Privacy Policy

1. Scope and roles

1.1 This policy covers personal information we handle as the operator of Fidella. It is designed to comply with the 13 Information Privacy Principles (IPPs) under the NZ Privacy Act 2020 and the 13 Australian Privacy Principles under the Australian Privacy Act 1988.

1.2 Participating Merchants run their own loyalty programmes on Fidella. For the customer information a Merchant collects and uses for its own purposes, the Merchant is independently responsible and its own privacy notice applies. Our handling of information on a Merchant's behalf is governed by the Data Processing Addendum.

2. Information we collect

• Account data: name, email, a unique account identifier, profile preferences, messaging preferences, analytics-consent choices, and country/region.
• Usage data: device information, app interactions, and crash/diagnostic events, with PII scrubbing applied per our internal logging policy.
• Loyalty activity: site memberships, stamps/points/balances, rewards earned and redeemed, and voucher purchases, transfers, and redemptions.
• Payment data: payment references and tokens processed by our payment processor. We do not store card numbers.
• Support & communications: messages you send to support, contact requests, and interest registrations for regions we do not yet serve.
• Optional profile fields: gender (for self-identification and aggregate, non-identifying reporting) and coarse location (for "nearest site" sorting on the Discover map). Both are optional, never used for advertising, never shared with Merchants at the individual level, and can be cleared at any time.
• Profile photo (optional): a photo you upload in the app or, if you sign in with a provider such as Google, a link to the profile picture that provider holds for you. You can replace your photo in the app at any time. To remove it without replacing it, contact privacy@fidella.app.
• Optional IP-derived country: only when you explicitly agree at the point of collection and the feature has been approved and enabled, Fidella may send the trusted connection IP to the configured geolocation provider to infer a country. We store only the country/country code from that lookup—not the IP, inferred latitude/longitude, city, or postcode. Declining does not prevent signup; you can provide your country directly instead.
• Age band: a coarse age band collected at signup (under 16 / 16–18 / adult) to enforce minimum-age requirements. We deliberately do not collect a date of birth.

We collect information directly from you, automatically as you use Fidella, and from service providers such as our identity provider and payment processor. Where the law requires (IPP 3 / APP 5), we tell you why we are collecting information at the point of collection.

3. How and why we use information (purposes and lawful bases)

• Service delivery (performance of our contract with you): authenticate you, operate loyalty programmes, issue and redeem wallet passes and vouchers, and process transfers.
• Security and fraud prevention (our legitimate interests / necessary functions): abuse prevention, rate limiting, transfer limits informed by anti-money-laundering controls, and incident response.
• Analytics and product improvement (consent): non-essential analytics run only when you give explicit consent. Your consent choice is stored on your account and returned in account exports.
• Optional regional eligibility (consent): an IP-derived country lookup runs only with request-scoped consent. Its sole purpose is signup-region eligibility and regional defaults; it is not used for advertising or individual tracking.
• Marketing (consent): optional communications and offers, which you can unsubscribe from at any time. We comply with the Unsolicited Electronic Messages Act 2007 (NZ) and the Spam Act 2003 (Australia) — we send commercial electronic messages only with consent, identify ourselves, and include an unsubscribe facility.
• Legal and compliance obligations: keeping financial, refund, and tax-relevant records as required by law (see clause 6).

4. Sharing information

• Identity & auth: our identity and authentication provider, for authentication and profile claims.
• Payment processing: our payment processor, for voucher purchases and related settlement.
• Infrastructure: hosting, database, storage, CDN, and email providers as sub-processors.
• Optional IP geolocation: the explicitly configured provider receives the connection IP only after consent and returns a minimized country signal. The feature is disabled unless operations has approved the provider terms and enabled both configuration gates.
• Analytics & observability: our analytics and error-monitoring providers, with PII scrubbing and consent respected where applicable.
• Participating Merchants: only the customer data necessary to fulfil loyalty interactions, under a limited licence (clause 11). If you have a profile photo, it is shown to staff at the venue alongside your name when they scan your code.
• Legal and corporate: where required by law, to enforce our terms, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets (with continued protection of your information).

The specific providers we use in each category are named in our current Sub-processor Register, which we update as providers change. We do not sell your personal information.

5. International transfers and disclosures

5.1 Some of our service providers process information outside New Zealand and Australia. Before disclosing personal information overseas we take reasonable steps consistent with IPP 12 (NZ) and APP 8 (Australia) — for example by relying on comparable-protection regimes, standard contractual clauses, or your authorisation where required.

5.2 For Customers in Australia, we will not disclose your personal information to an overseas recipient unless we have taken reasonable steps to ensure the recipient handles it consistently with the APPs, or an exception applies.

