Draft: the highlighted details still need filling in (web/src/lib/brand.ts), and this should be checked by a solicitor or template service before launch.

Privacy policy

Last updated: (to be confirmed)

Who we are

One On Us is run by (to be confirmed) ((to be confirmed)), (to be confirmed). We are the data controller for the information described here. Contact us about privacy at hello@oneonus.co.uk.

If you use the app as a customer

You can browse without an account. To collect rewards you create a free account, and we store:

• your first name, email address and password (the password is stored encrypted)
• your birthday, if you choose to add it
• whether you'd like news and offers from us by email (you can change this any time)
• the businesses you've connected to (your loyalty cards)
• the date and time of each visit you log by scanning a business's code
• which rewards you've unlocked and when you used them
• for each business, whether you'd like one-off offers from them (off unless you turn it on), the offers they've sent you, whether you've opened them and when you used them

The camera is only used to read QR codes. Photos and video are never saved or sent to us. We don't track you across other apps or websites, show you ads, or sell your data.

What businesses see. Each business you visit can see your visit history and rewards at their business only, and your first name if you allow it (you can turn this off in Account). They never see your email address or birthday. You also have a short code (for example #3F9A1C) that's different at every business. If you turn on offers from a business, it can send you offers in the app, at most one a week, and see how many of its offers were opened and used. You can turn offers off on its page at any time.

If you use the dashboard as a business

We store:

• your email address and password (the password is stored encrypted)
• your business name, category, address and reward program
• notices and offers you post, and the logo and photo you upload
• visit and reward data from customers at your business, as described above

Your business name, address, rewards, notices, logo and photo are shown publicly in the app so customers can find you.

If we're acquired

If One On Us is ever sold or merges with another company, your data may transfer to the new owner, who must keep protecting it as this policy describes.

Why we use your data

• To provide the service (running loyalty cards, rewards and the business dashboard). This is necessary for our contract with you.
• To keep rewards fair, for example limiting how often a visit can be logged. This is in our legitimate interests and those of the businesses.
• To show businesses how their loyalty program is doing through anonymous statistics about visits. This is in our and their legitimate interests.

Who we share it with

We use Supabase to store data and run accounts, and a hosting provider to run the dashboard website. They process data only on our instructions. Your data is stored in (to be confirmed). Where a provider handles data outside the UK, we rely on the safeguards UK law requires, such as the UK's International Data Transfer Addendum. We don't sell or share your data with anyone else, unless the law requires it.

How long we keep it

We keep your data while your account exists. When you delete it, it's removed straight away from our live systems and disappears from backups when they're overwritten shortly after.

Deleting your data

• Customers: in the app, go to Account → Delete my account. This removes your account, cards, visits and rewards. Deleting the app alone does not remove them.
• Businesses: on the dashboard, use Delete account at the bottom of the page. This removes your business and all its customer records.

Your rights

Under UK data protection law you can ask to see, correct, delete or move your data, and object to or restrict how we use it. Email hello@oneonus.co.uk. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

One On Us isn't aimed at children under 13, and we don't knowingly create accounts for them.

Changes

If we change this policy, we'll update the date at the top, and tell businesses by email about significant changes.