Privacy Policy — Rewardtree

The short version

We collect the minimum a loyalty card needs: your mobile number, your first name, and your stamps and rewards.
A shop can text you offers only if you tick that shop's own box ("{Shop} can text me offers"). The box is never pre-ticked.
Reply STOP to any offer and no shop on Rewardtree can text you offers again, unless you later tick a shop's box when you join it.
A shop can email you only if you tick its own email box and confirm your email. Every email has a one-tap Unsubscribe that stops that shop's emails. Shops never see your email address.
A shop's card may remind you when a reward is waiting, on your Wallet card, and by text when you haven't been in, but only if you ticked that shop's box. One tap on the back of your card switches a shop's reminders off.
A shop sees only its own customers, at its own shops. It never sees where else you shop.
No ads, no ad networks, and we never sell or rent personal information.

Who we are

Rewardtree is run by NK Tech Pty Ltd, an Australian company in Sydney. We run loyalty cards for local shops. When you join a shop's card, the shop runs its loyalty program, and we hold and use your information to run it for them and to run Rewardtree. We handle personal information under the Australian Privacy Principles in the Privacy Act 1988 (Cth).

What we collect from customers

Mobile number: how you join and sign in (we text you a code). One mobile number is one customer, so your cards and stamps belong to your number, not to a phone.
First name: shown on your card, on the reward screen, and to the shop. If you change it at rewardtr.ee/manage, we note that it changed, when, and the internet address it came from, never the name itself.
Stamps and rewards: each stamp and reward at each shop, and when. This history is never rewritten: a correction is added as a new entry.
Offer consent, shop by shop: whether you ticked "{Shop} can text me offers", when, and on which shop's page. A tick for one shop never lets another shop text you.
STOP: if you reply STOP to an offer, your number, when, and the word you used (see Offers by text).
On a shop's page: a cookie that remembers your card on that phone (see Cookies), and roughly how far you were from the shop when you collected a stamp or used a reward (see Your location).
A stamp outside a shop's opening hours: if a shop has set its opening hours and a stamp is collected more than 30 minutes before it opens or after it closes, it doesn't count. We keep a note of it: which card, which shop, the time there, how far outside the hours it was, whether your phone shared its location, and which phone and internet address it came from. Never where you were. We use it to check the rule works fairly, and delete it after 90 days.
Your Wallet card: when you add your card to Apple Wallet or Google Wallet, an identifier for it, so we can update the card after each stamp. For Google Wallet, Google also tells us, each time we update the card, whether someone has it saved, so reminders only go to cards that are really in a Wallet.
Reminders: which reminders a shop's card sent you (the shop, which kind, how and when, and whether it went) and whether you switched a shop's reminders off. A reminder by text is also kept like an offer text, its words included (see Reminders about your card).
Your email and birthday, only if you give them for emails from shops: your email, the language you used, when you confirmed it and, only if you add it, your birthday (the day and month, never the year). For each shop, whether you said yes to its emails, when and where, and every stop (see Emails from shops).
Email (only if you added one in the older Rewardtree customer app): if you confirmed it in the Rewardtree app's Profile, you can also use it to sign in to that app, with a code we email you. Shops don't see it. Confirming it never signs you up for offers.

We never collect customers' payment details.

Your location on a shop's page

When you collect a stamp or use a reward on a shop's page, your phone may ask to share its location. We use it at that moment to check you're near the shop.
We keep only roughly how far you were from the shop (to the nearest 100 m), how precise your phone said its location was (to the nearest 10 m) and, when it didn't share a location we could use, why (for example, you said no or it took too long). We never keep where you were.
We also count these across many customers to check that every shop where customers collect stamps is on its business's plan. For that count we also use which card and phone each stamp came from, the internet address and the time. The count never shows anyone's name or number, and we keep nothing new for it.
Saying no never stops you getting your stamp. The shop may see "Shop not known" next to that stamp, when its business has more than one shop and can't tell which one you were at.
The older Rewardtree customer app can use your location, if you allow it, to show shops near you. It's used for that search only.
The older Rewardtree Merchant app records where the shop's phone was when it scanned a card, to check the scan happened at the shop.

