Privacy Policy

Business account data: When you register a business account, we store your identity and contact details, your role within your business, and the profile and communication settings you configure for it, such as its name, branding, contact details and the language used for customer communications. Billing data: When you subscribe to a paid plan, we store your subscription plan, status, current billing period, trial end date, and Stripe customer and subscription identifiers. Payment card details are processed and stored by Stripe; we never see or store full card numbers. Loyalty program configuration: We store the settings a business chooses for each loyalty program, including its name and reward rules, its branding and card design, the messages it sends, the location details it enables, the links it adds to its card, the wallet identifiers needed to issue passes, and which customer fields it chooses to collect or require. End customer data: When a customer enrolls in a loyalty program, we store the information the business operating that program has chosen to collect. This falls into three groups: contact details, such as email address and phone number; identity details, such as first and last name; and optional profile details the business invites the customer to provide, such as a date of birth or a stated preference. An email address is always collected. The business decides which of the others it asks for and which are required for its loyalty program to work. Optional profile details are used to operate the loyalty program. Depending on what a business collects, they allow it to find a customer's card when the customer cannot present their wallet pass, to identify or prevent duplicate registrations, to provide date-related benefits such as birthday rewards, to derive aggregate characteristics such as age ranges for analytics, and to recognize a customer's usual choices. Where age is presented to businesses for analytics it is shown in bands rather than as an exact date of birth. Loyalty activity data: We store the cards a customer holds and what happens to them, including current and lifetime balances, enrollment date, the timing of each interaction, card status, wallet type (Apple or Google), and the individual transactions and reward records behind them (earned, redeemed, expired). Where a program awards value based on spend, we also store the purchase amount and currency entered by the business at the time of the scan. Where a program connects customers to one another, such as an invitation from someone who already holds a card, we store the link between their cards and any bonus awarded for it. Loyalty engagement data: We may analyze loyalty-program activity, such as visit frequency, balances, rewards, redemptions and time since a customer's last interaction, to group customers into engagement and re-engagement segments. These insights help businesses understand how customers interact with their loyalty program and identify changes in customer engagement. We also record when a customer acts on a link or call to action presented on a loyalty card, so the business can measure what its card drives. Notes recorded by a business: A business can write free-text notes about its own customers, for example a service preference or a reminder for staff. The business decides what it writes. These notes are visible to that business only, are included when a customer's data is exported, and are deleted when that customer's data is erased. References recorded by a business: A business can keep one reference for each of its customers under a name it chooses, such as a membership or policy number it has assigned. The reference is shown on the customer's loyalty card and to the business's staff when the card is scanned, is included when a customer's data is exported, and is deleted when that customer's data is erased. Wallet pass device data: When a customer adds a pass to Apple Wallet or Google Wallet, the wallet platform registers their device with us. We store the device library identifier and a push token that lets us update the pass and send notifications. We do not receive the customer's phone number, Apple ID, or Google account. Notifications and in-app messages: We store the notifications sent through your programs (title, message, type, target, send time, recipient count), including messages sent automatically from templates the business sets up, in response to loyalty activity, and the in-app notifications shown to you in the dashboard. Staff scanner apps: Our mobile and desktop scanner apps are used by a business's own staff, not by customers. Staff sign in with the same business account, and the app uses the device camera solely to read the QR code on a loyalty card. Camera frames are decoded on the device and are never uploaded to us or stored. The apps also tell us which version of the app is installed, the device's operating system and a random identifier for the installation, linked to the signed-in staff member, so we can see which versions are still in use and support staff on an older one. We keep this until the staff member's account is deleted. Assistant and administrative records: The dashboard offers automated assistance that answers a business user's questions about its own loyalty data. We keep a record of each question, the answer given and which data was consulted, so that access to personal data through it is accountable. Those records can therefore contain the customer data that was needed to answer. Where our support staff need to access a business account to investigate a problem, that access is logged, recording who accessed which account and when. Prospective customer data: A member of our team may show you a Habulo QR code, for example at an event, or you may add one of our contact passes to your wallet. If you scan it and complete the short form, we add our contact card to your wallet and store the details you give us: your email address, your first name, a phone number if you provide one, the language of your device, the wallet platform you chose, and which team member's code you scanned. You are not the customer of a business using Habulo in this case, and we hold these details as controller so that we can follow up with you about the Service. Acceptance records: When you accept our Terms of Service and this Privacy Policy, for example when you register a business account, join a business's team, register for a loyalty card or ask for our contact card, we record which versions you accepted, when, in which language, and the IP address and browser type (user agent) of the device you used. We keep this as evidence that the acceptance took place and to detect and prevent fraudulent or abusive registrations. Technical and diagnostic records: We keep technical logs of the Service's operation, such as wallet pass delivery results and request metadata, and short-lived counters used to rate-limit abusive traffic. These are operational records rather than profile data, and they may temporarily include identifiers such as an IP address. Usage data: We use PostHog for product analytics: until you accept analytics cookies, PostHog runs in a cookieless mode with no cookie, no browser storage and no persistent cross-session identifier; if you accept, it may also use cookies to recognize your browser across sessions. Server logs may temporarily record IP addresses and request metadata for security and debugging. Cookies: We use cookies that are strictly necessary to run the Service: authentication and session cookies set by Supabase, small cookies that remember your theme and language preference, and a cookie that stores your cookie-consent choices. Analytics cookies are set only if you accept them in our cookie banner. You can change or withdraw your choice at any time through the cookie-preferences link on our website. We do not use advertising or third-party behavioral tracking cookies.

