Privacy policy

Oktapus is a digital loyalty card. This page tells you which data we process, why, on which legal basis, who else sees it, how long we keep it and how to take back control. It covers the oktapus.app website, the merchant space and the customer space it hosts, the Oktapus app installed on your phone and Oktapus Pro, the app used by merchants and their team.

It is written to be read in full, and it gives the information required by articles 13 and 14 of the General Data Protection Regulation.

Altis Koten SRL, registered with the Belgian Crossroads Bank for Enterprises under number BE 1037.896.832, with its registered office at Traverse d'Esope 6, 1348 Ottignies-Louvain-la-Neuve, Belgique, decides the purposes and the means of the processing described here.

For any question, write to hello@fideloop.app. We have not appointed a data protection officer: as things stand, our activity falls under none of the cases in article 37, and this page will change the day that is no longer true. Your request therefore reaches the people who run the service directly.

Nothing is collected just in case. Here is the full list, category by category.

• Your account: your email address, or the relay address Apple creates for us when you choose to hide yours, an internal identifier, your language, your light or dark theme, your notification choices, the sign-in services you have linked and the creation date. We ask for neither your name, nor your photo, nor your date of birth.
• Your loyalty: the shops where you hold a card, your cards, every stamp with its date, its shop and the way it was given, the rewards handed over and the corrections a merchant has made.
• Your code: the key from which your phone, or the page of the customer space on the website, computes the code you show at the counter, a record of the codes already used, and the last stamp a shop refused, with its date.
• The contest: your declaration (country of residence, minimum age confirmed, rules accepted), your entries, your answers, your results and your vouchers.
• Your device, if you turn notifications on: an installation identifier, the notification token, the platform, the app's language, the time zone and the app version.
• Your location, if you allow it: it is used to work out an answer and is never kept.
• The home screen measurement: which card your home screen was showing when a stamp was given.
• Your reports: the shop reported, the reason and your comment.
• The shops you hid: their list and the date, until you show them again or your account is deleted.
• The notifications we send you: their type, their status and their date.
• Your requests: a deletion request, a request for a copy of your data, a message sent from the contact form.
• The website: our host's technical logs, which contain your IP address and the time of the request.
• If you are a member of a shop's team: your email address, your role, the name the shop gives your station, the date of your last scan, and the stamps and vouchers you recorded.
• If you are a merchant and subscribe to the contactless plan: the billing name and email address, the billing address, the VAT number and the result of its check, the recipient's name and the delivery address of the kit, and the status of the subscription and of the kit. Your bank card or bank account details are entered at Stripe and never reach us.

The app works without an account. As long as you do not sign in, we have neither your address nor your name: only a device and its cards. The customer space on the website, for its part, requires an account.

• Keeping your cards: adding a stamp when the shop scans your code or you tap its contactless card, counting, and opening a new card once the reward has been handed over.
• Keeping your account: signing you in, finding your cards again after you change phone, answering your messages.
• Letting a shop's team give stamps and redeem vouchers with Oktapus Pro, or scan a code from the browser, in the merchant space on the website.
• Showing you the partner shops around you, and putting the card of the shop you are in at the top of the home screen, if you allow location.
• Running the contest: recording your answer, drawing the winners among the correct answers, issuing and redeeming the vouchers.
• Checking, in aggregate figures, that the home screen shows the right shop.
• Sending you the notifications you have accepted, and no others.
• Offering you Discovery: telling you about a nearby partner shop where you do not have a card yet.
• Handling reports and suspending a shop that breaks our rules.
• Preventing abuse: limiting attempts, letting a code or a contactless card serve only once, limiting the stamps given in a short time, and protecting a merchant's programme from someone who would drain it without ever setting foot in the shop.
• Meeting our accounting obligations when a merchant pays for a plan.
• For a subscribed merchant: collecting the subscription, issuing its invoices, checking its VAT number and sending it the kit.

What we do not do: no resale, no exchange, no targeted advertising, no advertising profiling, and no automated decision producing legal effects concerning you. This website carries no analytics tool whatsoever.

Every processing operation rests on a basis set out in article 6 of the Regulation, and here is which one.

