Privacy Policy

1. Who this policy covers

• Merchants: business owners and staff with Tallyr accounts.
• Members: people who hold a stamp card issued by a Merchant through Tallyr.

A note for Members: the business that issued your card is the primary collector of your loyalty information and uses Tallyr as its platform. This policy explains what Tallyr itself does with your information. The Merchant's own privacy practices are their responsibility.

2. What we collect

Merchants: name, business name, contact details, login credentials, business branding, and billing details (payment card details are entered with and stored by Stripe, our payment provider, not on our servers; we keep only your card's type and last four digits, to show which card is on file).

Members: name and contact details you provide when joining a card, your stamp and reward history, and the businesses whose cards you hold. You may optionally add a birthday, of which we store the day and month only — never the year — so that a business whose card you hold can send you a birthday message on the day. The business never sees your birthday, and you can remove it at any time.

Records of activity at the counter: when staff search for a Member by name, we record who searched, at which venue and when, and how many results came back, but never the words they typed. When a Merchant adds stamps to a card by hand, we record who added them, how many and the reason given. We keep these records to prevent and investigate misuse.

Stamp requests: when you scan a Merchant's poster to ask for a stamp, we record the request: who asked, at which venue and when, a three-digit number shown on your screen and to the venue's staff, what became of it (approved, declined, cancelled or timed out), and which staff member opened, approved or declined it. We do not record a reason when a request is declined. We use these records to show the request to the venue's staff so they can confirm it, to tell you what happened, and to limit how often requests can be made.

Everyone: technical data such as device type, browser, IP address and usage information, collected to keep the Service secure and working well.

We do not collect sensitive information (such as health or biometric data) and we ask that you do not submit it.

3. How we use information

• To provide and operate the Service: cards, stamps, rewards, dashboards.
• To process subscription payments (via Stripe).
• To provide support and send service messages (such as receipts, security notices and important changes).
• To maintain security, prevent fraud and misuse, and improve the Service.
• To deliver the messages a Merchant sends its Members through their wallet pass (see Messages from businesses below).

Messages from businesses

A business whose card you hold may send you messages through that card: reminders about your stamps and rewards, offers and news it writes itself, a birthday message on your birthday (if you added one), and a request to review it on Google after you have visited a few times. These messages appear on your Apple Wallet or Google Wallet pass, so they reach you only if you have added the card to a wallet. Tallyr limits how often each business can message you.

The business writes its messages and is responsible for their content; Tallyr delivers them on its behalf. We do not give the business your email address or phone number to do so, and we never use these messages to advertise anyone else. A review request opens Google, whose own terms and privacy policy apply to anything you post there, and a business may not offer you anything in return for a review.

You can stop messages from any business at any time by switching it off under Notifications in the app. Your card keeps working and still updates when you collect a stamp. You do not need to sign in to stop them either: remove the pass from your wallet, turn off notifications in the card's details in Apple Wallet, or email info@tallyr.com.au, and we will stop them within five working days. Every pass says how.

What we do not do: we do not sell personal information, we do not share it with advertisers, and we do not display third-party advertising in the Service.

4. Where your data lives, and who we share it with

Our primary application data is hosted with Supabase in the Australia region, so your loyalty data is stored onshore.

We share information only with service providers who help us run Tallyr:

• Stripe for payment processing. Stripe is a global provider and may process payment information overseas in accordance with its own privacy policy.
• Infrastructure and deployment providers that serve the application. Where any provider processes limited technical data overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.
• Apple and Google, if you add a card to Apple Wallet or Google Wallet. For Google Wallet, the details shown on the pass (your display name, the business, your stamps and reward, and any message from that business) are stored with Google to display it. For Apple Wallet, the pass is kept on your device, and we use Apple's push notification service to tell your device when the pass has changed. Both may process this information overseas under their own privacy policies.
• Professional advisers, or authorities where the law requires it.

Members' information is visible to the Merchant whose card they hold, for the purpose of running that loyalty program:

• Staff at any of the Merchant's venues can find a Member by display name at the counter, and see the Member's avatar and the cards, stamps and rewards the Member holds with that Merchant, so they can stamp a card when its code will not scan.
• When a Member sends a stamp request, the active staff at that venue and the Merchant can see it: the Member's display name and avatar, the request's three-digit number, the cards and stamps the Member holds with that Merchant, and how long the request has been waiting. Staff at the Merchant's other venues do not see it.
• The Merchant can see its Members' display names, avatars and loyalty activity with it, and can download a list of its Members as a file containing each Member's display name and a summary of their visits: active cards, total stamps, visits, rewards redeemed, and the dates first and last seen.

A Merchant never sees a Member's email address, phone number or birthday, and never sees a Member's cards or activity with any other business. A Merchant that downloads its Member list is responsible for handling that copy in line with the Privacy Act.

5. Security

We take reasonable steps to protect personal information, including encryption in transit, access controls and reputable cloud infrastructure. No online service can guarantee absolute security, but if we become aware of a data breach likely to cause serious harm we will notify affected people and the OAIC as required by law.

6. Retention

We keep personal information while an account is active and for a reasonable period afterwards for legal and operational purposes, after which it is deleted or de-identified. Merchants can request an export of their Member data within 30 days of closing their account. Records of name searches at the counter are deleted after 12 months, or sooner if the account or venue they relate to is deleted. Records of stamps added by hand are part of a card's history and are deleted with the card. Stamp requests are deleted 30 days after they end, and straight away if the Member's account is deleted; a stamp added by approving a request is part of the card's history like any other.

7. Access, correction and deletion

You can access and update most of your information in the app. You may also contact us to request access to, correction of, or deletion of your personal information. We will respond within a reasonable time. Members can also ask the issuing Merchant to correct their loyalty records.

8. Cookies and analytics

The Service and website use cookies and similar technologies for sign-in and security. We do not run third-party analytics, advertising or tracking scripts on this website or in the app. You can control cookies in your browser settings; some features may not work without them. If we add analytics later, we will update this policy before we do.

9. Complaints

If you have a privacy concern, contact us first at info@tallyr.com.au and we will do our best to resolve it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

10. Changes

We may update this policy from time to time. Material changes will be notified in the Service or by email. The date at the top shows the current version.

Contact: info@tallyr.com.au · EMEI Pty Ltd, 7 Stanthorp St, Burnside Heights VIC 3023