Privacy Policy

The short version

We do not know your name. We never see your card number. We do not run advertising cookies or tracking pixels on guest receipt pages, and we do not sell your individual data.

A receipt-access credential is stored on your device. We build a persistent visit history only if you allow visit analytics. A loyalty card separately stores its qualifying purchases, points, tier, membership and rewards. Under the GDPR that pseudonymous history is personal data even when it carries no name, and we describe it that way.

What we collect when you tap

Tapping the marker at the counter opens your receipt. To do that, we record the time of the tap, the store, device category and browser language. We do not store the raw IP address or the raw browser user-agent string.

During receipt matching we create two temporary identifiers. The first is a rotating signal derived from your IP address and browser characteristics through a one-way function with a salt that changes daily. Your IP address itself is never stored. The second is a random value we place in a first-party cookie on your device. Neither carries your name. The random cookie is required to prove that this browser owns the receipt and to reopen it later. Once matching is complete, tap identifiers are removed unless you have allowed visit analytics.

If you allow visit analytics, the same first-party identifier can recognise return visits. It is used to show you your own visit history, for a venue’s own reporting, and for locations managed under the same account. We do not use the necessary receipt cookie to target you across unrelated venues.

What we receive from the store

Once your tap is matched to a sale, the store’s point-of-sale system sends us that receipt: the items, prices, VAT, totals, time, terminal and payment method. We store the response as it arrives so that a later correction from the till can be reconciled.

We never receive or store your card number.

What we collect if you go further

Joining a loyalty card. You give us an email address and we send a confirmation link. Your card exists only once you click it. From then on we hold your email, the qualifying purchases and rewards on your card, and which venue you joined at. For each qualifying purchase we also keep its total and how many qualifying items it had, because points and tiers are counted from them. Your email is what lets the same card follow you between your phone and any other device. Joining also keeps a history of your visits, described next.

Points and tiers. If the venue runs points, we keep a record of the points each purchase earned, the rewards you spent them on and your balance. If it runs tiers, we work out your tier from your qualifying purchases over the last 12 months and keep the tiers you have reached and when. This is an automated assessment of your purchases, used only to show your tier and its perk; it has no legal or similarly significant effect on you. The venue's staff see your balance or your tier when they look you up in its guest list.

Asking for membership. If the venue runs a membership, you can ask to become a member from your card. Asking shares the email address on your card with that venue, and the screen says so before you ask. The venue sees that email address, when you asked and how many qualifying visits you have made in its program, so it can recognise you and decide. We keep the email address you shared, the version of the wording you were shown, and when you asked and when the venue decided. To stop being a member, write to us or to the venue.

Keeping a history of your visits (visit analytics). This is an optional box on a receipt’s History tab: “Keep a history of my visits on this phone. The venue also sees anonymous repeat-visit numbers.” Joining a loyalty card includes it, and its wording says so. If you keep a history, we link your visits so you can see them on the History tab for a year, and the venue sees repeat-visit numbers that do not identify you. You can untick the box on the History tab at any time; doing so unlinks your visits and deletes the visit totals kept for your history.

Allowing market insights. This is a separate, optional box when joining a loyalty card. Only records covered by that consent may contribute to aggregated cross-venue insights.

Having a receipt emailed to you. The address passes through us to our email provider and is not kept. We record only that a receipt was sent and to which domain.

Asking for offers. This is a separate tick box, never pre-ticked, and you can withdraw it without affecting your loyalty card. We store the email address and the version of the wording you agreed to. We do not currently send SMS or WhatsApp messages.

Unlocking an offer with your contact details. Some venues offer something in exchange for permission to email you. The form asks for your name and email address and, if you want a birthday offer, your date of birth. You must be 18 or over to give a date of birth; the form checks it and keeps nothing if you are younger. Nothing is kept until you confirm with the link we email you. The venue then sees your name, email address and date of birth. You can withdraw from your receipt or from that email, and your name and date of birth are deleted when you do.

Saving to Google Wallet. If you save a venue's loyalty card, Google receives a pass showing that card's progress (stamps, a points balance, a tier or a membership) and its next reward, perk or discount, identified to Google by an internal pass number. If you save a receipt, Google receives a copy of it: the venue, the date, the items and the total. Neither contains your name or your email. You can remove either pass from Google Wallet at any time; if you ask us to delete your data, we mark your saved passes as expired.

Adding to Apple Wallet. On an iPhone the pass goes from us straight to your phone; we do not send it to Apple. A receipt pass holds the venue, the date, the items and the total, and it stays in your Apple Wallet even after the receipt is deleted here, until you remove it. A loyalty card pass shows the card's progress and its next reward, perk or discount. Neither contains your name or your email. If you keep your Wallet in iCloud, Apple stores your passes under your own agreement with Apple.

To keep a loyalty card pass up to date, your iPhone gives us a device identifier and a push token for that pass. When your card changes, we send Apple's push service a notice addressed to that token. The notice carries no content; it only tells your phone to fetch the new version from us. Apple receives the push token, our pass type and the usual connection data, and no details of your card. When you remove the pass, your phone tells us and we delete that registration. If you ask us to delete your data, or the venue leaves hndrdfold, the pass is marked as no longer valid and your phone shows that the next time it connects; we cannot remove it from a phone that stays offline.

