Privacy Policy

Wapas (Private) Limited ("Wapas", "we", "us") operates the digital loyalty platform at wapas.me. We are responsible for your personal data as described in this Privacy Policy.

Contact: hello@wapas.me

For Restaurant Account holders

• Name, email address, and password (hashed)
• Business name, address, and contact details
• Payment information (processed by our payment provider — we do not store raw card numbers)
• Usage data: login times, features used, campaign performance metrics

For Customers (end-users of a restaurant's programme)

• Phone number (used to identify the customer and send notifications)
• Visit history and stamp counts
• Rewards earned and redeemed
• Push notification subscription tokens (if you opt in)
• Approximate last-visit date (used for win-back timing)

Automatically collected data

• IP address and browser/device type
• Pages visited and time spent
• Referrer URL

Game Challenges: if you play Stack Drop at a restaurant, we store an anonymous device ID (a random number, not your name or phone number) with your runs and any tickets you win. Your IP address and user agent are kept for 30 days, only to check for abuse, and then deleted. If you tap “Save to my card” on a ticket you won, the ticket is linked to your wapas card (your phone number) at that restaurant, so its staff can find it and you can see it with your rewards.

We use session cookies to keep you logged in and to secure your session. We may use analytics cookies to understand how the platform is used. We do not use advertising tracking cookies.

You can control cookies through your browser settings. Disabling session cookies will prevent you from logging in.

Customers may be asked to enable push notifications when joining a restaurant's loyalty programme. Push notifications are sent only for loyalty-related purposes: stamp confirmations, reward availability, and win-back offers from the specific restaurant they joined.

You can disable push notifications at any time through your browser or device settings. This does not affect your loyalty card balance.

• To provide the service: authenticating accounts, recording stamps, triggering notifications
• To operate win-back campaigns: determining when a customer has lapsed and triggering push messages on behalf of the restaurant (and WhatsApp messages, once available)
• To improve the product: analysing aggregate usage patterns, debugging errors
• To communicate with restaurant accounts: billing, product updates, support
• To comply with legal obligations: fraud prevention, law enforcement requests

We do not sell personal data to third parties. We do not use customer data for advertising purposes outside the restaurant's own programme.

We share data with a limited number of trusted service providers:

• Cloud hosting: our servers are hosted by Hetzner in Germany, in the European Union
• WhatsApp messaging (coming soon): automatic WhatsApp win-back messages are not live yet. When they are, they will be sent via a WhatsApp Business API provider, and your phone number will be shared with them solely to deliver the message. Until then, a restaurant may message you on WhatsApp from its own phone.
• Email delivery: transactional emails are sent via a third-party email service provider

All third-party providers are contractually bound to process data only as instructed and to maintain appropriate security standards.

• Active restaurant account data is retained for the duration of the account plus 12 months
• Customer loyalty data is retained for 24 months from the last visit, then deleted
• Deleted accounts are purged from live systems within 30 days; backups are rotated within 90 days

Depending on your location, you may have rights including:

• Access: request a copy of personal data we hold about you
• Correction: request correction of inaccurate data
• Deletion: request deletion of your data (subject to legal obligations)
• Objection: object to processing for win-back campaigns
• Portability: receive your data in a machine-readable format

To exercise any of these rights, email us at hello@wapas.me. We will respond within 30 days. For customers of a restaurant's programme, requests should be directed to that restaurant; we will assist as needed.

We implement industry-standard security measures including encrypted data transmission (TLS), hashed passwords, access controls, and regular security reviews. No system is 100% secure. In the event of a data breach affecting your personal data, we will notify affected parties as required by law.

The Wapas platform is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify restaurant account holders of material changes by email. Continued use of the service after a change constitutes acceptance of the updated policy.

For privacy-related queries, please contact our team at hello@wapas.me.