Privacy Policy

PocketPerks is a digital loyalty card platform operated by VenturesSky Ltd (“PocketPerks”, “we”, “us”). This policy explains what personal information we collect, why, and what rights you have over it. It applies to both business owners who run a loyalty program on PocketPerks (“merchants”) and the customers who hold a PocketPerks loyalty card (“cardholders”).

If you’re a merchant:

• Your email address and password (stored as a one-way hash, never in plain text)
• Your contact name and phone number, given when you sign up, so we can reach you about your account
• Your business name, branding (logo, colours), and reward program details
• Staff accounts you create, and each staff member’s email/password
• Location details, if your business operates from more than one address

If you’re a cardholder:

• Your email address, collected when you join a loyalty program (used to send you your card link and, if a business chooses to, occasional reward updates)
• Your stamp and reward history, tied to an anonymous card identifier — we deliberately do not require an account or password to hold a card
• If you add your card to Apple Wallet or Google Wallet, a device identifier used only to push card updates to your phone
• Your birthday, if you choose to add one — the day and month only, never the year. It is used for nothing but a birthday reward from that business, and you can skip it
• Whether you have been asked to leave a Google review, and whether you tapped the ask — so a business doesn’t ask you again. We never learn whether you left one

We also automatically log failed login attempts (email address and timestamp only) for up to a short period, purely to detect and slow down attempts to guess a password.

• To create and operate your account or loyalty card
• To send essential emails — verifying your email address, sending your card link, or notifying you of a reward
• To send you messages and offers from a business whose loyalty card you joined. These appear in your phone wallet if you added the card there, and otherwise come by email. Every one of these emails has an unsubscribe link, and unsubscribing stops them straight away
• To keep the service secure (detecting suspicious login activity)
• To understand how PocketPerks is used, so we can improve it (see Cookies below)
• To meet our legal and accounting obligations

We do not sell your personal information to anyone, for any reason.

We use one essential cookie (pocketperks_session) to keep merchants signed in — the service cannot function without it, so it doesn’t require consent under UK cookie law. We also use PostHog, a product analytics tool, and Microsoft Clarity, which records anonymised heatmaps and session replays of how visitors use the site (sensitive content like form fields is masked automatically) — both set their own cookies to understand how the app is used. See our Cookie Notice for the full list and how to opt out.

We keep a simple count of how many people visit this website and which pages they look at. We do this ourselves rather than through an outside analytics company.

This does not set a cookie and does not store your IP address or anything else that identifies you. To avoid counting the same person twice in a day, we combine your IP address and browser type with today’s date and a secret key, and turn the result into a scrambled code. That code cannot be turned back into your IP address, and it changes every day, so you cannot be recognised from one day to the next. Your IP address itself is never written down.

We record only the page address, never anything after a ? in the web address — so the links we email you, which can contain your email address, are never stored here. We count the public website only, not the pages you see once signed in and not your loyalty card.

Because none of this identifies you, it does not need your consent and there is nothing to opt out of. It is separate from PostHog and Microsoft Clarity, which do set cookies and only run if you accept them.

We use a small number of trusted service providers to run PocketPerks:

• Resend — delivers our emails (verification links, card links, reward alerts, and messages from businesses whose loyalty card you joined)
• Apple and Google — power the Wallet pass features, if you choose to add your card to a phone wallet
• PostHog — product analytics, to understand app usage
• Microsoft Clarity — heatmaps and session replays, to understand how visitors use the site
• Backblaze and Synology — store encrypted, automated backups of our database, off our main server, purely for disaster recovery

Each of these providers only receives the minimum information needed to do their job, and none are permitted to use your data for their own purposes.

We keep account and loyalty data for as long as your account (or your loyalty card) is active, plus a reasonable period afterward in case you return. Automated database backups are kept on a rolling basis and are covered by the same protections as the live data. If you’d like your data deleted sooner, contact us and we’ll action it, subject to any legal retention requirements (e.g. accounting records).

Passwords are never stored in plain text. Our database is backed up automatically every night, with copies kept in two separate physical locations, so a single point of failure can’t result in permanent data loss. See our Terms and Conditions for more on our backup and recovery approach.

Under UK data protection law, you have the right to:

• Ask what personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete your information
• Object to or restrict certain uses of your information

To exercise any of these rights, get in touch using the details on our Contact us page. If you’re not satisfied with our response, you have the right to complain to the UK Information Commissioner’s Office (ico.org.uk).

PocketPerks is intended for use by adults running or patronising a business. It is not directed at children, and we do not knowingly collect information from anyone under 16.

We may update this policy from time to time as the service changes. We’ll update the “Last updated” date above whenever we do; significant changes will be communicated more directly where appropriate.

Questions about this policy or your data? See our Contact us page for how to reach us.