Cookies

rt_card (customers): a shop's page remembers your card on this phone, so next time you just scan. It lasts up to 400 days, or until you clear your browser. We store only a scrambled copy of it, and deleting your account switches it off.
Shop owners' sign-in cookies (rewardtree.com.au): a session cookie; a "stay signed in" cookie (up to 400 days, or until you sign out); rt_device, a random id for this browser (5 years), so we can tell you when a new device signs in; and rt_carry and rt_carry_start (5 minutes), used only while moving you across from our old address.
Every page: a short session cookie and a form-safety cookie (XSRF-TOKEN) that expire soon after you stop using the page. On our website the session cookie also remembers the first page you opened, so if you sign up a business we know how you found us. If you don't sign up, it's gone when the session ends. If you chat with us on our website, the same cookie keeps your chat open while you move between our pages (see Chatting with us).
Our network security provider, which protects our sites, may set its own security cookies (for example, to tell people from bots).

We use no advertising cookies and no analytics cookies.

Counting visits: on our website's own pages (not a shop's page, and not a shop owner's pages) we count visits without cookies: which page was opened, the website that sent you there, and roughly your country and type of device. It can't tell who you are, and it's never used for ads.

We also count visits ourselves, on our own server, in the same way: only daily totals, and we don't keep your internet address.

What we collect from shop owners

Your shop: its name, your reward, your logo if you add one, your shops' addresses (found with the address search below) and your shop's link.
Signing in: your Australian mobile (we text you a code) and, only if you choose it, your Google sign-in (the account id, and the email and name Google shares). An older account may also have an email address on it. We never use an email address to find or connect an account.
Devices and sign-ins: the phones and browsers you sign in on (a scrambled device id, never the id itself, the device's name, and when it was first and last used), and when you last signed in. We use these only to email you when a new device signs in, and to keep your sign-in safe.
Your plan: paid on our secure payment page. We never see or store your full card number. We keep a reference number for your business's billing, your plan and whether it's paid.
Where to post things we send you: the name and address you type as your shipping address (it can be your home), and an optional note for the delivery. We use it only to post you what you ask for or we offer you, like a free counter sign. It's never on your shop's page, and never in a text or a phone alert. You can see it, and so can your managers (if you have any) and the people who pack and post it for us. If a manager gives or changes it, we tell you.
Texts you send: your words, when you sent them, how many customers they went to, and whether each one arrived. And your text credits: what you bought, used and got back.
How you found us: the first page of our website you opened before signing up and when, the name of the website that sent you there (never the page itself, unless it was a page on Rewardtree, like a shop's page), any campaign tags on that link, which of our buttons opened the sign-up form and, if you tap one, your answer to "How did you hear about us?" (it's optional). We keep it with your business and use it only to see how shops find Rewardtree.
Rewardtree tips and news: whether you ticked the box to get them by text, and when. It's never ticked for you, and to stop them, email [email protected].
People you let into your owner page: their name, mobile and the same sign-in records.
Alerts on your phone or computer, only if you turn them on: when you tap "Turn on alerts" on your owner page and allow it, your browser gives us an address at its notification service and two keys for that device. We keep them with your sign-in, with a name for the device (like "iPhone · Safari"), and use them only to send you alerts about your shop. An alert says your shop's name and what happened, like "{Shop}: 3 stamps need a look" or "{Shop}: 12 new customers today". It never has a customer's name or number in it, and it's encrypted for your device, so the notification service can't read it. To stop them, tap "Turn off alerts on this phone" on your Alerts page, switch off any kind of alert there, or turn off notifications for Rewardtree in your phone's or browser's settings. Your owner page also lists every alert, and we delete them after 60 days.
Alerts in our app for shop owners, only if you turn them on: if you use the Rewardtree Business app and allow its notifications, your phone gives the app a notification token. We keep it with your sign-in, with a name for the phone (like "iPhone"), and use it only to send you the same alerts about your shop. They're carried by the app's notification service and your phone maker's, so they aren't encrypted end to end like the browser's, which is one more reason an alert never has a customer's name or number in it. To stop them, turn off alerts in the app, switch off any kind of alert, sign out of the app or remove it.

