Privacy Policy

Equivalent Exchange, operated by [Equivalent Exchange — legal entity name], provides a digital loyalty and rewards platform for businesses ("Merchants") and their end customers ("Customers"). This policy explains what personal information we collect, how we use it, and the choices you have.

For Customer data collected through a Merchant's loyalty program, the Merchant decides what program to run; we process that data to provide the platform on the Merchant's behalf.

• Account information — email address, name, and authentication data (password hash, passkey public key, or a social sign-in identifier). We never see or store plaintext social login credentials.
• Merchant organization data — business name, logo, branding, subdomain, and team member emails and roles.
• Loyalty program data — reward cards, points, visit and redemption history, and, when a Customer chooses to provide it, a birthday (month and day) for birthday rewards.
• Wallet and device data — Apple/Google Wallet pass registrations, push notification subscriptions, and the device/browser user agent needed to deliver them.
• Billing data — subscription status and payment card brand/last four digits. Full payment details are collected and stored by Stripe, not by us.
• Usage data — product analytics about how the apps are used (pages viewed, features used) and technical logs for security and debugging.

• Provide and operate loyalty programs, cards, and rewards.
• Deliver notifications the Merchant configures (for example reward reminders or birthday rewards) to Customers who opted in.
• Process subscription billing and prevent fraud and abuse.
• Provide analytics to Merchants about their own program.
• Improve the product and fix problems.
• Meet legal obligations.

We do not sell personal information.

Push notifications require an explicit opt-in on your device and can be turned off at any time in the app settings or your device settings. Emails related to your account (sign-in codes, receipts, security notices) are transactional and sent as part of operating the service.

We use cookies to keep you signed in and to remember essential preferences. If analytics is enabled, we use it to understand product usage; analytics identifiers are not used for third-party advertising.

• Supabase — database, authentication, and file storage
• Vercel — application hosting
• Stripe — payment processing
• Resend — transactional email delivery
• PostHog — product analytics
• Apple and Google — wallet passes and push delivery, when you add a card to your wallet or enable notifications

We keep personal information while an account or loyalty card is active and for a reasonable period afterward for backup, legal, and fraud-prevention purposes, then delete or anonymize it.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information. To exercise these rights, contact support@eqxchange.com. If you are a Customer in a Merchant's loyalty program, you can also contact the Merchant directly; we will assist them in fulfilling your request.

We use industry-standard safeguards including encryption in transit, row-level access controls on program data, and least-privilege access for our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The service is not directed to children under 13, and we do not knowingly collect personal information from them.

We may update this policy from time to time. Material changes will be announced by email or in-app notice before they take effect.

[Equivalent Exchange — legal entity name], [business address]. Privacy questions: support@eqxchange.com.