Privacy Policy

In short

• The Operator is the controller of your personal data. They decide why and how your data is used to run their loyalty programme. Perkstar is the processor — we run the platform on their behalf.
• Your data is held in the EEA. Our database and the systems that handle your requests run in Ireland and Germany. A small number of sub-processors are outside the UK and EEA; transfers are protected by UK-recognised legal safeguards.
• You have rights. You can ask the Operator for a copy of your data, ask them to correct it, opt out of marketing, or ask them to erase your data. Where it's easier for you, you can also contact us at privacy@perkstar.co.uk and we'll route your request.
• Automatic gender estimation has been discontinued. Earlier versions sent names, email addresses, birth years, languages and the business’s country to Anthropic for audience summaries and promotion audience selection. Estimates can be wrong. Existing estimates remain until corrected or erased; ask your business to correct or remove them. New signups and background jobs make no estimates. Customer-provided gender and AI writing tools remain available. Customer erasure clears stored gender and its inference flag.

1. Who is the controller of your data?

The business that runs the loyalty programme you joined is the controller of your personal data. They decide what programme to run, what data to collect, and how to communicate with you. If you want to know who that business is, look at the name on your loyalty card or wallet pass, or in the email you received when you joined.

Perkstar is the processor. We provide the technology that powers the loyalty card — issuing the Apple Wallet or Google Wallet pass, recording your stamps or points, sending you the messages your Operator asks us to send on their behalf, and giving you tools to manage your data.

For some narrow purposes (running the Perkstar platform itself, security monitoring, fraud prevention, legal compliance) Perkstar is itself a controller. Those purposes are listed in Section 6.

2. What personal data we hold or process about you

Depending on the loyalty programme you joined and how you use it, we may hold or otherwise process the following personal data on the Operator's behalf:

• Identity: your name, email address, phone number, and, if the Operator asks for it, your date of birth.
• Any custom information the Operator collects: for example, dietary preferences, T-shirt size for a clothing brand, vehicle registration for a car-wash programme. The Operator chooses what to ask.
• POS integration profile data: where your Operator connects Loyverse or another point-of-sale provider, this may include external customer references, a customer code or Wallet scan identifier, and existing address or customer-note fields processed only when needed to match you and preserve the provider-owned customer profile during an update. When your Operator moves an existing loyalty programme from Loyverse to Perkstar, they may instruct us to run a pre-activation migration workflow that may be refreshed before the first completed cutover, copying the existing Loyverse customer directory and each customer's current points balance. We use the merchant-scoped Loyverse customer ID, name, available contact details, current points and any existing customer code to create or link the Perkstar member and preserve their opening loyalty value; we do not reconstruct their historical purchases and this copy does not opt them into marketing. For an ordinary Square customer-attributed payment, email or phone from the attached Square Customer is used transiently to find an existing Perkstar member and is not kept when no member matches. If your Operator enables optional one-scan Square customer identification, Perkstar acts only after you give explicit voluntary consent. Perkstar then exact-matches an existing Square Customer using your stable Wallet scan value, email address or optional phone number. If there is no unique match, Perkstar may create a Square Customer using your first name, optional last name, email address and optional phone number. We then keep the merchant-scoped Square customer identifier and ownership record needed to put your stable Wallet scan value into an empty Square Customer reference_id safely.
• Loyalty activity: enrolments, stamps, points, balances, rewards earned and redeemed, transactions linked to the programme.
• Receipt and refund data: where a connected point-of-sale integration is enabled, this may include receipt and refund references, created, updated or cancelled timestamps, the sale total, attached customer and store references, points fields and the monetary points-discount amount needed to calculate earning, exact redemption and corrections.
• Wallet pass data: the serial number and device push tokens for any Apple Wallet or Google Wallet pass you install.
• Communications: messages sent to you (email, SMS, push), bounce and complaint signals, your unsubscribe choices.
• Consent and audit trail: per-channel marketing consent (email, SMS, push), separate ad/analytics tracking consent where configured, and separate consent for optional Square Customer Directory creation where enabled, with the date, your IP address and User-Agent at the moment you gave or withdrew consent, plus an immutable snapshot and hash of the consent and privacy text you were shown.
• Technical metadata: limited request logs (IP address, User-Agent, page accessed) generated when you interact with a Perkstar-hosted page.