Chatting with us on our website

What we keep: what you write in the chat and our replies, when each was sent, the page of our website you started on, and your email, only if you type one in. We don't keep your internet address with the chat, or with the session that keeps it open.
Why: only to answer your questions, in the chat or, if you left your email, by email. It's not marketing: we never add your email to a list or send you offers because you chatted with us.
Who reads it: our support team. Your messages are saved by Rewardtree in our Australian databases and passed to our support team's phone. Today that's by email (see Who helps us). We may also use a messaging service to pass them to that phone. If we do, it handles some details overseas, mainly in the United States.
Replies by email: if you leave your email and don't see our reply in the chat within 2 minutes, we email it to you from Rewardtree. The email has only our answer, not your messages. Don't want emails from us? Empty the email box in the chat and tap Send, or reply to our email and say so.
The "are you a person" check runs on your first message (see Who helps us).
On your browser: the session cookie keeps your chat open while you move between our pages. When your browser session ends, the chat no longer shows there, but we keep it as below.
How long: we delete a chat, with any email you left in it, 12 months after its last message, and the copies of its emails in our support inbox on the same schedule. You can ask us to delete it sooner: [email protected].

Offers by text, and STOP

Only shops whose box you ticked can text you offers. The box ("{Shop} can text me offers") is on the shop's page when you join, and it's never ticked for you.
Every offer starts with the shop's name and ends with a link to the shop's page (it shows where to find the shop) and "Reply STOP to opt out".
Offers come from Rewardtree's Australian number, so you can reply to them.
Reply STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT, or anything like "opt out", "please stop" or "no more texts") and we record it straight away. Every shop's offers come from the same number, so you can't tell which shop you're answering. That's why STOP stops offers from every shop on Rewardtree, not just one.
Replying START takes your number off our STOP list, but it doesn't restart any shop's offers. A shop can text you offers again only if you tick its box when you join it.
Your tick lapses after 12 months away: if you haven't been to any of a business's shops for 12 months (no stamp and no reward used), it can't text you offers or reminders. Your next visit there brings your tick back by itself: we don't ask again, and you can still reply STOP any time.
Switching offers off at rewardtr.ee/manage also stops offers from every shop.
Our number can't pass replies on to a shop, so if you reply with anything else, nobody reads it. We send one automatic answer, at most once a day, with the shop's address or its page, and we don't keep what you wrote.
We keep a record of each offer text (which number, when, and whether it arrived) for 2 years, then we take the number off it.
We keep your number on our STOP list even if you delete your account, so no shop texts you offers unless you tick its box again when you join it.
Service texts, like your sign-in codes and, for shop owners, reminders about their plan, aren't offers.

Emails from shops

Only if you say yes, shop by shop: a shop can email you only if you tick its own box ("{Shop} can email me offers") and then tap the button in the one email we send to check the address is yours. The box is on the shop's page when you join, on the screen after a stamp from your second visit (at most twice, and never after you stop that shop's emails), and in Manage your card. It's never ticked for you, and a tick for texts never counts for emails, or the other way round.
What they are: a welcome, a birthday email if you added your birthday, a "we miss you" when you haven't been in for a while, and about one news email a month. Each one comes from Rewardtree for that shop, says who it's from, and has a one-tap Unsubscribe.
What we keep: your email (encrypted), the language you used and when you confirmed it; your birthday only if you add it after confirming (the day and month, never the year); and, for each shop, when you said yes, where, the words you saw, and every stop. That record of who agreed to what keeps your email only in scrambled form.
Shops never see your email address or your birthday. A shop only sees how many of its customers said yes.
Stopping them: tap Unsubscribe in any email. It stops that shop's emails straight away, with no sign-in, and the page it opens also lets you stop emails from every shop on Rewardtree. You can also stop them on the shop's page when it knows your card, or in Manage your card, one shop or all of them. Emails and texts are separate: replying STOP to a text stops texts, not emails, and an email's Unsubscribe doesn't stop texts.
After 12 months away: if you haven't been to any of a business's shops for 12 months (no stamp and no reward used), its emails stop by themselves. To get them again, say yes again.
A confirm email you didn't ask for: ignore it and nothing more comes. It has no offer in it, its button works for 7 days, and we send at most 3 a day to one address.
Who sends them: our email provider, from servers in Japan (see Who helps us).

