Privacy Policy

This Privacy Policy explains what information Swabzy ("we", "us") collects when businesses and their customers use the Swabzy digital loyalty platform, how we use it, and the choices you have. This page is maintained by Swabzy to answer common privacy questions about the service.

1. Information we collect

From business accounts. When you sign up as a business we collect the account owner's email address, display name, and authentication identifiers from your chosen sign-in method (email/password or Google). To publish your shop page we also collect business name, business type, public handle (slug), phone number, address, short tagline, and an optional logo image. Subscription and billing information (plan, status, billing email, and Paddle customer/subscription identifiers) is collected when you upgrade to a paid plan.

From customer accounts. When someone signs up as a customer we collect their email, display name, chosen username, and authentication identifiers. During onboarding or profile edits customers may optionally provide date of birth, gender, mobile number, and a profile picture. As customers use their wallet we record which loyalty cards they saved, stamps issued, completed cards, and rewards redeemed.

Automatically collected. We record basic device category (mobile/tablet/desktop) for analytics on stamp events, along with standard server logs (IP address, user agent, timestamps) needed to operate the service securely.

2. How we use information

• Provide the core loyalty features: create cards, issue stamps, unlock rewards.
• Authenticate accounts and keep them secure.
• Send transactional emails (welcome messages, stamp receipts, reward alerts).
• Show businesses aggregated analytics about their own customers and visits.
• Process subscription payments and manage plan entitlements.
• Investigate abuse, prevent fraud, and comply with legal obligations.

3. Sharing between businesses and customers

Swabzy is a two-sided platform. When a customer saves a business's loyalty card, visits that business's public menu while signed in, or otherwise interacts with a business on Swabzy, the customer's profile details are shared with that business as an independent data controller for loyalty, customer-retention, marketing, and lead-generation purposes. The information shared with the business includes: display name, username, mobile number (the number used to sign in), profile picture (if provided), and — where the customer has voluntarily provided them — date of birth and gender, along with stamp progress, redemption history, and menu-visit activity for that specific business.

Customer email addresses (from Google sign-in, where applicable) and authentication credentials (OTP codes, passwords) are never shared with businesses. A business only receives data about customers who have interacted with that business — it never sees data belonging to another business's customers.

Legal basis and your choices. Where required by law (including the EU/UK GDPR and India's DPDP Act), the legal basis for this sharing is (i) performance of the loyalty service you asked us to provide and (ii) your consent, which you give when you create an account or save a loyalty card. Businesses may contact you with marketing, offers, and loyalty-related messages; you can opt out of a specific business's marketing by removing their card from your wallet or by contacting that business directly. Businesses are contractually required to use the data only for lawful loyalty, retention, and marketing purposes and to comply with applicable privacy laws in their own jurisdiction.

3a. Restrictions on how businesses may use your data

Businesses on Swabzy are contractually bound by our Terms of Use (Section 4b — "Prohibited uses of customer data") and may only use your details to run their loyalty programme and to send you marketing about their own goods and services. In particular, businesses must not:

• Sell, rent, trade, or otherwise transfer your data to any third party or data broker.
• Combine your data with other sources to build cross-business profiles or resale marketing lists.
• Send you spam, messages unrelated to their business, political or religious campaigning, gambling, or adult content.
• Contact you after you have withdrawn consent (by removing their card or opting out).
• Use your data to harass, discriminate, deceive, or otherwise harm you.
• Retain your data after they leave Swabzy, or beyond what is needed for the loyalty programme.

How to report misuse. If a business contacts you outside of Swabzy's intended purposes, ignores your opt-out, or misuses your data in any way, please email privacy@swabzy.com with the business name and a description of the issue. We investigate every report and may suspend or terminate offending businesses, require them to delete exported data, and — where legally required — notify supervisory authorities such as the Data Protection Board of India, the relevant EU Data Protection Authority, or your local regulator.

4. Service providers (subprocessors)

• Supabase — database, authentication, and file storage.
• Paddle — subscription billing and payment processing for businesses on paid plans.
• Resend — transactional email delivery.
• Cloudflare — hosting and content delivery.

These providers only process data on our behalf to deliver the service.

5. Retention and deletion

We keep account and loyalty data for as long as the account is active. You can request deletion of your account and associated personal data by contacting us at the address below; we will remove data within a reasonable period, except where we must retain records to comply with legal, tax, or fraud-prevention obligations.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Customers can edit their profile directly in the wallet; businesses can update their details in Dashboard → Settings. For anything else, email us and we will respond within a reasonable time.

7. Security

Data is transmitted over HTTPS and stored with row-level access controls so that each account only sees its own data. No system is perfectly secure — if you notice a vulnerability, please report it to the contact address below.

8. Children

Swabzy is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page.

10. Contact

Questions or requests about your data? Email privacy@swabzy.com.