Privacy Policy.

Who operates the Platform

This Privacy Policy describes the data handling of AP RESERVE Loyalty, which operates the shared customer loyalty wallet and the participating-business management app. A participating business independently determines its loyalty offers, rewards, announcements, and customer interactions. That business may have a separate privacy notice for activities outside the Platform. For privacy inquiries, contact contactapreserve@gmail.com. Before public release, the operator must publish its registered legal name and any contact address required by applicable law.

Information collected from customers

When you use the Customer app, Firebase Authentication can create a unique anonymous user identifier without requiring an email address or password. We store any display name you supply, the businesses you join, each business’s member ID/QR-code identifier, points balance, reward/redemption and transaction records, membership dates, and messages associated with those memberships. The app can remember which messages you have read on your device. If you opt in to promotional push alerts and allow iPhone notifications, Firebase Cloud Messaging may store a messaging token and your notification preference. You can use loyalty cards without enabling promotional push alerts.

Information collected from business owners

For owners, we process the email address used to sign up, authentication records and verification status, the owner account ID, the business name, unique business ID, business logo and image uploads, points and rewards settings, and records created by the owner (such as customer point adjustments, announcements, direct messages, and uploaded promotional images). We may store necessary authorization, security, and operations records so that one business cannot edit another business’s data.

Technical data, camera and photos

Our hosting, authentication, and messaging providers may receive technical data needed to deliver and secure the services, such as device identifiers or tokens, IP addresses, request metadata, diagnostic logs, and timestamps. The QR scanner uses the camera to recognize membership codes; we do not intentionally store a continuous camera video feed in our database. If you choose a business logo or promotional image from Photos or Files, the selected image is uploaded so it can appear in the app; selecting an image does not give businesses access to your entire photo library. We do not request precise location for the loyalty features described here.

How information is used

We use the described data to create accounts and memberships, show business directories and cards, generate and verify QR codes, record points and redemptions, calculate displayed reward values, display message history and unread counts, deliver optional push alerts, process account deletion, troubleshoot errors, prevent abuse, and meet legal obligations. We do not use the Platform as an advertising broker or sell member lists. We do not authorize businesses to harvest data for unrelated purposes.

Who can see or receive information

The owner of a business you join can see your membership display name, membership identifier, point balance, reward activity and direct messages related to that business. Owners should not see your unrelated memberships with other businesses. Business names, logos, and published offers may be visible to users who browse the directory. Platform administrators and contracted service providers may access information reasonably necessary for support, security, and hosting. A participating business is responsible for its own use of information that it receives through its workspace.

Service providers and international processing

We use Google Firebase services, including Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, and Cloud Messaging, to operate the Platform. Apple notification services may be involved when push alerts are enabled. Data may be processed in cloud regions and locations used by these providers, subject to their terms and safeguards. Before publication, we will review all bundled SDKs, analytics settings, crash-reporting services, and cross-border processing, and update this notice if other data recipients or practices apply.

Messaging and your choices

In-app announcements and direct messages from a business you joined can appear in that membership’s inbox. Promotional push alerts are optional; you can disable them in Profile or iPhone notification settings. This does not automatically delete messages already in your inbox or revoke any separate marketing consent you may have given directly to a business. If you no longer want that business’s membership messages, you can delete or leave that business membership. Business owners must independently honor legally required opt-outs and marketing permissions.

Data retention and deletion

Membership and business data are generally kept while the relevant membership or business workspace remains active and while needed to provide the service. Customers may delete one business membership from that business’s Profile screen, or delete the entire wallet through My Cards. Owners may request deletion of their business account in Business Settings, which starts the removal of that business workspace and associated records. Deletion of an account does not automatically remove records stored independently by a participating business or another service. Security logs, backups, support communications, and legally required records may remain for limited periods under applicable retention requirements and service-provider settings. Do not assume immediate erasure from all backup copies.

Your privacy rights

Depending on where you live, you may have the right to request access, correction, deletion, or information about use and sharing of your personal data, and to object to or restrict certain processing. To exercise a legal right or ask a privacy question, email contactapreserve@gmail.com. We may need to verify account control before responding. Some requested changes can be made directly in Profile or Business Settings. Rights and exceptions vary by law.

Children and regulated businesses

The Platform is not intended for people under 18. Businesses offering age-restricted goods or services are responsible for required age verification, local advertising limits, and lawful promotions. The Platform must not be used to target minors with cannabis, tobacco, alcohol, or other regulated-product promotions. If we learn that we have collected information from an ineligible child, we will assess and take appropriate steps under applicable law.

Security

We use Firebase authentication, business-scoped access controls, server-side authorization, and service-provider security measures intended to reduce unauthorized access. Businesses must protect their sign-in credentials and ensure only authorized personnel use the Owner app. No internet service can promise absolute security. If you suspect unauthorized access, contact us promptly.

Changes to this Policy

This Policy takes effect on October 29, 2026. We may update it as the Platform changes. Material changes will be communicated when required by law, and the current policy will be made available in the apps and on our public privacy page.

Contact

For platform privacy requests or complaints, contact AP RESERVE Loyalty at contactapreserve@gmail.com. Registered legal operator and public postal address: to be completed and verified before publication. For a dispute about a specific merchant’s separate sale, advertising consent, or offline customer file, please also contact that merchant.