• Performance of our contract, article 6(1)(b): your account, your cards, your stamps, your rewards, signing in, support, the copy of your data, your contest entry under its rules, the draw and your voucher, and a team member's access to Oktapus Pro.
• Your consent, article 6(1)(a): notifications, Discovery, and reading your location, which you allow yourself, in the app and then in your phone's settings. You give it on a screen that explains what it does before asking for anything. You withdraw it for notifications and Discovery from Profile, then Notifications, and for location in your phone's settings. Withdrawal only applies going forward and takes nothing away from your cards.
• Our legitimate interest, article 6(1)(f): preventing fraud and abuse, the security of the service, the technical logs, the record that lets a contest draw be checked, the home screen measurement and the handling of reports. The interest at stake is a simple one: that a merchant does not watch their programme drained by someone who never came in, that your account is not taken over by somebody else, that a draw can be shown to be fair, and that a feature which guesses where you are does not mislead you.
• A legal obligation, article 6(1)(c): invoicing and the retention of accounting records, when a merchant pays for a plan.
• Performance of the contract with a subscribed merchant, Article 6(1)(b): the subscription payment, the VAT number check, the billing emails and the delivery of the kit.

Refusing notifications, Discovery or location changes nothing about your cards or your stamps.

Three routes in the Oktapus app, all of which give us the same thing: an email address.

• With Apple, you choose to share your address or the relay address Apple creates for us. Either way, we receive that address and nothing else. If you remove Oktapus from your Apple account, we are told and your account is deleted.
• With Google, we receive your address and the identifier Google gives us for you. We ask for neither your contacts, nor your files, nor your photo.
• With an emailed code, we receive only the address you had it sent to. There is no password to remember, and therefore no password to lose.

Oktapus Pro, the merchant space and the customer space on the website only offer the emailed code. A sign-in code lives for five minutes and stops working after three attempts. The code of the deletion page lives for fifteen minutes and stops working after five attempts.

The Oktapus app has no scanner and does not use your phone's camera. A stamp is given in one of two ways.

• You show your code in the Stamp tab, and the shop scans it with Oktapus Pro, or from a phone's browser, in the merchant space on the website. The code is computed by your phone from a key of your own account, changes every thirty seconds and shows even without a network. It designates your account and nothing else: neither your name nor your address. Each code serves only once, and we keep a record of the codes already used for seven days so that they cannot be presented again.
• You hold your phone to the shop's contactless card. The card answers a challenge our server draws for that tap, and we keep that answer for one day so that it cannot be used again.

While your code is on screen, the app regularly asks our server whether a stamp has just been given, so that it can show it to you straight away. If a shop refuses a stamp, we keep the latest refusal, with its date and the shop, so that your screen can tell you why.

Without the app, the customer space on the website shows the same code. The page receives the key from our server each time it opens and keeps it in memory while it stays open, without writing it to your browser's storage: once closed, it forgets it, and without a network it shows no code. Like the app, it regularly asks our server whether a stamp has just been given.

Oktapus Pro lets a merchant and their team give stamps and redeem contest vouchers. You sign in with a six digit code received by email, on the same account as the merchant space on the website. If the address entered has no account yet, signing in creates one. A team member joins a shop with the code its owner gives them.

For each team member, we process their email address, their role in the shop, the name the shop gives their station, for example "Counter 2", the date of their last scan, and, on every stamp or voucher they record, the fact that they recorded it. The shop's journal therefore shows who did what.

The camera is used only to read a customer's code or a voucher. No image is stored or sent: only the text of the code that was read goes to our server. When the shop's phone has no network, the codes it read wait on that phone and are sent once the network is back, and a code read more than twenty four hours earlier is no longer accepted. The phone's contactless reader is used to activate the shop's contactless cards.

Oktapus Pro does not read the phone's location and sends no notifications. When the team scans your code, they see the state of your card at their shop, never your name, your address or the other shops where you hold a card.

Without Oktapus Pro, the merchant space on the website can scan too, from a phone's browser and with the same account. The camera is used there only to read the code, once allowed in the browser: the image stays on the phone, only the text of the code that was read goes to our server, and no reading is kept without a network.

The app only reads your location if you allow it. It offers you the choice once, at the launch that follows your first stamp, on a screen that explains what it is for, and again from the Around tab if you had refused. Without it, your cards, your stamps and searching for a shop by name all work.

If you allow it, the app reads your precise position once at every opening, that is at launch and when you bring it back to the foreground, and when you tap the location button of the Around tab. It does not follow you while you use it. That position is sent to our server to answer three questions: which partner shop is a few dozen metres away, to put its card at the top of the home screen; which partner shops are around you, for the Around tab; and how far away a shop you search for by name is.

The position travels in the body of the request, never in its address. It is used to work out the answer and then discarded: it is written neither to our database nor to our logs, and the answer is marked so that no intermediary keeps a copy. On your phone, it stays in memory while the app is open and is not stored. What we keep is a count of the searches your account made in the hour, which contains no position and is erased after three days.