This section covers both of the roles described in section 3: what we do with business users' data as controller, and what we do with end customers' data on a business's instructions as processor. We use the information we collect to: - Provide, maintain, secure, and improve the Service - Authenticate you and protect your account - Process subscriptions, payments, and invoices through Stripe - Create, issue, update and retrieve digital loyalty cards, including Apple Wallet and Google Wallet passes - Operate the loyalty programs businesses configure: recording activity, applying each program's reward rules, providing the benefits it offers, and identifying a customer's card when they cannot present their pass - Identify and prevent duplicate loyalty card registrations - Produce loyalty analytics and insights for businesses, including grouping customers into engagement and re-engagement segments and deriving aggregate characteristics such as age ranges - Help businesses select relevant audiences for campaigns based on loyalty-program activity and engagement, where the customer is eligible to receive marketing communications - Answer business users' questions about their own loyalty data and analytics through automated assistance in the dashboard - Keep an accountable record of access to personal data through that automated assistance, and of any access to a business account by our support staff - Send service emails, such as account verification, team invitations, billing notices and periodic activity summaries, via our email provider - Deliver loyalty-related notifications through Apple Wallet and Google Wallet. These include service and loyalty notifications such as pass updates, balance updates and reward notifications; messages sent automatically from templates the business sets up, in response to loyalty activity, such as a relevant date, a period of absence, or a milestone reached; and, on Apple Wallet, a notification when a customer is near a configured business location. Promotional notifications are sent only where the customer has opted in to receive marketing communications, or where another applicable legal basis permits such communication - Change the look of a customer's wallet card for a limited time while the business runs a campaign, for example to show a seasonal design or a current offer. The change is applied to the card silently, and a notification about it is sent only where the customer has opted in to receive marketing communications - Follow up about the Service with people who asked for our contact card by scanning a Habulo QR code shown by a member of our team - Detect, prevent, and respond to fraud, abuse, and security incidents, including refusing registrations made with disposable email addresses - Keep a record of each acceptance of our Terms and this Privacy Policy, including the IP address and browser type it was made from, as evidence of that acceptance - Comply with legal obligations and enforce our Terms

We process personal data under the EU and Greek implementation of the GDPR. Which grounds apply depends on whose data it is, because we do not hold the same role for everyone. When we act as data controller (business users' own data) This covers the personal data of business owners and team members: account, profile, billing and usage data. - Contract performance: to provide the Service to you under our Terms. - Legitimate interests: to keep the Service secure, prevent fraud, debug errors, and improve features. We balance these interests against your rights. - Legal obligation: to retain billing records and respond to lawful requests. - Consent: where we rely on it, such as analytics cookies. You may withdraw it at any time. When we act as data controller (prospective customers) This covers the details you give us when you scan a Habulo QR code to receive our contact card. - Steps taken at your request: to issue the contact card you asked for. - Legitimate interests: to contact you about the Service after you asked us for our details in person. We have weighed this against your rights. The contact is business to business, it follows an approach you started, and every message carries a way to stop it. You may object at any time, including before we first write to you, by emailing info@habulo.com. When we act as data processor (end customers' data) This covers the personal data of customers who enroll in a business's loyalty program. The business operating that program is the data controller. It decides what is collected, for which purposes, and on which legal basis, and it is responsible for obtaining any consent required, including consent for promotional communications and for the data fields it chooses to collect. We process that data only on that business's documented instructions, as set out in our Terms. We do not determine the purposes or the legal basis for it ourselves.

