Privacy Policy

• Businesses and their staff who use the SAAHB dashboard. For this data Epic World (FZE), licence no. 3392 is the controller.
• Customers who join a business's loyalty program (for example by scanning a QR code). For this data the business you joined is the controller and SAAHB processes it on the business's behalf. Questions about how a business uses your data should go to that business first; you can also use the options on your card page.

Business users:

• name, work email, business name, country and language;
• your password, stored only as a salted hash, and two-factor authentication secrets, stored encrypted;
• sign-in sessions and security records: IP address, browser and an audit log of important actions.

Loyalty customers (only what the business's join form asks for):

• name, phone number and/or email, country and preferred language;
• your birthday (day and month on the join form, if you choose to give them; a business may also record the year), and any notes the business adds to your profile;
• whether you agreed to receive offers, with the time and the exact wording you agreed to;
• your card and its activity: stamps, points, rewards, balances and the branch and staff member for each visit;
• if you add your card to Apple Wallet or Google Wallet, the technical identifiers those services need to update it;
• messages sent to you and whether the provider accepted them.

Payments: card details are entered on Stripe's pages and never reach SAAHB. We receive the payment result and amounts.

• to run the loyalty program: record visits, update your card and wallet pass, and give rewards;
• to keep accounts and data secure, prevent fraud and investigate problems;
• to bill businesses for their plan;
• to send offers, only when you agreed to receive them; service messages about your own card (for example a reward unlocked) do not need that consent;
• to meet legal and accounting obligations.

We do not sell personal data and do not use it for advertising.

Only service providers that help run SAAHB, and only what they need:

We may also disclose data when the law requires it. Each business can only see its own customers; one business's data is never shown to another.

Some providers above may process data outside your country. The hosting location and the safeguards used for international transfers will be stated in the final version of this policy.

• Sign-in sessions end after 7 days at most (8 hours of inactivity).
• Customer data is kept while the business runs its program. A business can set customers with no activity for a chosen period (at least 180 days) to be deleted automatically.
• Deleting a customer erases their name, contact details, birthday and notes and revokes their card. Records of stamps, points and payments are kept without personal details because businesses need them for accounting and refunds. Remaining traces (such as the IP address stored with a consent record) are removed after the business's purge period.
• Business account data is kept while the account is open and then deleted, except records we must keep by law.

• Loyalty customers can ask for a copy of their data or for deletion from their card page, change their language there, reply STOP to text messages and use the unsubscribe link in emails.
• You can withdraw consent to offers at any time; the business stops sending them.
• Depending on where you live you may also have rights to correct data, object to or restrict its use, and complain to your data-protection authority.
• Business users can manage their details in the dashboard and contact us for anything else.

Connections are encrypted. Passwords are hashed, secrets and provider keys are encrypted, and each business's data is isolated in the database so one business cannot read another's. Owners can require two-factor authentication for all staff, and sign-in attempts are rate limited. No system is perfectly secure; if a breach affects you, we and the business will tell you as the law requires.

SAAHB is a service for businesses. Businesses should not enrol children below the age set by local law without a parent's or guardian's consent.

We will update this page when our practices change and change the date at the top. Important changes will be announced in the dashboard.

Epic World (FZE), licence no. 3392. Email: [email protected]. Registered address: to be added.