We do not see your payment card numbers. If you pay for anything through a Perkstar surface, payment goes directly to Stripe, our payment processor.

3. Where we get your data from

• Directly from you — when you sign up for a loyalty card, install a wallet pass, scan or tap to earn a stamp, update your details, or choose whether to consent to optional Square Customer Directory creation.
• From your Operator or its connected systems — your Operator may send details through a point-of-sale integration, a bulk import, or an API connection. Square does not involve a bulk customer-directory import. For an ordinary customer-attributed payment, Perkstar reads only the attached Square Customer and uses email or phone transiently to look for an existing Perkstar member. Where optional one-scan identification is enabled, Perkstar acts only after you give explicit voluntary consent. Perkstar then makes exact searches of the Operator's Square Customer Directory using the stable Wallet scan value, email address or optional phone number and, if there is no unique match, may use the contact details you provided to create a Square Customer. The Operator is responsible for making sure it has the right lawful basis and notices for the processing it enables.
• Automatically — request metadata is generated when your device interacts with our platform.

4. Why we process your data, and on what legal basis

Perkstar processes your data on the Operator's documented instructions. The Operator decides the lawful basis for each processing activity under UK GDPR Article 6 (and, where relevant, EU GDPR). Typically:

• Contract or legitimate interests: running the loyalty programme — issuing the pass, recording stamps and points, sending transactional messages about your account or rewards, handling your enrolment and redemptions, and matching the customer already attached to an attributed payment where the Operator has established that basis.
• Consent: marketing messages on each channel you've opted into (email, SMS, push), separate ad/analytics tracking where an Operator has configured Meta, TikTok or Google Analytics measurement, and optional Square Customer identification where that feature is enabled, including any exact Directory search, customer link, profile creation and reference publication. You can refuse the entire Square identification workflow and still join Perkstar, and you can withdraw consent at any time.
• Legal obligation: retaining transactional records for tax-audit purposes (typically 6 years under UK tax law for UK Operators; see Section 8).
• Legitimate interests: keeping the platform secure (rate limiting, fraud detection, abuse prevention), running essential non-advertising analytics for the Operator, improving the Services, and producing aggregated, anonymised statistics from loyalty activity. Once that anonymisation is complete the resulting statistics are no longer personal data and cannot be traced back to you; Section 6 explains what we do with them.

5. Marketing communications

You will only receive marketing communications from us on the Operator's behalf on a channel you've opted into.

• Opt-in is double-confirmed. If an Operator asks us to opt you in, we send you a confirmation email with a signed link; we only enable the channel once you click it.
• Opt-out is one click. Every marketing email contains a List-Unsubscribe header and an unsubscribe link. For SMS, use the opt-out link in the text message; alphanumeric sender IDs cannot receive STOP replies. For push, change the wallet pass settings on your device and use the customer preference page where available.
• Transactional messages are different. Messages about your account, wallet pass, balance, reward unlocks, redemptions, expiry reminders, programme changes or security are service messages. They are sent where needed to operate the loyalty programme and keep your pass accurate. Marketing consent controls do not block these transactional updates.
• Advertising and analytics tracking is separate. If the Operator has configured Meta, TikTok or Google Analytics measurement, we only send those server-side events after you choose the separate ad/analytics tracking opt-in. You can withdraw that consent from your customer preferences.

6. When Perkstar is itself a controller

Perkstar acts as a controller (not a processor) for limited purposes connected to running the platform itself:

• platform security, abuse and fraud prevention, including identity verification of Operators through Stripe Identity;
• diagnostic and performance logging of platform operation;
• enforcing our Terms of Service and acceptable use policy; and
• complying with our own legal obligations; and
• producing aggregated and anonymised statistics from platform activity, and using them to improve the Services and to build benchmarking, industry-insight and business-risk products.

For these purposes, Perkstar is the controller, the legal basis is generally Perkstar's legitimate interests in operating a secure, lawful service (or compliance with a legal obligation, where applicable), and you can exercise your rights against us directly by emailing privacy@perkstar.co.uk.

