Effective 16 June 2026

Privacy policy

Fidz takes your privacy and your customers' privacy seriously. This policy explains what we collect, why, where it's stored, and your rights — written in plain English, no lawyer-speak.

Who we are

Fidz is operated by Adrien Pouchard, sole trader (individual) (ABN 89 169 486 121), based at 340 Boundary Road, Tallygaroopna, Victoria 3634, Australia. We provide a software-as-a-service platform that helps local businesses run digital loyalty programs via Apple Wallet and Google Wallet. Contact: hello@fidz.app.

What we collect (and from whom)

We collect two distinct categories of personal information:

1. From merchants (you, the business owner)

Your email address and password (hashed).
Your business name, address, phone number, and business type.
Payment information (handled by Stripe — we never store your card details).
Logs of your dashboard activity for security and debugging.

2. From your customers

Their mobile phone number, if the business asks for it.
Their first name (optional).
Their birthday (optional).
Their email address (required to issue a loyalty card, and confirmed with a one-time code).
Visit timestamps and points earned.
Their language preference (auto-detected from their phone).

Customer data belongs to the merchant who collected it. Fidz acts as a data processor on the merchant's behalf — we don't sell or market to your customers ourselves.

The Fidz Pro app (iPhone and Android)

Fidz Pro is the companion app for merchants and their team. It uses the same account as the website, and the same data. It adds the following, on the phone:

Sign-in. Your session is kept in the phone's secure storage (Keychain on iPhone, Keystore on Android).
Notifications. If you allow them, we store your phone's push token, the phone's name, its system (iPhone or Android), the app version and your language, so that we can alert your team (for example “stamp to validate”). The alert text can include a customer's first name and goes through Expo's push service and Apple's or Google's notification service. The token is removed when you sign out, when the owner removes you from the team, and when you delete your account.
Camera. Used only to read the QR code of a customer's card. The picture is analysed on the phone and is never recorded or sent; only the code that was read goes to our server.
Photos. You can pick one photo from your library for a story picture: only that photo is sent, and it is kept with your shop's story settings until you remove or replace it. The app can also save a story picture to your photos.
App lock. Face ID or the phone's code is checked by the phone itself; Fidz never receives it.
Data kept on the phone. To stamp quickly and without network, the phone keeps the customers you recently stamped or searched (name, phone number, e-mail, balance), the stamps waiting to be sent, and your display choices. This stays on the phone and is removed when you sign out of the app or uninstall it.
Support messages. When you send “A problem? An idea?”, the app adds your screen size, language, time zone, the app version and the system version to your message, so we can reproduce the problem.
What the app does not do. It has no advertising, no tracking, no analytics tool and no error-reporting tool of its own, and it does not use your location.

You can delete your account from the app (More, My profile, Delete my account) or by following these steps.

Where it's stored

All data is stored in Supabase's Sydney region (ap-southeast-2), within Australia. Backups stay within Australia. Stripe stores payment data per their own privacy policy.

How we use it

To deliver the loyalty card experience (Apple Wallet/Google Wallet passes).
To send the push notifications and e-mails that the merchant has configured.
To send Google review requests on the merchant's behalf.
To bill the merchant for their plan via Stripe.
To improve our service (anonymous aggregated metrics).
To respond to support requests.

Who we share with

We share data only with these subprocessors, each governed by their own privacy policy:

Supabase — database hosting (Sydney).
Vercel — application hosting (global edge).
Apple & Google — Wallet pass delivery and, for the Fidz Pro app, delivery of its notifications.
Expo — relays the alerts of the Fidz Pro app to your team's phones: it receives the phone's push token and the alert text (which can include a customer's first name).
Stripe — payment processing.
Resend — transactional emails.
Cal.com — booking a 15-minute call from the Contact page, only if you choose to book one (your name and email are entered on Cal.com).
Google Places — address search in the merchant dashboard: only the business name or address a merchant types in the search field is sent, from our server. No customer data. Used only when the feature's key is configured.
OpenStreetMap services (Nominatim and Photon) — the same address search, and the conversion of a saved business address into map coordinates (so the card can appear on the lock screen near the shop). Only the address text is sent, never customer data. Photon (photon.komoot.io, run by Komoot) receives the typed text straight from the merchant's browser, so it also sees the merchant's IP address.
Sentry — error reports (error message, technical trace and internal identifiers such as a shop or customer id). Used only when the error-reporting key is configured.
Google Analytics — audience statistics of the public website only, and only after you accept analytics in the cookie banner (see Cookies below).

We only engage a subprocessor once its feature is switched on for your plan. If we add or change a subprocessor, we update this list and notify you before it processes any of your data.

We do not sell personal data. Ever.

Cookies

Fidz sets the cookies and browser storage entries needed for the service to work — login session, language, your cookie choice — and nothing else unless you agree. We do not use advertising cookies. On the public website only (never in the dashboard, the sign-in page or the customer pages), Google Analytics 4 measures audience if — and only if — you accept analytics in the cookie banner; your IP address is anonymised and advertising signals are off. You can withdraw at any time with the “Manage cookies” link in the footer. The full list is in our cookie policy.

Your rights

You have the right at any time to:

Access — request a copy of all personal data we hold about you.
Correct — update inaccurate information.
Delete — request permanent deletion (subject to legal retention requirements, e.g. tax records).
Export — download your customer database as CSV anytime from the dashboard.
Withdraw consent — opt out of marketing emails or push notifications.
Complain — lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Email hello@fidz.app with the word “PRIVACY” in the subject — we respond within 30 days.

For customers of merchants using Fidz

If a local business has enrolled you in their loyalty program using Fidz, the merchant is the primary data controller. Contact them first. If they don't respond, contact us — we'll help you exercise your rights.

Data retention

We keep your data while your account is active. When you delete your account, your data is kept for 60 days (so you can change your mind — you can cancel the deletion during that window), then permanently and automatically erased. A customer can ask a merchant to delete their individual record at any time, and it is removed immediately. Tax records are kept for 7 years as required by Australian law.

Children's data

Fidz is not designed for users under 16. We don't knowingly collect data from anyone under 16. If you believe a child's data is in our systems, contact us and we'll delete it.

Security

All data in transit is encrypted via TLS 1.3.
Passwords are hashed with bcrypt.
Database uses Supabase row-level security so merchants only ever see their own data.
Stripe handles all payment data — we never see card numbers.

Changes to this policy

We'll email you at least 30 days before any material change. The effective date at the top of this page always shows the current version.

Questions? Email hello@fidz.app.
See also: Terms of service.