Café Loyalty Privacy Notice

This notice explains how personal information is handled when you join or use a café loyalty card powered by BitLayer, or when you work at a café that uses it. BitLayer is operated by Rahul Rameshchandra Parkale (ABN 87 554 983 542). The café you joined offers the loyalty program and decides how it is run. BitLayer runs the system on the café’s behalf. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Our general Privacy Policy covers our website and consulting services.

1. Information we collect

From card holders:

• Your name, email address and mobile number, entered when you join.
• Your card number, the tokens and rewards you earn and redeem, when each happened, and which staff member recorded it.
• Whether you agreed to receive promotional emails, and when.
• Technical information needed to keep your wallet card updated, such as device and push notification identifiers from Apple or Google, and server logs including IP addresses.

From café staff:

• Your name, email address, login details and a record of the actions you take in the staff app.

We also collect anything you send us through the “Problem adding your card?” form. Your name and email are needed to create and send your card, so we can’t issue one without them. Café staff may enter your details for you at the counter. The café’s name and privacy contact are shown on the join page.

2. How it is used

• To create your loyalty card, keep your token balance up to date and let staff find you if your card cannot be scanned.
• To send emails needed to run your card, such as your card link or a reward confirmation.
• To send the café’s promotional emails, only if you agreed. Every promotional email has an unsubscribe link.
• To give the café reports on its loyalty program, and to keep the service secure and prevent misuse.

We do not sell your information, share it with other cafés, or use it to market BitLayer’s own services to you.

3. Who can see it

The café’s owner and staff can see the information of customers who joined that café. BitLayer can access it to run and support the service. We use these service providers:

• Supabase: our database. Customer and staff records are stored in Sydney, Australia.
• Vercel: runs the loyalty web app. Information you enter, and your card details, are processed on its servers in the United States.
• Resend: sends emails. Your name and email address are processed in the United States.
• Apple and Google: when you add the card to Apple Wallet or Google Wallet, the card’s details (such as your name, card number and token balance) are sent to Apple or Google so it can appear and update on your phone. Their own privacy policies apply.
• Cloudflare: provides DNS for our domain.

Apple, Google and Cloudflare process information in the United States and other countries where they operate.

4. How long we keep it

We keep your information while you hold a card with the café. If you ask us to delete it, or the café stops using the service, we delete or de-identify it within 60 days. Records of tokens and rewards are kept for the café’s accounts, but with your personal details removed.

5. Security

Each café can see only its own customers. Every staff member has their own login, and changes to tokens are recorded and cannot be secretly edited. Data is encrypted in transit and at rest. No system can be guaranteed to be completely secure. If a data breach is likely to cause you serious harm, we will notify you, the café and, where required, the Office of the Australian Information Commissioner.

6. Your choices and rights

You can unsubscribe from promotional emails at any time. You can ask the café, or us, to access, correct or delete your information. To remove the card from your phone, delete it from Apple Wallet or Google Wallet; this does not delete your record, so contact us if you want that too. We acknowledge privacy requests and complaints within 7 days and aim to respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Contact us

Email [email protected] · ABN 87 554 983 542