Aggregated and anonymised statistics. We turn loyalty activity across the platform into aggregated statistics — for example how often customers return to a type of business in a region, or how a particular reward structure performs. That anonymisation is irreversible: the statistics carry no identifiers, are drawn from at least 10 businesses and 250 customers before we share anything outside Perkstar, and cannot reasonably be used to identify you, your purchases, or the business you visit. We may publish or commercialise those statistics, including to help businesses understand their market and to assess businesses — not individuals — for funding products. We never sell your personal data, and no product we build makes an automated decision about you (see Section 11).

7. Who we share your data with

We share your data with:

• Your Operator — they are the controller and have full access to their own Cardholder records.
• Our sub-processors — companies Perkstar appoints to run the platform on our behalf. The current list is at https://dashboard.perkstar.co.uk/dpa/sub-processors. It includes Supabase (database, Ireland), Vercel (hosting, Frankfurt), Resend (email, Ireland), Upstash (rate limiting, Ireland), Stripe (payments, billing and identity), Apple (Wallet), Google (Wallet and Places, and Analytics only where configured and consented), Telnyx (SMS), and Inngest (background jobs). These providers process data under Perkstar's instructions.
• Operator-selected integration providers — POS, booking, delivery or marketplace providers that your Operator independently chooses and connects, such as Square, Shopify, Toast, Lightspeed, Clover, Loyverse, Acuity, Mindbody, Deliveroo, Dojo, EPOS Now, Access EPoS, MX POS, Poynt and NCR Aloha Cloud. Data may travel to or from a provider only when your Operator enables that integration and instructs us to operate it. The provider's processing is governed by your Operator's separate contract with that provider. For ordinary customer-attributed Square payments, Perkstar receives merchant/location details, completed payment and refund details and only the Square Customer attached to a payment; email or phone is used transiently to match an existing Perkstar member, unmatched contact data is discarded and the Square Customer Directory is not bulk-imported or mirrored. If your Operator enables optional one-scan Square customer identification, Perkstar acts only after you give explicit voluntary consent. We then exact-match an existing Square Customer using your stable Wallet scan value, email address or optional phone number. If no unique match exists, we send your first name, optional last name, email address and optional phone number to create a Square Customer. We write the stable Wallet scan value only to an empty Square Customer reference_id, never overwrite a value set by another system, and release only a live value whose Perkstar ownership can be proven when identification is disabled, consent is withdrawn, erasure is completed or Square is disconnected. The Square Customer profile remains in Square. Perkstar does not create or update Square payments, Square Loyalty balances or Square rewards, and Square Loyalty is not required. When your Operator moves an existing programme from Loyverse, Perkstar uses a pre-activation migration workflow to receive the existing Loyverse customer directory and each customer's current points on the Operator's instruction, so their identity and opening loyalty value can be carried into Perkstar without recalculating historical purchases. The business may refresh that snapshot before the first completed cutover. This does not create marketing consent. Where your Operator enables Loyverse customer-card scanning, Perkstar shares the Cardholder's name, email address, optional phone number and Wallet scan identifier with Loyverse so till staff can identify the Cardholder at checkout. Perkstar also receives the Loyverse business identity and currency, relevant customer profile fields needed to match and safely preserve the profile, and paid receipt or refund details — including customer, store and receipt references, timestamps, totals, points fields and points-discount amounts — to calculate earning, exact redemption and corrections. Products, inventory, employees, taxes and payment information are not synchronised.
• Operator-configured advertising or analytics recipients — Meta, TikTok or Google Analytics only where the Operator has configured that measurement and you have given the separate ad/analytics tracking consent.
• Authorities or third parties where required by law, court order, or to protect our rights, your rights, or the rights of others.

We do not sell or rent your data. We do not use your data to train artificial intelligence models. We do not enrich our own marketing databases with it.

Automatic gender estimation has been discontinued. Earlier versions sent names, email addresses, birth years, languages and the business’s country to Anthropic for audience summaries and promotion audience selection. Estimates can be wrong. Existing estimates remain until corrected or erased; ask your business to correct or remove them. New signups and background jobs make no estimates. Customer-provided gender and AI writing tools remain available. Customer erasure clears stored gender and its inference flag.

Emailable

Emailable LLC (United States) checks email addresses before Perkstar's own account sends invitations, reminders or business newsletters. Only email addresses are shared, never names, purchases or message contents. We keep the result and when it was checked, without demographic estimates, and reuse a recent result instead of checking again. Invitations aren't sent to invalid or uncertain addresses; newsletters aren't sent to invalid ones. A check doesn't guarantee delivery or give permission to contact someone.

