Privacy Policy
1. Who We Are
RewardIf ("we", "us", "our") is the operator of the RewardIf loyalty platform. We provide technology that connects customers with local businesses through loyalty rewards programs.
For privacy enquiries, contact our Privacy Officer:
📧 support@rewardif.com
🌐 rewardif.com
2. What Information We Collect
2.1 Information you provide directly
- Mobile phone number — required to create and verify your account via SMS one-time passcode (OTP).
- Full name — required to create your account.
- Email address — optional; used to link your account to businesses that require it.
- Date of birth — optional; used for profile personalisation only.
2.2 Information generated by your use of the Service
- Visit and transaction history — records of purchases, services received, loyalty points earned, rewards redeemed, and gift vouchers issued or used.
- Authentication tokens — secure session tokens that keep you logged in, stored in encrypted storage on your device and on our servers. These expire automatically.
2.3 Device and technical information
- Device type and operating system version — used for compatibility and security purposes (e.g. detecting unusual login patterns).
- Session data — on the website, we use cookies and server-side sessions solely to keep you logged in. We do not use tracking cookies or advertising cookies.
2.4 Camera access
The App requests access to your camera only when you use the QR code scanner. We do not capture, store, or transmit any images or video. The camera feed is processed entirely on your device to read the QR code and is immediately discarded.
2.5 What we do NOT collect
3. How We Use Your Information
| Purpose | Information used | Legal basis (APP 3) |
|---|---|---|
| Create and manage your loyalty account | Phone, name, email, DOB | Necessary to provide the Service you requested |
| Verify your identity via OTP | Phone number | Necessary to provide the Service; security |
| Record loyalty visits and rewards | Transaction history, account ID | Necessary to provide the Service |
| Allow businesses to process sales and redemptions | Name, phone, transaction history for that business | Necessary to provide the Service; your consent at enrolment |
| Detect and prevent fraud or misuse | Device info, session data, transaction patterns | Legitimate interest in protecting users and the platform |
| Improve and maintain the Service | Aggregated, de-identified usage data | Legitimate interest; no personal data linked |
| Comply with legal obligations | As required by applicable law | Legal obligation |
We will not use your information for any purpose not listed above without first obtaining your consent.
4. Sharing Your Information
We do not sell, rent, or trade your personal information. We share it only as described below:
4.1 Participating businesses
When you join a business's loyalty program, that business's authorised staff can see your name, phone number, and transaction history with that business only. They cannot see your history with other businesses. Businesses access this information through the RewardIf portal under our terms of service, which require them to use your data only for operating their loyalty program and to not share it with third parties.
4.2 Service providers (sub-processors)
We engage the following categories of third-party processors to operate the Service:
- SMS gateway provider — receives your phone number solely to deliver OTP verification codes. They are contractually prohibited from using it for any other purpose.
- Web hosting provider — our servers are hosted with a commercial hosting provider. Your data is stored on these servers. See Section 8 (Cross-border transfers).
- App distribution platforms — the Apple App Store and Google Play Store distribute the App to your device. Their privacy practices are governed by their own policies, which we encourage you to review.
We do not share your information with advertisers, data brokers, or analytics companies.
4.3 Legal obligations
We may disclose your information if required to do so by law, court order, or government authority, or if we believe disclosure is necessary to protect the safety of any person, prevent fraud, or protect our legal rights.
4.4 Business transfer
If RewardIf is acquired, merged, or its assets are sold, your personal information may be transferred to the new entity. We will notify you before your information is transferred and becomes subject to a different privacy policy.
5. Data Storage and Security
We implement commercially reasonable technical and organisational measures to protect your personal information, including:
- HTTPS encryption for all data transmitted between the App and our servers.
- Encrypted secure storage on your device for authentication tokens (using platform-provided secure enclaves).
- Access controls limiting which staff and business operators can view your data.
- Regular review of our security practices.
6. Data Breaches
In the event of a data breach that is likely to result in serious harm to you, we will comply with our obligations under the Notifiable Data Breaches (NDB) scheme (Part IIIC of the Privacy Act 1988). This means we will:
- Assess the breach as quickly as practicable (within 30 days of becoming aware).
- Notify the Office of the Australian Information Commissioner (OAIC) if the breach is likely to result in serious harm.