6. Data retention

• Account/profile and server-side consent records: 24 months after deactivation or last verified activity.
• Uploaded profile photo: deleted when you replace it with a new one, and when your profile is anonymised.
• Profile picture from a sign-in provider: we store only the link, not a copy of the image. The link is removed when your profile is anonymised. The copy the provider holds is theirs, and we cannot delete it.
• Loyalty, voucher, transfer, and financial ledger records: 7 years after the transaction or completion/expiry date, and longer where a dispute or legal hold applies.
• Support records: 24 months after ticket closure. Compliance, fraud, and legal-hold records: 7 years after case closure or release.
• Raw logs with identifiers: 30 days. Aggregated telemetry: 13 months.
• IP-derived regional signal: no server-side IP copy is retained; the optional country/country-code result follows the account/profile schedule and is included in account export/correction/deletion handling.
• Backups: 35-day rolling retention, with masked-restore controls applied before any restored data re-enters production access paths.

6.1 Legal basis for 7-year ledger retention

When you deactivate or delete your account we anonymise your profile data after 24 months. We retain the financial and loyalty ledger for 7 years from the deactivation date because we are legally required to keep accurate records of financial, refund, and tax-relevant transactions. The records we retain are limited to the financial and loyalty transaction history needed for those obligations — for example records of rewards earned and redeemed, vouchers issued and redeemed, promotions applied, voucher purchases, merchant settlement totals, refund records, payment-processor references, and the minimum identifiers needed to reconcile a wallet pass to the correct balance.

Legal bases, by jurisdiction we operate or plan to operate in:

• New Zealand: Tax Administration Act 1994 s 22 (7 years); Financial Reporting Act 2013; AML/CFT Act 2009 s 49 (5 years; we apply 7 to align with tax law).
• Australia: Income Tax Assessment Act 1936 s 262A / A New Tax System (GST) Act 1999 (5 years; aligned upward to 7); AML/CTF Act 2006 record-keeping (7 years).
• United Kingdom (future): Companies Act 2006 s 388; HMRC retention (6 years; aligned to 7); Money Laundering Regulations 2017 (5 years; aligned to 7).
• EU/EEA (future): GDPR Art. 6(1)(c) legal-obligation basis; national tax law sets the period (commonly 7–10 years).

After profile anonymisation, the only personal information remaining on a retained record is an opaque, pseudonymous account reference together with payment-processor references (required for reconciliation); the rest is non-personal data such as amounts, dates, and the identifiers of the relevant site, reward, or voucher. To request earlier deletion, contact privacy@fidella.app; we will assess whether a tax or AML hold applies and, if so, tell you the earliest date the record can be removed.

7. Age attestation and children

Every new account must self-attest an age band at signup (under 16, 16–18, or adult); accounts that declare an age under 16 cannot complete signup. We deliberately do not capture a date of birth. Each attestation is recorded so we can demonstrate compliance. We do not knowingly collect the personal information of children under 16.

8. Security

We protect personal information with measures appropriate to its sensitivity, including encryption in transit, role-based access controls, rate limiting, audit logging, PII scrubbing in logs and observability, and an incident-response process. No system is completely secure, and we cannot guarantee absolute security.

9. Data breaches

9.1 New Zealand. If we have a privacy breach that it is reasonable to believe has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, as required by the Privacy Act 2020.

9.2 Australia. Where an eligible data breach under the Notifiable Data Breaches scheme occurs — unauthorised access, disclosure, or loss of personal information likely to result in serious harm — we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required by the Privacy Act 1988.

10. Your rights and choices

• Access and correction: you may request access to, and correction of, your personal information (IPP 6 & 7 / APP 12 & 13) via privacy@fidella.app or in-app tools.
• Portability/export: account exports include persisted messaging and analytics-consent metadata; raw push-subscription endpoints and other device secrets are excluded.
• Deactivation/closure: disables access immediately, clears active sessions and device/pass artefacts, and schedules profile anonymisation after 24 months unless a legal hold applies.
• Consent withdrawal: you may object to or withdraw consent for non-essential analytics or marketing at any time.
• Complaints: you may complain to us at privacy@fidella.app. If unresolved, you may complain to the Office of the Privacy Commissioner (New Zealand, privacy.org.nz) or the OAIC (Australia, oaic.gov.au). Australian residents may also have rights under the statutory tort for serious invasions of privacy that commenced on 10 June 2025.

11. Merchants and your information

Participating Merchants receive only the customer data necessary to operate their loyalty interactions with you, under a limited licence. Each Merchant is independently responsible for its own handling of your information and must maintain its own privacy notice and obtain any consents it requires. Our processing on a Merchant's behalf is governed by the Data Processing Addendum.

12. Cookies and tracking

Our use of cookies and similar technologies, and your choices about non-essential analytics, are described in the Cookie & Tracking Notice.

13. Contact and updates

13.1 Privacy requests and questions: privacy@fidella.app. Postal: Kiwana Labs Limited (NZBN 9429050289325), K007, 219 Don McKinnon Drive, Albany, Auckland 0632, New Zealand.

13.2 We may update this policy from time to time. Material changes will be communicated through the app or by email. Continued use after the effective date constitutes acceptance.