Pseudonymous, not anonymous

An earlier version of this policy described tap data as anonymous. That was not accurate and we have corrected it. Data that cannot be tied to your name is still personal data if it can single you out, and a persistent device identifier attached to a purchase history does exactly that.

What follows from that is not a smaller claim but a larger duty: the rights described below apply to this data, not only to your loyalty card.

Legal basis

Delivering your receipt: necessary to provide the service you asked for by tapping.

Your visit history and return-visit analytics: your consent, given on a receipt’s History tab or by joining a loyalty card, which you can withdraw on the History tab without losing access to your receipts.

Your loyalty card (including points and tiers), a membership request, marketing messages, market insights, and wallet passes: your consent, given separately for each relevant purpose and withdrawable at any time. Marketing consent is also governed by section 10 of the Danish Marketing Practices Act.

Aggregated market insights shared outside the venue’s own account: the separate market-insights consent. The loyalty card’s required terms alone do not cover this use.

How long we keep things

Receipt content: 90 days from when we receive it, then deleted automatically.

Visit totals in your history: if you keep a history of your visits, the date and total of each visit stay for one year, though the receipt itself is deleted at 90 days. The items do not stay. Withdrawing deletes them at once.

Your name and date of birth, given to unlock an offer: until you withdraw that permission. The record that you gave it and withdrew it is kept as evidence, without them.

An unfinished registration: if you enter an email address and never confirm it, that address is deleted within seven days.

Tap and event records: operational fields such as timestamp, store, device category and language are retained for up to two years. Persistent device identifiers are kept on these rows only when you keep a history of your visits, and are removed when you withdraw it.

Sales enquiries: up to one year if they do not become an active customer relationship.

Your loyalty card: until you ask us to delete it. This includes its points record, the tiers you reached and any membership request, also after a venue changes its program: points from an ended points program can be spent for 90 days, and a tier or member discount shows for 90 days, but the record of them stays with your card until you delete it.

Apple Wallet registrations: the device identifier and push token your iPhone gives us for a loyalty card pass are kept until you remove the pass. After an erasure or a venue leaving, they are kept for at most eight days, so the phone can be told the card is no longer valid, and then deleted. A receipt pass registers nothing with us.

The receipt-access cookie: 90 days, renewed each time you tap, matching the receipt-access period. Clearing browser data ends it immediately. The analytics preference cookie lasts up to 180 days so we can remember your choice.

Who else processes your data

These are the companies involved in running the service. We do not sell data to anyone, and nobody on this list is an advertiser.

• Supabase: the database. Hosted in the European Union, Frankfurt.
• Vercel: application hosting. Our functions run in the EU, Frankfurt region.
• OnlinePOS: the store’s point-of-sale system, which is where every receipt comes from. It is the store’s own supplier rather than ours: we read from it using credentials the store gives us, and we send it nothing about you.
• Resend: sends receipt and confirmation emails. Your address goes to them at the moment of sending.
• Google: Google Wallet, if you choose to save a pass, and the Google Cloud services behind it. Address autocomplete on our own staff screens also uses Google Maps.
• Apple: if you add a loyalty card to Apple Wallet, Apple's push service (APNs) delivers our update notices to your iPhone. Apple provides Wallet and APNs under its own terms, through Apple Distribution International Ltd in Ireland.
• cron-job.org: triggers the scheduled jobs that import receipts and run deletions. It holds no guest data.

Some of these process limited data outside the EU or EEA under Standard Contractual Clauses. If you write to us we will tell you the current list and where each one sits.

Who is responsible for what

For your receipt, your visits and your loyalty card at a particular venue, that venue is the data controller and hndrdfold is its processor, working on its written instructions under a data processing agreement.

For the optional aggregated market-insights product, hndrdfold is a controller in its own right. Only records covered by the separate market-insights consent may be used. Those statistics describe groups and never identify you, but the decision to produce them is ours, so the responsibility is ours too.

hndrdfold is operated by Hndrdfold, a Danish sole proprietorship, CVR 46479262, Amagerbrogade 131, 2300 København S, Denmark.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to processing we base on legitimate interest, and ask for your loyalty card data in a portable form. Where we rely on consent you can withdraw it at any time, and withdrawing it does not affect what happened before.

Write to us and we will answer within 30 days. If you have only ever tapped and never joined a loyalty card, we can still act on your request. Tell us and we will explain what identifier we need from you in order to find your records without asking for more information than the request requires.

If you are not satisfied with how we handle it you can complain to the Danish Data Protection Agency, Datatilsynet, at datatilsynet.dk.

Cookies

We set a necessary first-party cookie, hf_device_token. It holds a random value, it is marked httpOnly so page scripts cannot read it, and it lasts 90 days from your most recent tap. It proves receipt ownership and lets the receipt reopen on your phone.

A second httpOnly first-party cookie, hf_analytics_consent, remembers whether you keep a history of your visits, for up to 180 days. It does not identify you. We use no advertising cookies or tracking pixels on guest receipt pages.

Children

Loyalty cards are for people aged 18 and over. Anyone can view a receipt.

Changes

When we change this policy we change the date at the top. If a change materially affects loyalty card holders we email them.

Contact

For anything in this policy, including a request about your data: hello@hndrdfold.com