Unsplash

A business can put a free Unsplash photo at the top of its newsletter. The photo loads from Unsplash's servers when you open the email, like any image hosted elsewhere, so Unsplash may see your IP address and device details. Perkstar doesn't send Unsplash anything about you.

8. Where your data is stored, and international transfers

Your data at rest is held inside the EEA. Our database is in Ireland (AWS eu-west-1, via Supabase). Server-side request handling runs in Frankfurt (Vercel). Email and rate-limiting infrastructure are in Ireland (Resend and Upstash).

Some Perkstar-appointed sub-processors are based outside the UK and EEA — currently Stripe, Apple, Google, Telnyx and Inngest. Where Perkstar transfers data to them, we put a UK-recognised transfer mechanism in place where required, such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum. An Operator may also independently connect an integration recipient outside the UK or EEA. Your Operator is responsible for the transfer safeguards governing that provider under its separate contract with it.

9. How long we keep your data

• Active Cardholder records: kept while your Operator's subscription is active.
• Operator subscription ends: a 90-day grace window during which the Operator can export or reactivate. After 90 days, we delete Cardholder personal data from production systems, except for the pseudonymised transactional residue below.
• Loyverse integration data: Loyverse OAuth credentials and provider-only merchant identity, external-customer links, receipt, webhook and sync evidence are deleted when a Perkstar disconnect completes, or promptly after Loyverse permanently revokes authorisation. If your Operator instructed Perkstar to copy an existing Loyverse customer and their current points into its Perkstar loyalty programme, that Perkstar Cardholder record and opening loyalty balance then follow the ordinary active-record, termination and erasure rules in this section; they are not retained as a mirror of Loyverse. The de-identified Perkstar loyalty ledger may remain under the pseudonymised transactional rule below, but it no longer contains Loyverse receipt IDs, customer references, notes or provider payloads.
• Square integration data: Square access stops immediately when a disconnect, Square revocation or permanent authorisation failure is recorded. When cleanup completes, we delete encrypted Square credentials, Square merchant/location configuration, opaque matched-customer identifiers, Square-sourced operational records and retained webhook payloads. If Perkstar placed a stable Wallet scan value into a Square Customer reference_id, we release it when Square customer identification is disabled, consent is withdrawn, an erasure is completed or Square is disconnected only where we can prove that Perkstar owns the live value; we never clear another system's value. The Square Customer profile remains in Square under the Operator's and Square's retention arrangements. We may keep only de-identified Perkstar-authored loyalty balances and ledger entries under the pseudonymised transactional rule below; they no longer contain Square customer, merchant, location, payment, refund or event identifiers.
• Pseudonymised transactional residue: when an erasure request is fulfilled (or after the grace window above), identifying fields are removed (your name, email, phone, date of birth, custom fields) and any active wallet pass is voided. The transactional record itself (enrolment, redemptions, balance) is retained in pseudonymised form — linked only by an internal opaque ID and not re-identifiable to us — for the period the Operator is required to retain accounting records under tax law (typically 6 years for UK-based Operators under VATA 1994 and FA 1998).
• Data export ZIPs: 48-hour time-to-live, single-use download.
• Consent opt-in tokens: 30-day time-to-live, single-use.
• Wallet pass back-of-card links: 90-day rolling time-to-live, re-minted on every pass refresh.
• Backups: daily, retained on a rolling 7-day basis through our database provider and overwritten in the ordinary course. Backups are not restored except to recover from a disaster.

10. Your rights

Under UK GDPR (and the EU GDPR where it applies to you), you have the right to:

• access the personal data we hold about you;
• rectify inaccurate personal data;
• erase your personal data (subject to the pseudonymisation behaviour above for tax-mandated records);
• restrict processing of your data in certain circumstances;
• portability — receive a copy of your data in a machine-readable format (JSON and CSV);
• object to processing (including marketing or ad/analytics tracking) at any time;
• withdraw consent at any time, where processing is based on consent; If you withdraw optional Square Customer identification consent, Perkstar stops exact Directory searches, customer linking, profile creation and reference publication for you, and releases only a reference_id it can prove it owns. Your existing Square Customer profile remains in Square;
• complain to a supervisory authority — in the UK, the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.