Discovery is off until you turn it on. Once on, it sends your position to our server, in the same way and without it being kept, and receives in return at most nineteen nearby partner shops where you do not have a card yet, with their coordinates. That list is kept on your phone, whose own system watches those areas. When you walk into one of them, it is your phone that shows the notification, and we are not told. Our server only receives your position again when the list needs renewing.

Discovery asks you for the location permission that lets it keep watching while the app is closed: "Always" on iPhone, "Allow all the time" on Android. If you only grant it while the app is in use, or if your version of the app does not ask for it, Discovery only works while the app is open.

You switch Discovery off from Profile, then Notifications, which also erases the list kept on your phone, and the location permission in your phone's settings.

When the app puts the card of the shop it thinks you are in at the top of the home screen, we want to know whether it guessed right. For every stamp your phone asks for itself, for example by tapping a shop's contactless card, the app says which card the home screen was showing at that moment: a shop's card, or the general card. We record that with the shop that gave the stamp and the date. When it is the shop that scans your code, nothing of the kind is recorded.

No position and no distance are recorded: two shops are enough to answer. These rows are used only to work out, in aggregate figures, how often the home screen showed the right shop, never to describe your habits. They rest on our legitimate interest in checking that a feature which guesses does not mislead the people who use it. They are erased after 180 days, and with your account if you delete it before then.

Map backgrounds are served by OpenFreeMap, from OpenStreetMap data, under the ODbL licence. Displaying a map sends a request to that provider, which therefore sees your IP address and the area you are looking at.

When a merchant saves the address of their shop, we turn it into coordinates at IGN for France, and at Nominatim, a service of the OpenStreetMap Foundation, for Belgium. These are shop addresses, never yours.

We send nothing until you have accepted notifications, and nothing on a topic you have left switched off. There are three topics: your cards (a reward waiting for you or a card about to close), the contest (entries about to close, your result or a voucher about to expire) and Discovery.

To deliver a message to you, we register your device, as the section "Your device" explains, and hand its token to Apple's or Google's notification service, which sees that token and the content of the message. That content never says more than what your phone's screen will display. Discovery notifications are the exception: your phone shows them itself, without going through us or those services.

We keep a record of what has been sent for ninety days, so as not to send you the same thing twice. You switch everything off from Profile, then Notifications, or from your phone's settings.

The Oktapus contest is free and open to people who have a Oktapus account, live in one of the countries where it runs (Belgium, France) and are at least 18: a device without an account cannot take part. Partner merchants and the members of their team cannot take part in it. At your first entry, the app asks for your country of residence, for confirmation that you have reached that country's minimum age, and for your acceptance of the rules, which you read in the app, in the Contest tab. We do not ask for your date of birth and do not check your age against a document: your confirmation is what counts, and a win obtained on a false declaration is void.

To run it, we process the following.

• Your declaration: the country of residence you declared, the minimum age you confirmed and the date of that confirmation, the version of the rules you accepted and the date of that acceptance. It is copied onto each entry, as evidence of what held that day.
• Your entry: the contest, the date, the answer you chose and whether it was correct, and, if you left it for another one, the date of that change.
• Your result: won, lost, or ruled out by a wrong answer.
• Your vouchers: the shop where it is spent, its amount, its expiry date, its status and, once it is redeemed, the date and the team member who redeemed it.
• The exclusion of merchants: when you enter and at the draw, we check whether your account is the owner or a team member of a shop on Oktapus. This check reads your account's access to Oktapus Pro and records nothing more.

For each contest we also keep the random value used for the draw, the number of entrants and the number of correct answers, so that the draw can be rerun and checked. Those figures designate nobody.

Your entry, your declaration, the draw and your voucher rest on the performance of the rules you accept by playing, article 6(1)(b). The record of the draw and the exclusion of fraudulent entries rest on our legitimate interest, article 6(1)(f). Contest notifications rest on your consent. No list of winners is published and your name is never shown. If you win, your first name and last initial, with the contest's region, are given to anyone who asks in writing, as the rules provide, on our legitimate interest in showing that the vouchers announced were actually awarded, article 6(1)(f). The shop where your voucher is spent sees that voucher when it scans it, not your name or your address.

Your entries and your results remain for as long as your account exists and go with it. A voucher is valid for one month. When your account is deleted, a voucher that was not redeemed is erased. A redeemed voucher stays in the shop's accounts, without designating you any more.

