Merchant Privacy Policy

Safyah Rewards Merchant is operated by Safyah Solutions ("we", "us"). This policy covers business owners, managers and staff who use it. Information about your customers is covered by our customer Privacy Policy, and your responsibilities for it are in the Merchant Terms.

• Account details. Your name and email address. If you sign in with Google or Apple, we receive your name, email address (which may be an Apple private relay address) and an account identifier from that provider.
• Business details. What you enter about your business: name, logo and cover image, category, description, brand colour, phone, email, website, and each location's name, address and map position. Your programmes and rewards.
• Team details. Which businesses you belong to, your role in each, when you joined, and invitations you create.
• Activity. The points you award, corrections you make and rewards you confirm are recorded with your name, as part of the business's history.
• Subscription details. Your plan, its status and renewal or expiry date. Payment is handled by Apple or Google; we never receive your card details.
• Notifications and technical data. A push token for your device, your in-app inbox, and server logs including your IP address, device type and the time of each request.

The app asks for these only when you use the feature that needs them:

• Camera, to scan customers' codes and team invites. Images are read on your device and never uploaded or stored.
• Photos, to choose a logo. Only the image you pick is uploaded.
• Location, to centre the map when you place your business on it. Your own location is not stored; only the position you choose for the business is saved.
• Bluetooth, on Growth, to broadcast your counter signal for "Here now". The signal carries a code that changes every few minutes and identifies your business, not you. The app doesn't collect anything through it.

• To create and secure your account, including emailing sign-in codes.
• To run your businesses: publish your listing, apply your programme rules, record scans and redemptions, and show your dashboard.
• To manage your team's access according to each person's role.
• To check your plan and apply its limits.
• To send notifications such as redemption and join requests from customers.
• To prevent fraud and abuse, keep the service reliable, and answer your questions.

• The public. Once a business is live, its listing (name, logo, cover, category, description, contact details, locations and active programmes) is visible to everyone using Safyah Rewards, including on the Nearby map.
• Your team. Colleagues see your name, role and when you joined. Owners and managers see your email address; staff see it partly hidden.
• Customers. Customers see a business's listing, programmes and rewards. Their card history shows points and rewards but not which staff member recorded them.

We share information only with providers that help us run the Service, under contracts that limit their use of it:

• our cloud hosting provider, which stores the service's data;
• RevenueCat, which manages subscriptions and receives your account identifier and purchase records from the App Store or Google Play;
• Apple and Google, who process subscription payments and, if you choose, sign-in;
• Google Firebase Cloud Messaging, and through it Apple Push Notification service, to deliver notifications;
• Apple Maps (on Apple devices) or Google Maps (elsewhere), which draw the map in the location picker and look up the addresses you search for;
• our email delivery provider, to send sign-in codes.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of our business. We do not sell personal information or use it for advertising.

We keep your account and business information while your account exists. Inbox notifications are deleted after 90 days and server logs after a short period.

When you delete your account (Account → Delete account), we delete your profile, memberships, push tokens and notifications, and every business you own along with its programmes, rewards, locations, team memberships and customer cards. At businesses where you were a manager or staff member, the history you recorded stays but your name is removed from it. Subscription records may be kept where the law requires it, for example for tax.

• Edit your business details and your own name in the app.
• Turn notifications and device permissions on or off in your device settings.
• Leave a team you've joined, or delete your account.
• Ask us for a copy of your data, or to correct, restrict or delete it, by emailing support@safyah.com.

Depending on where you live, you may have further rights, including the right to complain to your local data protection authority.

Data travels over encrypted connections, access is checked against each person's role at each business, and points can only be changed by our servers, with every change recorded. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you as the law requires.

Safyah Solutions is based in Saint Vincent and the Grenadines, and our service providers may process data in other countries, including the United States. When we transfer data, we use safeguards required by applicable law.

We will update this page when our practices change and revise the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.

Questions or requests about your privacy: support@safyah.com.