The Operator is your primary point of contact. You can also use the self-service tools we expose on the loyalty card — for example, the unsubscribe link in marketing emails, the preference page linked from your pass, or the data-management options on the back of your wallet pass.

If you'd rather contact Perkstar, email privacy@perkstar.co.uk or use the public GDPR request form. We'll either action your request directly (where we can) or pass it to your Operator without undue delay. Objection requests submitted through the public form immediately switch off marketing and ad/analytics tracking consents for matching records while the request is reviewed. Square Customer identification consent can be withdrawn from your Perkstar preferences or through an erasure request.

We aim to respond to rights requests within one month, in line with UK GDPR.

11. Automated decision-making and profiling

We do not carry out solely automated decision-making producing legal or similarly significant effects about you. AI features in the platform are limited to helping Operators draft text (email copy, push notifications, card descriptions) and to suggesting reward configurations. They do not decide who gets a reward, who is admitted to a programme, or any other outcome that affects you legally or significantly.

Where we assess a business for a funding or other financial product, that assessment is about the business and its trading performance, not about you. It does not use your personal data in identifiable form and it produces no decision about you.

Automatic gender estimation has been discontinued. Earlier versions sent names, email addresses, birth years, languages and the business’s country to Anthropic for audience summaries and promotion audience selection. Estimates can be wrong. Existing estimates remain until corrected or erased; ask your business to correct or remove them. New signups and background jobs make no estimates. Customer-provided gender and AI writing tools remain available. Customer erasure clears stored gender and its inference flag.

12. Cookies and similar technologies

Perkstar-hosted pages use cookies and similar technologies for secure login, language selection, wallet-pass installation, referral attribution, integration authorisation and first-party usage analytics. We do not set third-party advertising cookies on Cardholder-facing Perkstar pages.

Non-essential advertising or analytics tracking, including Meta, TikTok or Google Analytics server-side events configured by an Operator, is separate from ordinary wallet-pass operation. We send those events only where the Operator has configured that measurement and you have given the separate ad/analytics tracking consent.

Our Cookie Policy explains the cookies, localStorage entries and similar technologies we use, why we use them, and how to change your choices.

13. Children

The Perkstar platform is not directed at children under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child has signed up for a loyalty programme through the platform, please email privacy@perkstar.co.uk. On notification, we will:

• delete the child's personal data from the relevant Operator's records;
• log the deletion to the platform's privacy timeline; and
• cease any further processing of the affected data.

Operators are responsible under their own privacy notices for handling any further consequences with the affected family.

14. Security

We protect your data using industry-standard measures, including encryption at rest and in transit, role-based access controls, multi-factor authentication for staff with production access, per-organisation tenant isolation, PII scrubbing in error monitoring, signed and hashed tokens, and a documented breach-response procedure. The detailed list is in Schedule 2 of our Data Processing Agreement.

We also design internal admin tools to reduce unnecessary exposure of personal data to staff, including role-based access, audit logs, impersonation controls, PII redaction in error reporting, and evidence records for security and data-protection operations.

No system is perfectly secure. If you believe your data may have been compromised, contact us at privacy@perkstar.co.uk.

15. Changes to this notice

When Perkstar makes a platform-wide material change to this privacy notice that we apply automatically, we will publish an updated version at this URL and notify Cardholders through an in-app banner or email (via the relevant Operator) at least 14 days before the new version takes effect.

An integration-specific disclosure takes effect for affected Cardholders when their Operator enables that integration, after the Operator has informed them and established a lawful basis for the sharing. The integration does not receive their data through Perkstar before the Operator enables it.

Earlier versions are available on request.

16. Contact

For privacy questions, rights requests, or anything else related to how Perkstar handles your data, email privacy@perkstar.co.uk.

Postal address: Perkstar Ltd (company number 16256732), 86-90 Paul Street, London, EC2A 4NE, United Kingdom.

We are based in the United Kingdom and pay the UK ICO data protection fee. Perkstar has not appointed a representative in the European Union under Article 27 of the EU GDPR. If you are in the EEA and the EU GDPR applies to your data, you can still exercise your rights by contacting us using the details above, or by complaining to your local supervisory authority.