Privacy Policy

1. Personal Information We Collect

When you register we collect your name, WhatsApp number and password. You may optionally provide your date of birth and gender. We do not collect an email address for your membership.

When you redeem a physical reward we collect the recipient name, mobile number and delivery address you provide.

We record your marketing and cookie preferences, and the date on which you accepted the membership terms.

2. Member Activity

We record activity necessary to operate the programme: receipts you submit, verification decisions and their reasons, points credited, deducted, adjusted or expired, rewards you view and redeem, referrals you make, and notifications sent to you.

We record the date you were last active, so that customer care can assist you and so we can understand programme engagement.

3. Receipt Information

Receipt images are stored securely and are not publicly accessible. They are served only to you and to authorised staff carrying out verification.

We extract and store the retailer, purchase date, receipt number and total that you enter, and a cryptographic fingerprint of the image used to detect duplicate submissions.

Receipt images and their associated data are retained for as long as necessary to operate the programme and to meet audit and legal obligations.

4. How We Use Your Information

To operate your membership: verifying receipts, calculating and crediting points, fulfilling redemptions and administering referrals.

To communicate with you about your account and activity, over WhatsApp and in the notification centre — these service messages are not marketing and cannot be opted out of while you hold an account.

To send campaign and offer communications, only where you have given marketing consent, which you may withdraw at any time in your profile.

To detect and prevent fraudulent claims, and to meet our legal and audit obligations.

5. Third-Party Processing

We use third-party providers to host the website and database, to deliver WhatsApp verification codes and messages, and to deliver physical rewards. These providers process your data on our instructions and are bound to protect it.

We do not sell your personal information.

6. OmniChat Integration

We transmit member activity events to OmniChat, a third-party engagement platform, so that we can communicate with you about your membership.

Transmitted events cover registration, receipt submission and verification outcomes, points earned and redeemed, rewards viewed and redeemed, and completed referrals. Each event carries an event identifier, event type, your member identifier, a timestamp, the related record reference, and the properties relevant to that event.

We never transmit your password, one-time verification codes, authentication tokens, voucher codes, or any administrator activity.

Every event transmitted is recorded in our systems and can be reviewed on request.

7. Cookies and Tracking

We use a strictly necessary cookie to keep you signed in. This cannot be disabled while you are using your account.

Analytics and marketing technologies are used only with your consent, which you give or refuse through the cookie banner and can change at any time.

Full detail is set out in our Cookie Policy.

8. Security

Passwords are stored using a salted, computationally expensive hash and are never stored or transmitted in readable form. Verification codes are stored only as hashes bound to the destination number.

Session identifiers are stored only as hashes, so a database disclosure would not yield usable sessions.

Access to member data by staff is restricted by role, and consequential administrator actions are recorded in an internal audit log.

9. Your Rights

You may access and correct most of your information directly in your profile. Changing your WhatsApp number requires verification of the new number, because it is also your sign-in identifier.

You may withdraw marketing consent at any time.

You may request a copy of your personal information, ask us to correct it, or ask us to delete your account. Some records must be retained where we have a legal or audit obligation to keep them.

To exercise any of these rights, contact customer care.

10. Retention

We retain your information for as long as you hold a membership, and afterwards only for as long as required for legal, audit and fraud-prevention purposes.