Quardy

1. Introduction

This Privacy Policy describes how Quardy, published by Damien Buchet (SIRET: 52825331300035), collects, uses and protects your personal data.

It applies to the Quardy mobile app (App Store and Google Play), to loyalty cards and gift cards added to Apple Wallet or Google Wallet, to the related web pages (qr.quardy.app, account.quardy.app) and to the quardy.app website.

2. Data controller

Damien Buchet
SIRET: 52825331300035
Email: damien@quardy.app
Website: https://quardy.app

Quardy is the controller of your account data (customer or merchant). However, for the data of a business's customers (loyalty cards, visit history, manually added customers, gift cards), the merchant is the controller and Quardy acts as a processor on their behalf. Quardy's commitments to merchants are set out in the Data Processing Agreement (DPA).

3. Roles in Quardy

• Customer: you collect loyalty cards from businesses, in the app or directly in your Wallet, without an account
• Merchant: you create and manage a loyalty program for your customers
• Team member: you scan customers' cards on behalf of a business (Business plan)

A single account can hold several roles.

4. Data collected

Quardy only collects the data needed to run the service.

4.1 Account data

• First and last name: to identify you to merchants
• Email address: to sign in to your account and, for merchants, for service-related emails
• Preferred language and date of acceptance of the terms of use

4.2 Loyalty data

• Loyalty cards: businesses you joined, language of the card
• Balance: stamps, points or cashback
• Visit history: date, operation, purchase amount if any, team member who scanned
• Marketing consent: whether you accept the merchant's communications

4.3 Cards added to the Wallet without an account

You can add a card directly to Apple Wallet or Google Wallet without creating an account. We then store the card, its balance and history, and your first and last name if you provide them (the merchant can make them mandatory). To update the card in Apple Wallet, we keep technical identifiers sent by your device (registration identifier and Apple push token).

When a merchant has set the location of their shop, any card from that business added to Apple Wallet or Google Wallet (with or without an account) contains the geographic coordinates of the shop. Your phone alone decides to show you the card when you are nearby, based on your Wallet's location and notification settings: your location is never sent to Quardy or to the merchant. You can turn this suggestion off in the card's options (Apple Wallet) or in Google Wallet's settings.

4.4 Customers added by the merchant

A merchant can register a customer who uses neither the app nor the Wallet (for example someone without a smartphone). The merchant then enters their first name, last name and/or phone number. This data is only visible to that merchant.

4.5 Gift cards

When a merchant issues a gift card, we store the recipient's first name and email address, the sender's first name, the amount and the balance, in order to send the card to the recipient and allow its use.

4.6 Merchant data

• Business: name, address, logo, background image, card and program settings
• Subscription: plan and Stripe customer identifiers. Payment data is processed by Stripe only
• Team (Business plan): team members and invitation codes
• Campaigns: content of the notifications sent and number of recipients
• Statistics: number of new customers and visits per day

4.7 Technical data

• Notification token: to send you notifications, if you allow them
• Error reports: device model, app version, IP address and account identifier when an error occurs, to fix malfunctions
• Performance measurements: app startup times, update downloads and app errors, with a random identifier specific to the installation and not linked to your account (no name, email or account identifier), to make the app faster
• IP address: only stored in hashed form, to limit abuse of public pages

5. Purposes and legal bases

• Creating and managing your account and cards: performance of the contract
• Management of the loyalty program by the merchant: performance of the contract (Quardy acts for the merchant)
• Merchants' marketing communications (notification campaigns): consent
• Sending gift cards to the recipient: performance of the merchant's request
• Onboarding and information emails to merchants: legitimate interest, with the option to unsubscribe at any time
• Subscription management and billing: performance of the contract and legal obligations
• Security, abuse prevention and error fixing: legitimate interest

6. Data sharing

6.1 With merchants

When you join a loyalty program, the merchant has access to:

• Your first and last name (if provided)
• The status of your card (stamps, points, cashback) and the visit history
• Your marketing preference
• Your email address, only if you accepted their communications, in the export of their customer list

6.2 With our processors

We never sell your personal data. We use the following providers, only to run the service:

• Google Cloud / Firebase (Google): hosting, database, authentication, file storage and server processing. European Union
• Apple: Sign in with Apple, Apple Wallet cards and their updates
• Google: Sign in with Google, Google Wallet cards and their updates
• Stripe: payment and management of merchants' subscriptions
• Resend: sending emails (merchant emails, customer exports, gift cards). United States
• Expo (650 Industries): delivery of the app's push notifications and measurement of its performance. United States
• Sentry (Functional Software): technical error monitoring. United States
• Cloudflare: hosting and protection of the quardy.app website

7. Retention period

• Account data: as long as your account is active
• Loyalty cards and visit history: as long as the card exists. A card removed by the merchant stays visible in your app, deactivated, until you delete it
• Gift cards: during their validity period, then as long as the merchant keeps them
• Billing data: kept by Stripe in line with applicable legal obligations
• Error reports: limited period, according to Sentry's retention policy
• Performance measurements: 90 days

When you delete your account, your account data, your cards and their history are deleted. If you are a merchant, your business is deleted and your customers' cards are deactivated.

8. Data security

• Encryption of data in transit (HTTPS/TLS) and at rest
• Hosting in Europe on Google Cloud (Firebase)
• Authentication through Firebase Authentication, with no password stored by Quardy
• Server-side access rules: a merchant can only access their own customers' data
• Limited rights for team members (scanning only)
• Rate limiting on public pages

9. Your rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access: view your data in the app or on request
• Right to rectification: edit your information in the settings
• Right to erasure: delete a card, or your account and all your data
• Right to data portability: receive your data in a structured format (contact us)
• Right to object and to restriction of processing
• Right to withdraw consent: refuse a merchant's communications at any time, from the card concerned

To exercise these rights, use the app's features or write to us at damien@quardy.app. If your request concerns the data a business holds about you, you can also contact that merchant directly; we will help them respond.

10. App permissions

• Camera: to scan QR codes
• Notifications (optional): to inform you of your rewards and of the merchant messages you accepted
• Photo access (optional): to add a business's logo or background image

11. Cookies and tracking

The Quardy mobile app does not use cookies. We do not use behavioral analytics or targeted advertising services.

12. Transfers outside the European Union

Your data is hosted in the European Union, on Google Cloud (Firebase). Some of the processors listed above (notably Resend, Expo, Sentry, Stripe, Apple and Google) may process data in the United States. These transfers are governed by the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.

13. Minors

Quardy is not intended for people under 16. We do not knowingly collect data about minors.

14. Changes to this policy

We may modify this privacy policy. Any significant change will be notified to you via the app or by email. The date of the last update is indicated at the bottom of this document.

15. Contact and complaints

For any questions regarding your personal data:

Email: damien@quardy.app
Website: https://quardy.app

You can also file a complaint with the French Data Protection Authority (CNIL):

CNIL
3 Place de Fontenoy
TSA 80715
75334 PARIS CEDEX 07
Website: www.cnil.fr