If you report a shop, we record the shop, the reason chosen, the comment you add if there is one, the date, and your account or, if you have no account, your phone's installation identifier. A person on our team is told by email and reads the report.

This data is used to handle the report and to tell ten people apart from one person reporting ten times, on the basis of our legitimate interest in removing unlawful or misleading content. The report stays in the history of the shop concerned; once your account is deleted, it no longer designates you.

Every installation of the app creates an identifier of its own and keeps it on the phone. It is only sent to us if at least one notification is switched on and your phone allows them, together with the notification token, the platform, the app's language, the time zone and the app version. The token is used to reach you, the language to write to you in yours, the time zone to write to you at a reasonable hour where you are, and the identifier to tell your phones apart. If you report a shop without having an account, the identifier also comes with the report.

It is tied to no advertising identifier and travels to no third party; only the token is handed to the notification service. The device's registration is erased when you switch every notification off, when you sign out, when you ask for your account to be deleted, and when the notification service tells us the app has left the device.

If you open a shop's poster with your phone's camera, or hold your phone to its contactless card, without having the app, you land on a page of this site that names the shop before offering to install anything.

So that the shop is waiting for you when you first open the app, we create a single use token, valid for fifteen minutes, which designates a shop and a gesture, never a person. On Android it travels inside the app store link. On iPhone it is copied to your clipboard, for want of any other route: the app reads it once on first launch, and never touches it again.

A code or a contactless card is worth one stamp, once. We therefore count attempts per account, per email address and per IP address, which we make unreadable before counting it, we rate limit the public pages and the number of stamps one customer can receive from the same shop in ten minutes, and we keep those counters for three days.

They are used to refuse one request too many. They are not used to build a profile, and they are used for nothing else.

We also look at how each card is used (when its clients joined it, who signed them up, whether they come back from one day to the next) to tell whether a shop has real activity or is a trial. This rests on our legitimate interest in knowing how the service is really used, uses no IP address and serves no other purpose.

We sell nothing and we share nothing for advertising purposes. The only third parties involved are those who make the service run, each for a specific task.

• Supabase, for the database, hosted in the European Union.
• Vercel, for hosting the website, the merchant space, the customer space and our application interface, running in the Frankfurt region.
• Resend, for sending emails: sign-in codes, deletion codes, the copy of your data, report notices to our team and, for a subscribed merchant, the billing and kit emails.
• Stripe (Stripe Payments Europe, Limited, in Ireland), for a merchant's subscription payment, its invoices and the VAT calculation. Stripe receives the billing name, email address and billing address, the delivery address, the VAT number and the payment method. For its own obligations, such as fraud prevention and its legal duties, Stripe acts as a separate controller, under its own privacy policy.
• The European Commission's VIES system, which checks a merchant's VAT number with the tax authority of its country.
• The carrier that delivers the kit, which receives the recipient's name and the delivery address.
• Apple and Google, for the sign-in you choose and for delivering notifications.
• OpenFreeMap, IGN and Nominatim, for map backgrounds and for shop addresses.
• Sentry (Functional Software, Inc.), for error reports from the app, Oktapus Pro, the website and our application interface, stored in its European Union data region. A report describes the failure (the version, the device model and system, the place in the code) and is stripped before it leaves: no name, no email address, no location, no account identifier, no card token. We have asked Sentry not to store the device's IP address.

And merchants, who are the very point of the service: a merchant sees neither your email address, nor your name, nor the other shops where you hold a card. When their team scans your code, in Oktapus Pro or on the website, they see the state of your card at their shop. Their space shows them numbers: members of their programme, today's stamps and rewards handed over. The shop where a contest voucher is spent sees that voucher when it scans it.

The database stays in the European Union, and our servers run in Frankfurt.

Some of the providers named above are established in the United States. The resulting transfers rest on the European Commission's standard contractual clauses, or on the EU-US Data Privacy Framework where the provider is certified under it. You may ask us for a copy of these safeguards by writing to hello@fideloop.app.