Reminders about your card

On your Wallet card: if a reward has been waiting on your card for 14 days, the shop's card reminds you once, like "{Shop}: your free haircut is waiting. Use it on your next visit.", and once more at 45 days. Then nothing more about that reward. It goes only to a card saved in Apple Wallet or Google Wallet, and it's only about your own card: never a discount or an ad.
By text, only if you ticked the shop's box: if the shop switched it on, and you haven't been in for a few weeks, one text like "{Shop}: you have 4 of 5 stamps. 1 more for a free haircut.", with the shop's page and "Reply STOP to opt out". One text each time you're away, never after 6 months away. It comes from Rewardtree's number, between 9am and 8pm.
When stamps end, only if the shop chose it: a shop can choose that its stamps end after 3, 6 or 12 months with no visit. We work out the date from your last visit (a stamp or a reward used) and show it on your card, and 14 days before, your Wallet card warns you once, like "{Shop}: your 4 stamps end on Tue 2 Dec unless you visit before then." If we can't put that warning on your Wallet card, your stamps don't end. A warning already on your card still stands: switching reminders off or removing the card afterwards doesn't stop those stamps ending unless you visit.
Never too many: at most one reminder a week from a shop, two a month, and one a day from all shops together. None between 8pm and 9am.
Switching them off: tap "Stop reminders from {Shop}" on the back of your Wallet card. It works straight away, with no sign-in, and the page it opens lets you switch them back on. A shop's page shows the same switch when it knows your card. Replying STOP to any text stops reminders and offers from every shop. Your phone's Wallet settings can also switch off all notifications for a card.
What we keep: a record of each reminder (the shop, your card, which kind, how it was sent, when, and whether it went) for 2 years. It stops us sending one twice and keeps to the limits above. A reminder by text is also kept like an offer text: its words (like "you have 4 of 5 stamps"), the number it went to and whether it arrived, and we take the number off it after 2 years. The shop sees only how many reminders went in the last 30 days and how many of those customers came back within 14 days, never who. When you delete your account, these records no longer point at you.

How we use it

Running your card: recording stamps and rewards, and updating your card in Apple Wallet or Google Wallet.
Service texts and emails: sign-in codes; for customers who added an email in the older app, the codes that confirm it and sign in with it; for shop owners, reminders about their shop's plan, notices about their account, and an email when a new device signs in or their sign-in details change. These are part of the service, not marketing.
Help with your account (shop owners only): we may call, text or email you about your account, for example to help you get set up. It's part of the service, not marketing.
Answering your questions (anyone who chats with us): what you write in the chat on our website, and the email you leave, to answer you, as above. It's not marketing.
Offers: only with your consent, as above.
Emails from shops: only with your yes to that shop and a confirmed email, as above. The confirm email itself is part of the service, not marketing.
Reminders about your card: on your Wallet card, and by text only if you ticked the shop's box, as above. You can switch them off any time.
Rewardtree's own tips and news (shop owners only): by text, only to owners who ticked the box.
Alerts for shop owners: on the owner page and, for owners who turn them on, on their phone or computer. They're part of the service, not marketing.
Checking stamps are real: one stamp per visit (each shop chooses once a day or once every 4 hours), the location check, a late-night check, and "Needs a look" notes for the shop. The location and late-night checks never stop a customer getting a stamp. If a shop has set its opening hours, a stamp collected more than 30 minutes outside them doesn't count (see What we collect from customers). We also count those distances across many customers to check that each shop where customers collect stamps is on its business's plan.
Security: limits on how often something can be tried, sign-in device records, and fraud checks.
Totals across Rewardtree (for example, how many stamps are collected each week), which identify nobody.