We do not sell personal data. We share it only with the categories of recipient below, strictly as needed to operate the Service. The providers named are the ones we use today; where we change or add one, we update this list. - Hosting and infrastructure, including database and authentication: Supabase, Vercel. - Payment processing and subscription billing: Stripe. - Digital wallet platforms, for issuing and updating passes and delivering pass notifications: Apple (Apple Push Notification service / PassKit Web Service), Google (Google Wallet API). - Transactional email delivery: Resend. - Product and usage analytics: PostHog. - Automated assistance in the business dashboard: OpenAI. Only the loyalty and analytics data needed to answer the question asked is sent. Customers and team members are identified to it only by an internal reference, never by name, email address, phone number or date of birth, and the dashboard restores names from our own database when it shows the answer. Anything a business user types into a question is sent as written. Under OpenAI's API terms the data is not used to train their models. - Authorities: when required by a binding legal request, court order, or to protect rights, safety, or the integrity of the Service. - Successors: in the event of a merger, acquisition, or sale of assets, in which case the new entity will be bound by an equivalent privacy policy. Adding a recipient that processes personal data for a new purpose is a material change, and we notify you of it under section 11 before it takes effect.

Data we hold as controller (business users) We retain your account data for as long as your account is active. Your account ends when you close it from Settings, or when your subscription ends and is not renewed. We email you at least 14 days before the deletion, so that you can download a copy of your data from Settings, subscribe again, or cancel the closure. 90 days after your account ends we delete the associated personal data, except where we must keep limited records to meet legal, accounting, or tax obligations. Accounting and tax records are kept for five years from the end of the financial year they relate to, as Greek accounting law requires, and for as long as we hold them their use is restricted to those purposes. Data we hold as controller (prospective customers) Where you gave us your details by scanning a Habulo QR code, we keep them for five years from our last contact with you, or until you ask us to erase them or object to our contacting you, whichever comes first. Data we hold as processor (end customers) The business operating the loyalty program decides how long its customer data is kept, and you can export that data from your dashboard at any time while your account is active. When a business account or subscription ends, we give the business the opportunity to export its customer data before it is removed. Unless the business asks us in writing to return or retain it, the associated end customer records, loyalty cards, transactions, rewards and wallet pass registrations are deleted within 90 days of the account ending. A customer can erase their own data at any time from their private page, which the details link on their wallet pass emails to them, confirming the request through a link we email to the address they registered with, or ask the business, which can erase it from its dashboard. Either way, once confirmed, the customer's details, cards and history are deleted immediately. Server logs and analytics events These are kept only as long as needed for security and product analytics, typically no more than 90 days. Acceptance records A record of an acceptance, including the IP address and browser type it was made from, is kept for as long as the account, customer record or contact details it belongs to, and is deleted together with them. Accountability records Accountability records, namely the log of assistant questions and answers and the log of support access to an account, are kept beyond the periods above because their purpose is to evidence who accessed personal data and when. They are retained no longer than needed for that purpose and are not used for any other.

Under the GDPR you have the right to: - Access: request a copy of the personal data we hold about you. - Rectification: ask us to correct inaccurate or incomplete data. - Erasure: ask us to delete your personal data ("right to be forgotten"). - Restriction: ask us to limit how we use your data. - Portability: receive your data in a structured, machine-readable format. - Objection: object to processing based on legitimate interests and, at any time, object to the use of your personal data for direct marketing purposes, including profiling related to such marketing. - Withdraw consent: where processing is based on consent, you may withdraw it at any time. - Automated decision-making: we do not make decisions producing legal or similarly significant effects about you based solely on automated processing. The segmentation used for loyalty analytics and campaign audiences does not produce such effects. - Lodge a complaint: with the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, Greece, contact@dpa.gr, +30 210 6475600, www.dpa.gr) or your local supervisory authority. Where to exercise these rights depends on who holds your data. If you are a business user, we are the controller of the data we hold about you. Email info@habulo.com. If you gave us your details by scanning a Habulo QR code, we are the controller of those details. Email info@habulo.com to see them, correct them, have them erased, or tell us to stop contacting you. If you are a customer of a business that uses Habulo, that business is the controller of your data, so contact it first. We act on its instructions and will assist it in responding to you. You may also email us at info@habulo.com and we will pass your request to the relevant business, or act on it directly where we are able to.

We use cookies that are strictly necessary to run the Service: authentication and session cookies (Supabase), small preference cookies for theme and language, and a cookie that records your cookie-consent choices. PostHog, which we use for product analytics, runs cookieless until you accept analytics cookies in our cookie banner; if you accept, it may set cookies to recognize your browser across sessions. You can change or withdraw your consent at any time from the cookie-preferences link on our website. On the billing pages we load Stripe.js, so that card details go directly into Stripe's own fields and never reach our servers. Stripe may set cookies there to detect and prevent fraud. They are strictly necessary to take a payment securely and are set only on the billing pages. We do not run third-party advertising or behavioral tracking.

Our primary infrastructure is located inside the European Economic Area: our database and file storage run in Stockholm, Sweden, and our application runs in Paris, France. Personal data therefore stays within the EEA by default. Some of our other service providers (Stripe, Apple, Google, Resend, PostHog, OpenAI) may process data on infrastructure located outside the EEA, including in the United States. When data leaves the EEA we rely on transfer mechanisms approved under the GDPR, such as the European Commission's Standard Contractual Clauses and the EU to U.S. Data Privacy Framework where applicable.