• Your account, your cards and your contest entries: for as long as your account exists.
• After a request to delete an account: thirty days, then erasure. That window exists so that you can change your mind.
• A device used without an account, when you ask for it to be deleted: erased at once, since no sign-in would let you come back.
• Your stamps, after erasure: they are not deleted but detached from you. The merchant is left with a visit without a customer, rounded to the day, because their counters and their accounts cannot change retroactively.
• Your contest vouchers: valid for one month. On erasure, a voucher that was not redeemed is deleted, and a redeemed voucher stays with the shop without designating you any more.
• Your location: never kept.
• The home screen measurement: 180 days.
• The record of codes already used: seven days. That of contactless card answers: one day.
• Sign-in codes: five minutes. The codes and tokens of the deletion page, and install tokens: fifteen minutes.
• Notification tokens: until you switch notifications off or sign out, or until the notification service tells us the device no longer exists.
• The history of notifications sent: ninety days.
• The record of a copy of your data, used to count the day's copies: ninety days.
• Anti-abuse counters: three days.
• A report: in the history of the shop concerned, no longer designating you once your account is erased.
• Our hosts' technical logs: a few weeks, depending on the period each of them applies.
• A merchant's billing and delivery details: for as long as the shop exists, then thirty days after it closes. What stays after that is the Stripe customer identifier, the country and the VAT number, which link the invoices to the shop.
• A paying merchant's accounting records: seven years, as Belgian law requires.

At any time you may access your data, have it corrected, ask for it to be erased, ask for its processing to be restricted, object to processing based on our legitimate interest, withdraw a consent you have given, and receive a copy of your data in a machine readable format.

Two of these rights are exercised without writing to us: the copy of your data is sent from the app, at most three times a day, and deletion is requested from the app, or from the page provided for it on this site, even if you do not have the app.

For everything else, write to hello@fideloop.app. We answer within one month, which may be extended by two months for a complex request, in which case we tell you before the first month is out.

If our answer does not satisfy you, you have the right to lodge a complaint with a data protection authority: the one of your country of residence, the one of your place of work, or the one of the place where you believe your rights have been infringed.

• In Belgium: Data Protection Authority, rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be.
• In France: Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

You may also go directly to the competent court.

From the app: Profile, then Delete my account. Without the app: the deletion page on this site, which sends you a six digit code to check that the address is yours.

For an account, erasure is scheduled for thirty days later. As soon as you ask, your devices are signed out, your notification tokens and pending notifications are erased, and Apple is told if you signed in with Apple. You can turn back until the last day. After that, your cards, your contest entries, your unredeemed vouchers, your settings, the home screen measurement and your address are gone. If you were on a shop's team, your access is withdrawn and the stamps you gave no longer designate you.

If you use the app without an account, deletion is immediate: no sign-in would let you come back during a waiting period.

If you are the last owner of a shop, the same page asks you what becomes of that shop. While it stays open, your customer side is erased but your account remains, so that the shop keeps an owner. Closing it is immediate and cannot be undone: no stamp can be given there any more, its subscription ends, and thirty days later its customers' open cards are archived, the team loses its access, and the shop's description and address are erased.

The OKTAPUS marketing site uses strictly necessary cookies, a cookie that remembers your language, and one that records your answer to the consent banner so that we stop asking. No advertising cookie is ever dropped, and none of them is shared with a third party. If you sign in to the customer space or the merchant space, a strictly necessary sign-in cookie keeps you signed in for up to a year. No script on the page can read it, and it is deleted when you sign out. On the merchant space's scanner, your choice of sound on or off is remembered in the browser storage of that phone. It holds nothing else and is never sent to us.

We count visits to this site with our own tool, hosted in Europe and used by us alone. It sets no cookie and reads nothing from your device, which is why you are not shown a banner. It records the page viewed, the site you came from reduced to its domain name, how long the page stayed on screen, your country, your browser and the kind of device. Your IP address is used once on our server to derive that country and a fingerprint valid for the day: it is kept nowhere, and that fingerprint cannot be recomputed the next day. We also count how many visitors accept or refuse the consent banner, as a plain total: nothing in that count can recognise you.

If you accept the banner, we additionally keep a random identifier on your device for thirteen months at most. It lets us see that the same browser came back, which page it arrived on and which actions it took on this site. It carries no name and no email address, and it is never cross-referenced with the traffic measurement described above, which stays anonymous. There is one exception: if you open a shop or join a shop's card from this site, your visit is tied to that shop. For a merchant, it is then linked to their shop's account, which tells us how you found us. For a client, it only tells us whether that shop's card is used by people who come back, without naming you. This stays within the Oktapus team and is never passed on to the merchant. You can withdraw at any time through the Cookies link at the bottom of any page: the identifier is erased immediately and nothing more is recorded.

Altis Koten SRL, Traverse d'Esope 6, 1348 Ottignies-Louvain-la-Neuve, Belgique. By email: hello@fideloop.app.

This page may change. When a change is significant, we tell you in the app and by email before it takes effect, and the date at the top of the page changes with every revision.