1. Who This Policy Covers
This policy applies to:
- Business owners and authorised staff using FirSe.
- Customers joining or participating in a FirSe-powered loyalty programme.
- People who contact FirSe about the service.
2. Personal Data We Collect
The data collected depends on the features used and the information provided.
A. Business account information
We may collect business details and contact information provided during registration, together with account and access records.
The exact fields collected are the business name, the contact person’s name, their mobile number and their role.
B. Customer information
When a customer joins a loyalty programme by scanning a QR code, FirSe may collect:
- Mobile number, verified by a one-time password (OTP) sent by SMS.
- Customer name.
- Email address.
- Stamps earned and rewards redeemed.
- Visit or purchase history associated with the loyalty programme.
- Approximate location, only if the customer allows it, and only to show nearby participating businesses.
All information requested on the sign-up form is mandatory to join a loyalty programme.
C. Technical information
FirSe may process technical information needed to operate and secure the service, such as diagnostic records, access logs and error information.
FirSe does not currently use analytics or advertising tracking tools.
3. Why We Use Personal Data
Personal data may be used to:
- Register customers for loyalty programmes.
- Send one-time passwords (OTPs) by SMS to verify sign-in.
- Associate customers with the relevant loyalty card.
- Record stamps, visits and rewards.
- Allow participating businesses to administer their programmes.
- Investigate incorrect stamps, disputed rewards and technical issues.
- Secure accounts and detect misuse.
- Respond to enquiries and complaints.
- Meet legal obligations and protect legitimate legal rights.
Location data
FirSe asks for location in one place only: to show which participating businesses are near the customer. Location is not used for tracking, advertising, or any other purpose, and it is not recorded against a stamp.
Location purpose: To list nearby participating businesses.
Collection trigger and frequency: Only when the customer opens the screen that lists nearby businesses. It is read at that moment and not stored.
Is location optional?: Yes. Customers can decline, or withdraw permission later in their device or browser settings. Declining does not prevent collecting stamps or claiming rewards — the list of businesses simply cannot be ordered by distance.
A participating business sets the address of its shop so that scans can be checked for distance in future. That check is not active today: collecting a stamp does not send or use the customer’s location. If this changes, this policy will be updated first and the customer will be asked for permission at that point.
4. Notice and Consent
Where consent is required, FirSe will provide a clear notice explaining the personal data collected, the purposes of processing and how the individual can exercise applicable rights or raise a complaint.
Consent must not be bundled with unrelated purposes. Where applicable, individuals must be able to withdraw consent through an appropriate process.
Joining a loyalty programme does not automatically constitute consent to unrelated marketing.
FirSe's current MVP does not send promotional messages. If promotional communications are introduced later, the privacy notice, consent flow and opt-out mechanism will be updated before that feature is launched.
5. Who Can Access Personal Data
Depending on the service configuration, personal data may be accessed by:
- The participating business, for administering its own loyalty programme.
- Authorised FirSe personnel, where access is necessary to operate or support the service.
- Cloud hosting and database providers.
- Other service providers that FirSe actually uses to operate, secure or support the platform.
- Authorities or other parties where disclosure is required or permitted by applicable law.
Current service providers: Supabase (database and hosting) and an SMS provider, once one is in use (sending OTPs by SMS).
Each participating business can access only the records of customers in its own loyalty programme. A business cannot access another business's customer data.
6. Cloud Storage and Security
FirSe currently uses Supabase to store and host all FirSe data, including business accounts, customer profiles and loyalty records.
Cloud provider: Supabase.
Hosting and processing locations: [INSERT CONFIRMED LOCATIONS — the region of your Supabase project].
FirSe will implement reasonable technical and organisational safeguards appropriate to the data and the risks involved, including appropriate access restrictions and security measures.
No online service can guarantee absolute security. If a data incident occurs, FirSe will investigate, take appropriate remedial action and provide notifications where required by applicable law.
8. How Long We Keep Data
We keep account and loyalty data while your account is active. After an account is deleted, we remove or anonymise the personal data within 90 days, except records we are required to keep by law.
9. Customer Rights and Requests
Subject to applicable law, individuals may have rights to access information about their personal data, request correction or erasure, withdraw consent and raise grievances.
To make a request, contact Instagram @firseapp.
FirSe may need to verify the requester's identity or authority before acting. Requests will be handled within the timelines applicable under law.
Withdrawing consent does not make prior lawful processing unlawful. It may affect features that depend on the relevant data.
If you are not satisfied with our response, you can contact the Data Protection Board of India.
10. Children
Customers under 18 may use FirSe only with verifiable consent from a parent or guardian. If we learn that we hold a child's data without this consent, we will delete it.
11. Third-Party Services
FirSe may depend on cloud hosting, databases or other service providers.
The providers FirSe currently uses are listed under “Who Can Access Personal Data”.
If customers interact with a third-party service directly, that service may process their information under its own privacy policy.
12. Changes to This Policy
FirSe may update this policy when its service or data practices change or when required by law.
The latest version will show the date it was updated. Material changes will be communicated where required, and fresh consent will be obtained where legally necessary.
13. Privacy Contact and Complaints
Our full company and contact details will be published here before FirSe launches publicly. In the meantime, reach us on Instagram @firseapp.
We acknowledge complaints within 48 hours and aim to resolve them within 30 days.