Privacy Policy

1. Who We Are

Punch (“we,” “us,” or “our”) operates the Punch Loyalty Rewards platform at usepunch.app. This Privacy Policy explains how we collect, use, and protect the information you provide when using our Service.

2. Information We Collect

We collect the following categories of information:

• Phone numbers — collected when you sign up or use phone-based login. Used to send one-time verification codes and, for merchants who opt in, daily loyalty code SMS notifications.
• Email addresses — collected when you sign up or use email-based login. Used to send one-time verification codes and service communications.
• Business information — for merchants: your business name and URL slug, used to identify your loyalty program to customers.
• Punch activity — visit counts, punch card progress, and reward redemptions tied to your account. This data powers the loyalty program and analytics features.
• Usage data — standard technical information such as IP addresses, browser type, and pages visited, collected automatically to operate and improve the Service.

3. How We Use Your Information

We use the information we collect to:

• Operate and maintain the loyalty platform for merchants and customers
• Send one-time verification codes for account login via SMS or email
• Send daily loyalty codes to merchant accounts that have opted in to SMS notifications
• Track punch card progress and reward eligibility for customers
• Provide merchants with visit analytics for their loyalty programs
• Detect and prevent fraud and abuse of the Service
• Respond to support requests and communicate about your account

4. How We Share Your Information

We do not sell your data. We share your information only in the following limited circumstances:

• Twilio — our SMS delivery provider. When we send you a text message, your phone number is transmitted to Twilio to deliver that message. Twilio's use of your data is governed by Twilio's Privacy Policy.
• The merchant whose loyalty program you joined — if you are a customer participating in a merchant's loyalty program, that merchant can see your punch card activity (visit count, reward status) associated with their program. The merchant does not see your full contact information unless you have independently provided it to them.
• Legal requirements — we may disclose your information if required to do so by law, court order, or to protect the rights, property, or safety of Punch, our users, or others.

5. Data Retention

We retain your personal information for as long as your account is active. If you close your account, we will delete your personal data within a reasonable period, typically 90 days, unless we are required by law to retain it longer. Aggregated, anonymized analytics data may be retained indefinitely as it cannot be used to identify you.

6. Your Rights and Choices

You have the following rights regarding your personal information:

• Access — you may request a copy of the personal information we hold about you.
• Correction — you may update your contact information through your account settings or by contacting us.
• Deletion — you may request deletion of your account and associated personal data.
• SMS opt-out — text STOP at any time to stop receiving SMS messages from Punch.

To exercise any of these rights, contact us at hello@usepunch.app.

7. Security

We implement industry-standard security measures to protect your personal information, including encrypted data transmission (HTTPS), secure database access controls, and short-lived authentication tokens. No method of transmission over the Internet is 100% secure, but we take reasonable precautions to protect your data.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the “Last updated” date at the top of this page. Continued use of the Service after changes constitutes acceptance of the revised policy.

9. Contact

Questions about this Privacy Policy or how we handle your data? Contact us at hello@usepunch.app.