure (Google Firebase Cloud Messaging, Apple Push Notification Service). Because these providers’ servers are abroad, your data is transferred abroad under KVKK Art. 9 so that the service can be provided.
• Competent public authorities: only where there is a legal obligation.

How long we keep it

• Your account, membership and loyalty data are kept while your account is open.
• When you delete your account, your personal details are deleted or anonymised; points records are kept in anonymous form, separated from your identity, for the businesses’ accounting integrity.
• Your phone number is kept as long as your account; it is deleted when you delete your account.
• Checkout QR codes expire quickly and are deleted entirely when you delete your account.
• Technical and security logs are kept only as long as needed; SMS delivery logs (a keyed hash of the number, time and result) are kept for at most 30 days to prevent abuse.

Deleting your account

Deleting your account applies to every business: all your memberships end, and if you use the same account in another app on the same service (for example a business’s own branded app), that account is deleted too — it is one account.

• Account Deletion →

How we protect it

Your data is stored in an access-controlled database; every record is protected by row-level access rules and each business can only access its own data. Business staff can only access the data they need for their work (for example processing points at the till). All connections between the app and the servers are encrypted (HTTPS).

Your rights under KVKK

Under KVKK Art. 11 you have the right to apply to the controller to:

• learn whether your personal data is processed,
• request information about the processing,
• learn the purpose of the processing and whether the data is used accordingly,
• know the third parties in Turkey or abroad to whom it is transferred,
• request correction if it is incomplete or inaccurate,
• request deletion or destruction under the conditions of KVKK Art. 7,
• request that corrections, deletions or destructions be notified to the third parties to whom the data was transferred,
• object to a result against you arising exclusively from automated analysis,
• claim compensation for damage caused by unlawful processing.

You can delete your account at any time in the app (Account → Delete account).

How to apply: for requests about your account or the platform, write to the platform operator using the details in the Who is responsible for your data section, from the e-mail address registered to your account. For requests about your loyalty data at a particular business, you can apply to that business directly; requests sent to the platform operator that concern a business’s data are forwarded to that business. You may be asked for additional information to verify your identity.

Your application is concluded within 30 days at the latest (KVKK Art. 13). If it is rejected, you find the answer insufficient or it is not answered in time, you can complain to the Personal Data Protection Board (KVKK Art. 14).

• Account Deletion →
• Support →

Changes

This notice may be updated; the current version is always published on this page. This is version v1; the date of the last update is shown at the top of the page.