What a shop sees

A shop sees only its own customers, at its own shops: their first name, mobile number, stamps, rewards and "Needs a look" notes. It never sees which other shops you collect stamps at, never your email address or birthday, and it can't download its customer list. Your whole picture (every card at every shop) exists only on our side and in your own hands.

Who helps us, and where

Only the providers we need to run Rewardtree, under contract, for the purposes above:

Hosting — our servers and databases, in Australian data centres.
Apple and Google — your Wallet card (what's on it: the shop, your first name and your stamps), and, if a shop owner chooses it, signing in with Google.
Our text-message provider — texting sign-in codes, shop owners' plan reminders and offers, and receiving replies like STOP.
Our payment processor — shops' plans and text credits. It takes the card details on our secure payment page; we never see or store your full card number.
Our email provider — sending our emails, including the emails shops send to customers who said yes (your email address and the email).
Our network security provider — network security in front of our sites, counting visits to our website's own pages without cookies (see Cookies), and the quick "are you a person" check on our sign-up form, on our website chat and before we text anyone a code, which tells bots from people without a puzzle. The check has its own privacy terms, the Turnstile Privacy Addendum.
Address search — for shop owners only. When an owner types their shop's street address on their owner page, our servers send what they type to our address-search providers, to suggest matching addresses as they type and to find the address on the map when they save. When an owner pastes a Google Maps or Apple Maps link to their shop, our servers also send the map point in that link to one of them, to fill in the street address; a short Share link is first opened by our server at Google or Apple, only to read the shop's spot. The dashboard's shop map loads its pictures from a public map service, whose servers see the browser's internet address like any website. Only what a shop owner types or pastes about their shop is sent — never customer information, and never anything from the owner's own device. While our address-search provider in the United States is switched on, what a business owner types or pastes about their shop is sent to it instead. The shop's street address is still put on the map by one of our address-search providers in Europe.
Australia Post — posting what we send shop owners: the name, address and any delivery note on the parcel.
Our AI provider — when a shop owner presses "Write it for me" on their Send a text page: the shop's name, its kind of business, its reward and the few words the owner typed about the offer, to draft a text the owner reads and changes before sending. Nothing from the shop's customer list: never a customer's name, number or details from our records. We ask owners not to type a customer's name or number in those few words, and we take out anything that looks like a phone number or email address before they go. We don't keep the draft or the owner's words unless the owner sends them. It isn't used to train AI models.
Our error-reporting provider — technical details of an error on our servers, in our web pages or in our app for shop owners, handled in the United States and set up so it gets no phone numbers, email addresses, cookies or internet addresses.
Your browser's notification service — only for shop owners who turn on alerts: it carries each alert to their phone or computer. The company that makes the phone or browser runs it, and the alert is encrypted so that it can't read it.
Our app's notification service — only for shop owners who use the Rewardtree Business app and turn on its alerts: it passes each alert, with the phone's notification token, to the notification service run by the company that makes the phone. It's in the United States.
A messaging service, if we use one — to pass messages from the chat on our website to our support team's phone: what you wrote, the page and the email you left. It handles some details overseas, mainly in the United States.

Our servers and databases are hosted in Australia, in local data centres. Some providers above handle limited information overseas, mainly in the United States: our text-message provider (your number and the text, to deliver it), Apple and Google (Wallet card content), and Google (owners' sign-in), our payment processor (shops' billing), our network security provider (network traffic), our error-reporting provider (technical details of an error), the notification service a shop owner's browser uses for alerts (an encrypted alert it can't read), the notification service our app for shop owners uses for alerts (the alert and the phone's notification token), our address-search provider in the United States (what an owner types in the address search) and our AI provider (a shop's name, kind of business and reward, and its owner's few words for an offer). Our email provider sends our emails from servers in Japan. Our address-search providers process the shop addresses that business owners type on servers in Europe. We take reasonable steps to make sure they handle it consistently with the Australian Privacy Principles.

