Privacy notice

> Draft for development — not yet reviewed by a PDPA specialist Looplet runs the membership card and points system that connects customers with shops. 1. What we collect - The email from your sign-in provider, and the display name you choose - The phone number you type in yourself (not treated as verified) - The shops you follow, your points balance, and your redemption history - Approximate location, when you open the nearby-shops view 2. Who sees your data - A shop you are a member of sees your name, phone number and points balance - Other shops do not see your data, and points from one shop cannot be used at another 3. Lawful basis - Contract: providing the account, the membership and the points - Consent: marketing, location, and usage analytics (withdrawable at any time) 4. Your rights - Ask to see, correct or delete your data, and withdraw consent, from the privacy screens in the app - Contact the data controller at [contact email] 5. Retention - Consent records are kept for the life of the account and for 2 years after it is closed - Points and voucher history are kept as accounting law requires