Privacy Policy

3.1 Business Owner Information

When you register as a business owner, we collect:

• Account Information: Email address, password (encrypted)
• Business Information: Business name, legal entity name, business address, city, postal code, country
• Usage Data: Login times, features used, actions performed
• Technical Data: IP address, browser type, device information, operating system

3.2 Customer Information (Loyalty Program Members)

When you join a business's loyalty program, we collect:

• Personal Information: First name, last name, email address, date of birth
• Loyalty Data: Visit records, services used, promotions redeemed
• QR Code: Unique identifier for your digital loyalty card
• Consent Records: Your acceptance of terms and privacy policy

3.3 Automatically Collected Information

We automatically collect certain information when you use the Service:

• Log data (timestamps, actions, errors)
• Device information (type, operating system, browser)
• Usage patterns and analytics
• Cookies and similar tracking technologies

5.1 Business Owner Data

We use business owner information to:

• Create and manage your account
• Provide the Service's features and functionality
• Process your requests and communications
• Send service-related notifications
• Improve and optimize the Service
• Detect and prevent fraud or abuse
• Comply with legal obligations

5.2 Customer Data

We use customer information to:

• Generate and deliver digital loyalty cards
• Track visits and loyalty progress
• Process promotion redemptions
• Send loyalty cards and updates via email
• Enable businesses to manage their loyalty programs

6.1 We Share Your Data With:

• Payment Processor: Stripe, Inc. processes payments on our behalf (see Section 6.3 below for details)
• Service Providers: Email service providers, hosting providers, analytics services (only as necessary to provide the Service)
• Business Owners: Customer data is shared with the business whose loyalty program you joined
• Legal Requirements: Law enforcement or regulatory authorities when required by law

6.2 We Do NOT:

• Sell your personal data to third parties
• Share your data for marketing purposes without consent
• Transfer data outside the EEA without appropriate safeguards
• Store, collect, or process any payment card information

6.3 Payment Processing (Stripe)

We use Stripe, Inc. as our third-party payment processor. When you make a payment through the Service:

• Carthy does not store any payment card information. All payment details (credit card numbers, expiration dates, CVV codes) are provided directly to Stripe through their secure, PCI-DSS compliant payment forms.
• Stripe may collect and process your payment information, including your name, email address, billing address, and payment card details, in accordance with their own privacy policy.
• Carthy only receives confirmation of payment status and basic transaction information (such as amount, date, and a transaction identifier) necessary to provide the Service.

Stripe acts as an independent data controller for the payment information it collects. For more information on how Stripe handles your data, please review:

• Stripe Privacy Policy: https://stripe.com/privacy
• Stripe Terms of Service: https://stripe.com/legal

10.1 Right to Access

You can request a copy of your personal data we hold.

10.2 Right to Rectification

You can request correction of inaccurate or incomplete data.

10.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data when:

• Data is no longer necessary for its original purpose
• You withdraw consent
• You object to processing
• Data was unlawfully processed

10.4 Right to Restrict Processing

You can request limitation of processing when:

• You contest the accuracy of data
• Processing is unlawful but you don't want erasure
• We no longer need the data but you need it for legal claims

10.5 Right to Data Portability

You can request your data in a structured, commonly used, machine-readable format.

10.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing.

10.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time.

10.8 Right to Lodge a Complaint

You can lodge a complaint with your national data protection authority.

12.1 Cookies We Use:

• Essential Cookies: Required for authentication and security (cannot be disabled)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how users interact with the Service (with your consent)

12.2 Managing Cookies:

You can control cookies through your browser settings. Note that disabling essential cookies may prevent use of the Service.