We protect personal data using TLS encryption in transit, encryption at rest on managed database and storage infrastructure, row level security in the database so that an account can reach only its own records, separate credentials for user scoped and server side access, logging of administrative access to accounts, rate limiting of public endpoints, and an automated test suite that runs on every deployment. No system is perfectly secure; if we become aware of a breach affecting your personal data we will notify you and the competent authority as required by law.

The Service is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact info@habulo.com and we will delete it.

We may update this Privacy Policy from time to time. When changes are material we will notify you by email or through the Service before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you registered for a digital loyalty card from a business that uses Habulo, this section summarizes how your data is handled in plain language. Who you are dealing with: The business that owns the loyalty program is the primary owner of your data: they decide what to collect and how to communicate with you. Habulo runs the technical platform and acts as their processor. What we store about you: Your email address, plus whatever else the business running the loyalty program has chosen to collect. That falls into three groups: contact details such as your phone number, identity details such as your name, and optional profile details such as a date of birth or a preference you choose to share. The business decides which of these it asks for and which are required. What those details are for: They operate the loyalty program you joined. Depending on what the business collects, they let staff find your card when you do not have your wallet pass with you, help prevent duplicate registrations, provide date-related benefits such as birthday rewards, contribute to aggregate statistics such as age ranges, and let the business recognize what you usually choose. We also store information about how you use the loyalty program, including your balance, rewards, redemptions and the timing of your interactions. If the program connects customers to one another, such as an invitation from someone who already holds a card, we store the link between your cards. If the business has assigned you a reference, such as a membership or policy number, we store it and show it on your card. If you add the card to Apple Wallet or Google Wallet, the wallet platform tells us your device's pass identifier and a push token so we can update the card and send notifications. We never see your Apple ID, Google account, or phone number from the wallet. When you register, we also record that you accepted our terms, when, and the IP address and browser type of the device you used, so the registration can be shown to be genuine. Loyalty insights: Your loyalty-program activity may be analyzed to create engagement and re-engagement segments that help the business understand customer behavior and identify changes in engagement. These insights may also be used to select audiences for relevant campaigns. Promotional communications based on these insights are sent only where you are eligible to receive marketing communications. Notes about you: The business can write private notes about you, such as a service preference or a reminder for its staff. Only that business sees them. They are included if you ask for a copy of your data, and deleted if you ask to be erased. Questions the business asks about its own data: The business's dashboard has automated assistance it can ask about its loyalty program. We keep a record of those questions and answers so that access to your data is accountable, which means such a record can contain your details. Our own support staff may also need to access a business account to fix a problem, and that access is logged too. Why we hold your data: To operate the loyalty program you signed up for, including issuing and retrieving your card, tracking your balance and rewards, providing loyalty benefits, generating loyalty analytics and helping the business understand engagement with its loyalty program. If you have opted in to marketing communications, the business may also use loyalty-program information and engagement insights to send you relevant offers and messages, including ones sent automatically from the business's templates for occasions such as a birthday, a period of absence, or a milestone you reach. Your card's appearance: For a limited time, your card may show the business's seasonal design or a current offer. This only changes how the card looks, never your balance or rewards, and it is not accompanied by a notification unless you have agreed to receive promotional messages. Who sees your data: The business that issued the card sees it. Our service providers process it strictly to operate the Service: Supabase and Vercel host it, Apple and Google deliver your wallet pass, Resend sends emails, and PostHog provides product analytics. When a business asks the AI assistant in its dashboard a question about its own loyalty program, the loyalty activity needed to answer it is sent to OpenAI under an internal reference instead of your name or contact details (unless the business types them into its question itself), and is not used to train their models. We do not sell your data and we do not share it with advertisers. Your choices: You can delete your data yourself at any time from your private page, which the details link on your wallet pass emails to you. To make sure it is really you, we email a confirmation link to the address you registered with, and nothing is deleted until you use it. You can also ask the business to do it. Either way, once confirmed, your details, cards and history are deleted immediately. A card in Google Wallet then expires; a card in Apple Wallet stops updating and you can remove it from the Wallet app. You can disable notifications at any time from your wallet pass settings, and the details link on your pass emails you a link to your private page, which you can use to update your information and change your notification preferences yourself. You can ask us directly to access, correct, or delete your personal data by emailing info@habulo.com. You can lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr). Age: You must be at least 16 to register on your own. If you are under 16, ask a parent or guardian to register for you.

This Privacy Policy is published in English and in Greek and both versions are authentic. If there is a discrepancy between them, the Greek version prevails for people established in Greece and the English version prevails for everyone else.