Privacy policy

What we collect

We collect your verified email address, account identifier, restaurant memberships and membership permissions. You may also provide a name or mobile number. We record program agreement, table or takeaway check-ins, bills entered by staff, discounts, reward credits and redemptions, and corrections.

If you choose Google or Apple sign-in, we use basic identity information to verify your account. We do not request access to your inbox. Apple may provide a private relay email address.

How we use it

We use this information to sign you in, manage your restaurant membership, apply benefits, show your activity, prevent misuse and help with support. Joining does not subscribe you to marketing.

We use session cookies to keep you signed in and remember the restaurant or table you selected. Our service logs support security and troubleshooting. Keep sign-in codes and membership cards private.

Who can access it

Authorised staff at a restaurant can access the membership and visit information needed to operate that restaurant's club. Use Evenflow operators can access information needed to maintain the service and investigate support or security issues. Restaurant access is restricted to its own business.

Supabase provides account and database services, Vercel hosts the application, and Resend delivers sign-in and recovery emails. Google and Apple process information when you choose their sign-in or Wallet services. A Wallet card contains a membership identifier that the restaurant checks at checkout; it is not a live reward balance.

Storage and overseas processing

Our production database is hosted in Sydney, Australia. Hosting, email, identity and Wallet providers may process information outside Australia, including in the United States. Their processing is subject to their own service and privacy arrangements.

Access, corrections and account closure

Contact us to request access to your information, correct account details, close an account or raise a privacy concern. We verify that a request comes from the account holder before changing access or membership ownership.

Account closure and deletion requests are reviewed individually. Transaction, reward and audit records may need to be retained for reconciliation, dispute handling, security or legal requirements. We do not promise that closing an account immediately deletes all historical records or backups.

Contact

For account support or privacy questions, email nigel.ephraums@gmail.com. Include the restaurant and a description of the issue, but do not send passwords, sign-in codes or a photograph of your membership QR. If you have a privacy complaint, contact us first so we can investigate and respond.