Privacy policy

Qupons ("we", "us") provides a mobile app that lets businesses create digital loyalty cards and coupons and send them to their customers as Apple Wallet and Google Wallet passes. In this policy:

• Users are people with a Qupons account: business owners, admins and team members using the app, on a free or paid plan.
• Customers are customers of a business that uses Qupons, who hold one of its loyalty cards or coupons. Customers don't need the app or an account.
• Visitors are people browsing this website.

For users' and visitors' data, Qupons is the controller. For customers' data, the business that issued the card is the controller and decides how it is used; Qupons is its processor and handles that data only to run the service for the business. If you're a customer and want to use your rights, you can contact the business directly or contact us and we'll help.

Users

• Account details: name, email address and, if you sign in with Google or Apple, the profile details they share (such as your name and profile photo). Passwords are handled by Firebase Authentication and are never stored by us in readable form.
• Business details: business name, address, website, logos and banner images, the loyalty cards and coupons you design, and your team's members, roles and invitations.
• Activity: the redemptions you or your team make, including which team member made them and when.
• Subscription details: your plan, renewal dates and the store you bought it from. Payments are taken by Apple or Google; we never see your card details.
• Device and technical data: device type, operating system, app version, a push notification token and app instance identifier, app integrity checks, and diagnostic logs.

Customers

• Email address, used to send the card and identify the customer to the business.
• Whether the customer agreed to hear from the business about offers, and when that choice was made or changed.
• The cards and coupons they hold, and each stamp or redemption: when it happened and which team member recorded it.
• Wallet data: when a pass is added to Apple Wallet, Apple gives us a device identifier and push token so we can update the pass; Google Wallet passes are stored with Google.
• IP address when someone uses a public sign-up page, to prevent abuse.

We don't ask customers for their name, phone number, date of birth or payment details, and we don't collect anyone's location.

Visitors

• Standard server logs (IP address, browser type, pages requested and time), kept by our hosting provider for security and troubleshooting.
• Anything you send us when you email us.

• To create and run your account and business, and let your team work together
• To create customers' cards, QR codes and wallet passes, send them by email and keep the passes up to date after each visit
• To record stamps and redemptions and show the business its statistics and customer list
• To manage subscriptions and apply the limits of each plan
• To send service messages, such as team invitations and notices about your account
• To keep the service secure: authenticating requests, checking app integrity and rate limiting public pages
• To diagnose problems, provide support and improve Qupons
• To meet legal obligations

We don't sell personal data, use it for advertising, or send customers marketing of our own. Businesses may contact customers who opted in to hear from them.

Under UK and EU data protection law we rely on:

• Contract: to provide the app and service you signed up for
• Legitimate interests: to keep the service secure, prevent abuse and improve it, in ways you would reasonably expect
• Consent: for customers to receive marketing from a business, which they can withdraw at any time
• Legal obligation: where the law requires us to keep or disclose data

For customers' data, the business is responsible for having a lawful basis for its loyalty scheme.

We use these providers to run Qupons. Each only receives the data it needs for its job, under a contract that requires it to protect that data.

• Google Firebase (Google): sign-in (Firebase Authentication), our database (Cloud Firestore), image and pass storage (Cloud Storage), app integrity checks (App Check) and in-app notifications (Cloud Messaging and In-App Messaging).
• Google Cloud (Google): hosting for the Qupons API (Cloud Run, in Frankfurt, Germany) and this website (App Engine, in Europe), secret storage and rate limiting.
• Google Wallet (Google): to create and update customers' Google Wallet passes.
• Apple Wallet and Apple Push Notification service (Apple): to create customers' Apple Wallet passes and tell their devices when a pass changes.
• Sign in with Google and Sign in with Apple: if you choose to sign in that way.
• Apple App Store and Google Play: to take payment for subscriptions.
• RevenueCat (RevenueCat, Inc.): to manage subscriptions. It receives your account identifier and store purchase records, not your card details.
• Amazon Simple Email Service (Amazon Web Services): to send emails, including customers' cards and rewards and team invitations. It receives the recipient's email address and the email's content.
• Google Fonts (Google): this website loads its font from Google, which receives your IP address and browser details when you visit.

Apart from the services above, personal data is only shared:

• With the business: a business's owner and admins can see and export its customer list (email address, marketing choice and activity). Team members can search customers to stamp their cards.
• With customers: a customer's card shows the business's name, logo, address and website.
• With authorities: when required by law, or to protect the rights, property or safety of Qupons, our users or others.
• In a business transfer: if Qupons is merged, acquired or sold, in which case this policy will continue to apply.

Our main systems are hosted in Europe, but some providers (including Google, Apple, RevenueCat and Amazon Web Services) are based in, or process data in, the United States. Where data leaves the UK or European Economic Area, we rely on adequacy decisions such as the EU-US Data Privacy Framework and its UK extension, or on standard contractual clauses approved by the UK and EU authorities.

• All data is encrypted in transit (HTTPS) and at rest by our hosting providers
• Every request from the app is authenticated and checked against the user's role in the business
• App Check helps make sure requests come from the genuine Qupons app
• Public sign-up pages are rate limited, and each email address can only be sent a card a few times an hour
• Keys and credentials are kept in a secret manager, and access to production systems is restricted

No system is completely secure. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires.

• User accounts are kept while the account is open. When you delete your account, your personal details are deleted.
• Customer data is kept for as long as the business uses Qupons, or until the business deletes the customer, which also disables their cards.
• Server logs and backups are kept for a limited period and then deleted automatically.

We may keep some data for longer where the law requires it, or to resolve disputes and enforce our agreements.

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to how it's used, receive a copy in a portable format, and withdraw consent at any time.

• Users can update their details and delete their account in the app.
• Businesses can update, export and delete their customers' data in the app.
• Customers can ask the business that issued their card, or email us. The marketing choice can be changed at any time.

To make a request, email support@qupons.coupons. We'll respond within one month. If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

This website doesn't use analytics, advertising or tracking cookies. It may set strictly necessary cookies for security. The app stores a small amount of data on your device to keep you signed in and remember your settings.

Our website links to other sites, such as the App Store and Google Play. We're not responsible for their privacy practices, so please read their policies.

Qupons accounts are for people aged 18 and over. We do not knowingly collect personal information from children. If we learn that we have, we will delete it.

We may update this policy, for example when we add a feature or change a provider. The latest version is always on this page with its effective date, and we'll let users know in the app or by email about significant changes.

For any question about this policy or your data, email support@qupons.coupons.