We do not sell, rent or trade personal information. We don't run ads, and we don't share data with ad networks or data brokers. We share information beyond this list only if the law requires it.

Keeping and deleting

Customers

Delete your account any time at rewardtr.ee/manage (there's a step-by-step on the Delete your account page), or email [email protected]. We act within 30 days.
Your name, mobile number, email and offer ticks are removed, and the shop pages stop remembering your phone.
Stamp and reward history can't be rewritten (that's how balances stay trustworthy), so those records stay, but they no longer point at you: they point at an anonymous placeholder.
If you ever replied STOP, your number stays on our STOP list, so no shop texts you offers unless you tick its box again when you join it.
Your email for shops' emails and your birthday are deleted, and every shop's emails stop. The record of who agreed to what keeps your email only in scrambled form.

A note about a stamp that a shop's opening hours stopped: 90 days, then deleted. The internet address on the note that you changed your first name: 90 days, then removed. Both go when you delete your account.

Texts

Records of offer texts: 2 years, then the number is taken off them.
Replies to our number: we keep only what kind of reply it was (STOP, START, HELP or something else) for 90 days, never what you wrote.
Records of reminders: 2 years. A reminder by text is also kept like an offer text (its words, with the number taken off after 2 years).

Shops

While your account is open, your shop's information and your customers' activity at your shops stay on Rewardtree. There's no download of your customer list.
Alerts on your owner page: 60 days. The phones and computers you turned alerts on for: until you turn them off there, or the device's browser stops them. A phone with the Rewardtree Business app: until you turn its alerts off, sign out of the app or remove it.
If your plan ends (you cancel, a payment still fails after we've tried again, or your free days end without a card), we keep your shop, your customers and their stamps for 12 months from the day it ended, so you can pick up where you left off. About 30 days before the 12 months end, we email you (or text you if we don't have your email). If you haven't come back by then, we delete or de-identify your business's personal information, except records the law makes us keep (billing and tax records, for up to 7 years).
If you ask us to close your account, we delete or de-identify your personal information within 30 days, except records the law makes us keep (billing and tax records, for up to 7 years).
Your shipping address: until you change or remove it, or the 12 months after your plan ends are over (then we delete it, whatever else we keep), or on request. On each parcel: its name, street and delivery note are removed 90 days after it goes out, or after it's cancelled (the suburb, state and postcode stay with the record).
Your customers keep their own Rewardtree accounts. Only their cards at your shops close.

Website chat

A chat on our website, with any email you left in it, and the copies of its emails in our support inbox: 12 months after its last message, then deleted.

Our servers' logs

Technical logs on our servers (for example, an error and where it happened, or what a background task did): 14 days, then deleted.
Daily visit totals for our website: 25 months.

Security

Traffic is encrypted (TLS). Rewardtree is run by one person today, our founder, who is the only person who can get into our systems and see the information in them. A person who packs and posts signs for us sees only the name, address and delivery note on each parcel they pack and post, and nothing else about you or your customers. Shops and their teams see only their own customers (see What a shop sees). If we ever sign in to a shop's owner page to help them, we record it with the reason. The reward screen is live, works once and ends. Stamp history can't be rewritten. The cookies that remember a customer's card (rt_card) and an owner's device (rt_device) are stored on our side only as scrambled copies. If a data breach is likely to cause serious harm, we'll tell the people affected and the OAIC under the Notifiable Data Breaches scheme.

Children

Rewardtree isn't meant for children. You need to be at least 16, or have a parent or guardian's OK, to join a shop's loyalty card, and consent to offers only counts from people who can give it. If we learn we hold a young child's details, we delete them.

Your rights

You can see, download or delete your own details, or change the first name on your cards, any time at rewardtr.ee/manage. You can also ask us for the personal information we hold about you, ask us to correct it, or complain about how it's been handled: [email protected]. We reply within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Changes to this policy

If this policy changes, the new version appears here with a new effective date. If we change how we use personal information in a way that matters, we tell account holders before it takes effect.