- Notify affected individuals directly where it is reasonable and practicable to do so.
7. Data Retention
We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:
- Active accounts: data is retained while your account exists.
- Deleted accounts: personal information is deleted within 30 days of your account deletion request, except where we are legally required to retain records (e.g. for tax or dispute resolution purposes — typically 7 years for financial records under Australian law).
- OTP codes: expire after 10 minutes and are purged automatically.
- Session tokens: expire after a period of inactivity and upon logout.
- Inactive accounts: accounts with no activity for 3 years may be deleted after we provide you 30 days' notice to the phone number or email on file.
8. Cross-Border Data Transfers
Our servers are hosted by a third-party provider whose infrastructure may be located outside Australia, including in the United States. By using the Service, you acknowledge that your personal information may be transferred to and stored in countries outside Australia that may not have equivalent privacy protections.
Before transferring your information overseas, we take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles (APP 8.1), including through contractual protections with our hosting and SMS providers.
9. Cookies and Website Tracking
The RewardIf website uses:
- Session cookies — small files stored in your browser that keep you logged in during a visit. These are deleted when you close your browser.
- No third-party tracking or advertising cookies.
- No analytics cookies (e.g. Google Analytics) that track your behaviour across websites.
You can disable cookies in your browser settings, but doing so may prevent you from logging in to the website.
10. Your Rights
Under the Australian Privacy Act 1988 and Australian Privacy Principles, you have the following rights:
10.1 Access
You can request a copy of the personal information we hold about you. We will respond within 30 days. In limited circumstances we may decline access (e.g. if it would reveal information about another person or would prejudice an investigation), in which case we will explain why in writing.
10.2 Correction
If you believe information we hold is inaccurate, out of date, incomplete, irrelevant, or misleading, you can ask us to correct it. We will respond within 30 days.
10.3 Deletion
You can request deletion of your account and personal data at any time by:
- Emailing support@rewardif.com with the subject line "Account Deletion Request" and your registered phone number; or
- Using the account deletion option in the App (if available).
We will action your request within 30 days, subject to any legal retention obligations.
10.4 Opt out of direct marketing
We will only send you marketing communications (if any) with your prior consent. You may opt out at any time by contacting us. We will action opt-out requests promptly and within 5 business days at most.
10.5 Complaints
If you believe we have mishandled your personal information, please contact our Privacy Officer first at support@rewardif.com. We will respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
- 🌐 oaic.gov.au/privacy/privacy-complaints
- 📞 1300 363 992
11. Children's Privacy
The Service is intended for users aged 15 and over. We do not knowingly collect personal information from children under 15. If you are under 15, please do not use the Service without the involvement of a parent or guardian.
If we become aware that we have inadvertently collected personal information from a person under 15 without verifiable parental consent, we will take steps to delete that information as quickly as practicable. If you believe a person under 15 has provided us with personal information, please contact support@rewardif.com.
12. Business Operators Using RewardIf
If you are a business owner or staff member using the RewardIf business portal, this section applies to you additionally:
- You are responsible for ensuring that your customers are aware their data is being processed through RewardIf and for obtaining any consents required under applicable law.
- You must not use customer data accessed through RewardIf for any purpose other than operating your loyalty program (e.g. you must not sell, share, or use it for third-party marketing).
- You must keep your login credentials secure and notify us immediately of any unauthorised access to your account.
- Your use of the RewardIf portal is governed by our Terms of Service.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our practices or legal requirements. We will:
- Update the "Last updated" date at the top of this page for minor changes.
- For material changes (changes that significantly affect your rights or how we use your data), notify you directly via SMS or email at least 14 days before the change takes effect, and require your acknowledgement where required by law.
Your continued use of the Service after a material change takes effect constitutes your acceptance of the updated policy, provided we have given you adequate notice as described above.
14. Governing Law
This Privacy Policy is governed by the laws of the State of New South Wales, Australia. Any disputes relating to this policy will be subject to the exclusive jurisdiction of the courts of New South Wales, Australia, and the applicable provisions of the Privacy Act 1988 (Cth).
15. Contact Our Privacy Officer
For all privacy-related enquiries, requests, or complaints:
- Email: support@rewardif.com
- Website: rewardif.com
We aim to respond to all privacy requests within 30 days.