Your cards. Your choices. Plain language.

1. Who we are

ZAR Rewards (Pty) Ltd is a company registered in the Republic of South Africa and operates the ZAR Rewards app, website and related services. In this policy, “ZAR Rewards”, “we”, “us” and “our” refer to ZAR Rewards (Pty) Ltd. We are the responsible party for personal information we determine how and why to process under the Protection of Personal Information Act, 2013 (“POPIA”).

Privacy and Information Officer enquiries can be sent to hello@zarewards.com. If a different formal Information Officer address is registered with the Information Regulator, that address should be added to this page.

2. What this policy covers

This policy applies when you use the ZAR Rewards mobile app, visit zarewards.com, create or manage an optional account, manually sync cards, enable store detection, choose communication preferences, or contact us for help or feedback.

It does not govern the independent privacy practices of retailers, loyalty programmes, Supabase, Apple, Google, Facebook or other third parties. Their own notices and terms apply to information they determine how and why to process.

3. Information we handle

3.1 Your loyalty cards

ZAR Rewards stores your loyalty cards on your device. You do not need an account to use the app, and if you never create one, your cards never leave your phone.

If you choose to sync: When you create an account and tap “Sync cards”, we store a copy of your cards in your ZAR Rewards account so you can restore them on another device. Syncing never happens automatically—nothing is uploaded until you ask, each time.

When you sync, we store:

• the loyalty programme and card name;
• the membership number on the card;
• any nickname or favourite marking you added;
• a points balance you entered yourself; and
• the dates the card was added and last changed.

What stays on your device: We do not upload your logged spend, your receipt photos, or which cards you use and when. That information stays on your device.

Where synced cards are stored: Synced cards are held in our database, hosted by Supabase. Access is restricted to your own account at the database level: your records can only be read or changed while signed in as you.

Removing synced cards: Delete a card in the app and sync again, and it is deleted from your account. Deleting your account removes all synced cards.

3.2 Camera and barcode scanning

The app requests camera or photo-library access only when you choose a feature that needs it, such as scanning a barcode, importing a screenshot or photographing a receipt. Barcode and receipt processing is designed to occur on your device. Receipt photos and logged spend are not included in cloud card sync. We do not need or request your retailer or loyalty-programme password.

3.3 Signing in

You can sign in with an email address and password, or with Apple, Google or Facebook. When you use one of those sign-in providers, we receive your email address and, if you allow it, your name. We may also receive a provider identifier needed to connect the sign-in to your ZAR Rewards account.

We do not receive your Apple, Google or Facebook password and we do not post anything on your behalf. Your password for email-and-password sign-in is handled by the authentication service and is not stored by ZAR Rewards as readable text.

3.4 Optional location and store detection

Location access is optional and off unless you enable the store-detection feature and grant permission through your device. When enabled, the app uses your device location to identify the store or nearby stores so it can suggest a relevant loyalty card.

To provide this feature, location coordinates or an approximate search area and related request information are sent to Google Maps Platform or the Google Places API. Google processes that request under its own privacy terms. ZAR Rewards does not use location for advertising, does not include location in card sync, and does not create a location history in your ZAR Rewards account.

You can withdraw consent at any time by switching off store detection in the app or removing location permission in your device settings. The feature will stop working when permission is withdrawn, without affecting your local wallet.

3.5 Communications and email preferences

If you create an account, we may use your email address for necessary account and service communications, including authentication, password reset, security, material service changes, privacy or terms updates and support replies. These are not promotional messages and are used only where reasonably necessary to operate or protect the service.

Product news, feature announcements, surveys, offers or other marketing communications will be sent only if you make a separate marketing choice, or where another lawful basis expressly permits the communication. Account creation is not treated as automatic marketing consent. You can unsubscribe using the link in a marketing email or contact us. Unsubscribing from marketing does not stop essential account or security messages.

Where consent is used, we may keep a record of the choice, including the address, date, source and version of the consent wording, so we can honour and demonstrate your preference.

3.6 Support and feedback

If you contact us, we receive the information you choose to send, such as your name, reply email, message, device model, app version and attachments. The feedback form on our Help page prepares an email in your own email app; the website itself does not store the completed form.

3.7 Technical information and future Firebase use

Our hosting, authentication, security and app-distribution providers may generate limited technical records, such as IP address, browser or device type, timestamps, authentication events, crash details and security logs. We use this information only where available and reasonably necessary to operate, secure, diagnose and improve the service.

We do not currently use the website for personalised advertising, and the static website does not intentionally set advertising cookies. A browser, hosting provider or linked third-party service may still process information under its own policy.

Firebase is not described here as an active collection tool at the date of this policy. We may introduce Google Firebase services in a future app version for functions such as crash reporting, performance monitoring, analytics, notifications or other app infrastructure. Depending on the feature enabled, Firebase may process device or installation identifiers, app interactions, diagnostics, crash data, performance information or notification tokens. Before enabling a Firebase feature that changes our processing, we will update this policy and applicable app-store privacy disclosures, and request consent where required.

4. Why and how we use information

We process personal information only for defined purposes connected to the service, including to:

• store and display the loyalty cards you choose to add;
• provide optional sign-in and account features;
• sync the listed card fields only when you actively request it, and restore them after you sign in on another device;
• use your location, only with permission and while store detection is enabled, to request nearby-store information from Google Maps Platform or Places;
• authenticate users and prevent unauthorised access, abuse or fraud;
• respond to support messages, privacy requests and feedback;
• diagnose faults, protect service integrity and improve usability;
• meet legal, regulatory and app-store obligations; and
• send necessary service communications and, only with a separate lawful permission, optional marketing communications.

