Information we collect
TBC collects the information needed to provide loyalty and membership services. This may include account details such as name, email address, business name, branch information, customer name, loyalty activity, visits, rewards, membership status, campaign participation, and payment proof details submitted by owners.
How we use information
We use information to create and manage accounts, operate loyalty and memberships, process reward redemptions, display business and branch details, support owner dashboards, manage campaign access, review subscription or payment proof requests, improve the service, and protect TBC from misuse or unauthorized access.
Customer loyalty data
Customer loyalty information is used to show card status, record visits, determine reward availability, and support membership benefits. Owners can access customer activity connected to their own business or branch so they can operate their loyalty programme.
Sharing of information
TBC does not sell personal information. We may share information with service providers that help us run the app, host data, process authentication, store images or files, and maintain the service. We may also disclose information if required by law, to enforce our rights, or to protect users, businesses, and the platform.
Service providers we use
TBC uses a small number of service providers, each for one purpose: Supabase hosts the database, authentication and file storage; Resend sends the emails TBC or a business sends through it; Paddle.com Market Ltd processes card payments as merchant of record; Vercel hosts the web app; Sentry receives error reports with personal information already removed before it leaves your device or our servers; PostHog receives anonymous product-usage events, never your name, phone number or email; and, for businesses using the lead-finder tool, Google Places supplies public business listings. None of these providers receives more than it needs to do its one job, and none may use TBC data for its own purposes.
Data storage and security
TBC uses technical and organizational safeguards designed to protect information from unauthorized access, loss, misuse, or alteration. No online service can guarantee absolute security, but we work to keep access limited to the people and systems that need it to operate the service.
Why we are allowed to use your information
We process customer loyalty information to perform our contract with the business you are a customer of (running your card, tracking rewards, sending service messages). We process account, billing and support information to perform our contract with a business owner. We send marketing email only where you have opted in, which you can withdraw at any time. We keep security, fraud-prevention and audit records under our legitimate interest in protecting the service, weighed against your rights. Where a business asks us to hold information for a purpose beyond these, that business is responsible for having its own lawful basis for asking.
How long we keep information
A customer account and everything attached to it is kept until you ask us to delete it, or the business you hold a card with removes you. Deletion requests take effect seven days after you make them — reversible for all seven, so an accidental request cannot destroy something you meant to keep — and remove essentially everything: your cards, stamps, redemptions, memberships and visit history. A small number of records (security logs, fraud-prevention signals, and a one-way proof that a deletion happened) are kept for a bounded period afterwards because they no longer identify you. Technical logs, rate-limiting records and old outreach email history are removed automatically after a few weeks to about a year, depending on the record. Records TBC must keep for its own legal, accounting or audit obligations are kept as long as that obligation requires.
International transfers
TBC and its service providers may process information in a different country from the one you are in. Where that happens, we rely on the safeguards our providers offer for cross-border transfer — standard contractual clauses or an equivalent recognised mechanism — and we do not transfer information to a provider that has not committed to protecting it to a comparable standard.
Your rights
Depending on where you are, you may have the right to: access the personal information we hold about you; correct it if it is wrong; ask us to delete it; ask us to restrict or object to certain processing; receive a copy in a portable format; and withdraw a consent you previously gave, at any time and without affecting anything done before the withdrawal. A customer can exercise access, correction and deletion directly in the app — see your profile screen — without waiting on a request to support. For anything the app does not yet offer as a self-service action, contact TBC through the Contact page and we will respond within a reasonable time and in any case within the period the law where you live requires. If you believe we have not handled your request properly, you may complain to your local data protection authority.
Age
TBC is intended for people aged 16 or older. Where the law that applies to you sets a lower minimum age for using a service like this without a parent or guardian’s involvement — in the United States, 13 — that minimum applies instead. We do not knowingly collect personal information from anyone below the age that applies to them, and a parent or guardian who believes we have should contact TBC so it can be removed.
Changes to this policy
We may update this Privacy Policy from time to time. When we make changes, we will update the effective date and publish the revised policy on this page.
Contact
For privacy questions or requests, contact TBC support at thebeansclub.app@gmail.com.
Who operates the service
The Beans Club is operated from Pakistan (Islamabad, Pakistan). Privacy questions can be sent to thebeansclub.app@gmail.com.