You control whether card information is sent to the cloud. Not creating an account keeps the wallet local. Creating an account does not itself upload cards; a card upload happens only when you tap “Sync cards”.

Our lawful bases under POPIA depend on the feature and may include: your consent for optional location and marketing; actions necessary to provide an account, requested sync or support; our legitimate interests in securing, maintaining and improving the service where those interests do not unjustifiably override your rights; and compliance with legal obligations.

5. When information is shared

We do not sell your personal information. We may disclose only what is reasonably necessary to:

• Supabase: provides database, authentication and related infrastructure used for optional accounts and user-triggered card sync;
• Sign-in providers: Apple, Google or Facebook process a sign-in when you choose that provider;
• Google Maps Platform and Places: process a location-based nearby-store request only when you enable store detection and grant location permission;
• Email and communication providers: process addresses and delivery information needed for authentication, service messages, support and any separately authorised marketing;
• Google Firebase, if introduced: may provide diagnostics, performance, analytics, notification or app-infrastructure services only after the relevant feature is enabled and our disclosures are updated;
• Other service providers: providers supporting security, diagnostics, app distribution and website delivery, subject to appropriate contractual or technical safeguards;
• Legal and safety purposes: regulators, law-enforcement bodies, advisers or other parties when required by law, to protect rights and safety, or to investigate misuse; and
• Business changes: a successor or potential successor in a legitimate merger, financing, reorganisation or sale, subject to confidentiality and applicable law.

Retailers and loyalty programmes do not receive your ZAR Rewards wallet data from us merely because their programme is listed in the app. Presenting a barcode at a till causes the retailer to process it under that retailer’s own programme and privacy rules. A store-detection lookup may send location and search information to Google, but does not send your synced card membership number to the retailer.

6. International processing

Supabase, Google, Apple, Facebook and other service providers may process information outside South Africa. Where personal information is transferred across borders, we take reasonable steps intended to meet POPIA section 72, including using providers, contractual terms and safeguards designed to provide an appropriate level of protection.

7. Retention and deletion

• Guest-mode data: cards stored only on your device remain there until you delete them, clear the app’s data or uninstall the app, subject to any device or operating-system backup you control.
• Synced card data: remains in your account until you delete the card locally and sync again, or delete your account.
• Account data: remains while your account is active. Using the in-app account-deletion function removes the account and its synced cards.
• Location: ZAR Rewards does not retain a location history in your account. Google may retain request or technical information according to its own policies.
• Communication preferences: retained while needed to send authorised communications, honour an unsubscribe or demonstrate the consent choice.
• Support and feedback: retained only for as long as reasonably necessary to respond, keep an appropriate record and improve the service.
• Security records: limited authentication or security records may be retained where reasonably necessary to protect the service or meet a legal obligation.

Deleting your account removes the account and all synced loyalty cards. Limited records may still be retained only where required for security, fraud prevention or a legal obligation. Aggregated or de-identified information that can no longer reasonably identify you may be kept for analysis.

8. Security

We use reasonable technical and organisational measures appropriate to the nature of the information, including encrypted connections, database-level access controls that restrict synced records to the signed-in account, and service-provider safeguards. No storage or transmission method is completely secure. Protect your device with a strong passcode, keep its software current and do not share sensitive passwords through support or feedback.

ZAR Rewards is a loyalty-card wallet, not a payment wallet. Do not store payment-card numbers, PINs, passwords or other secrets in card notes or feedback.

9. Your choices and privacy rights

Subject to POPIA and other applicable law, you may ask us to confirm whether we hold personal information about you and request access, correction, deletion or restriction where appropriate. You may also object to certain processing, withdraw consent and lodge a complaint. Withdrawing consent does not affect processing that was lawful before withdrawal.

You can switch off store detection or revoke location permission at any time. You can unsubscribe from marketing without deleting your account. You may still receive strictly necessary authentication, security, legal and service messages while an account remains active.

To make a request, email hello@zarewards.com. Describe the request and use the email address connected to your account where possible. We may need to verify your identity before acting and will respond within the period required by applicable law.

You may also complain to South Africa’s Information Regulator. Current contact details and complaint channels are available at inforegulator.org.za.

10. Children

ZAR Rewards is not directed to children under 18 acting without the involvement of a parent, guardian or other competent person. If you believe a child’s personal information has been processed without appropriate authority, contact us so we can investigate and take appropriate action.

11. Retailers, programmes and third parties

ZAR Rewards is independent and is not the issuer or administrator of the loyalty cards shown in the app. All retailer, bank, fuel, travel, membership and loyalty-programme names, logos, icons, trade marks and other brand assets belong to their respective owners. Their appearance is intended only to identify a supported programme and help users select and present their own cards. It does not mean that ZAR Rewards owns those marks or that the owner sponsors, endorses, authorises or is affiliated with ZAR Rewards unless a partnership is expressly stated.

Programme balances, benefits, conversion methods, earning rules and redemption rules are controlled by their respective owners. Links and store buttons may take you to third-party services governed by separate terms and privacy policies. A rights owner with a concern about a mark displayed by ZAR Rewards can contact hello@zarewards.com for review.

12. Changes to this policy

We may update this policy as the app, our providers or legal requirements change. This includes updating the policy and app-store privacy disclosures before activating Firebase or another service that materially changes the information collected or its purpose. The revised version will be posted here with a new “Last updated” date. If a change materially affects how we use personal information, we will provide additional notice or request consent where required.

13. Contact us

Questions, POPIA requests, Information Officer enquiries or concerns can be sent to hello@zarewards.com.

Responsible party: ZAR Rewards (Pty) Ltd, Republic of South Africa.