Privacy Notice
Version 2026-08-17 · for people who hold a Kai card
DRAFT — pending legal review. This text was written for the Kai pilot and has not been reviewed by a qualified lawyer. Where the operating entity should be named it says so plainly instead of naming one. Everything it says about what is collected, where it goes and how long it is kept is a description of what the software actually does.
1. Who is responsible for what
Two organisations are involved, and they are responsible for different things.
The venue — the café, kebab shop or bar whose card you hold — is the controller of your loyalty data. It decides to run a loyalty programme, sets the reward, and decides who gets a stamp. Its own name and contact details are on its premises and in the app.
Kai operates the platform for that venue, as its processor, under a written data processing agreement. Separately, Kai is the controller of the things only Kai can be responsible for: your sign-in identity, the security of the service, and the records it keeps to stop abuse.
Kai's registered details are not published yet. The entity is being established; this notice will name it, with its registered address, before Kai leaves the pilot. The contact that works today is akaiyum@gmail.com, and it is monitored.
2. What we collect
Because you gave it to us
| What | When |
|---|---|
| Phone number | At enrolment. It is your identity here — there is no password. |
| E-mail address | Optional, if you choose to sign in or be contacted by e-mail. |
| First name | Optional. It is what the card says. |
| Birthday — day and month only | Optional. We never ask for the year, so your age cannot be worked out from it. |
| Preferred language | Chosen in the app, or guessed from your device and then correctable. |
| Your consent choices | Each one separately, with the exact wording you were shown. |
Because you used the service
| What | Why it exists |
|---|---|
| Every stamp: when, at which venue and location, why it was given, and which staff member gave it | It is the card. Without it there is no balance to show. |
| Redemptions | Same. |
| Time of your last visit | Shown to the venue; drives "we have not seen you in a while" messages if you consented to those. |
| The venue's own note and tags about you | Written by the venue's staff. The venue is the controller of it. |
| One-time codes we sent you: channel, time, cost, language — never the code itself after it is used | Cost control and being able to answer "did my code go out?". |
| The IP address recorded with a consent | GDPR Art. 7(1) — evidence of what was agreed and from where. |
Because the service has to defend itself
- A one-way hash of your phone number or e-mail address, computed with a secret key held on the server, used to count sign-in requests. It cannot be turned back into your number.
- A CAPTCHA challenge when you ask for a code, handled by Cloudflare Turnstile.
Your position, when you scan — and only then
When you open the Scan screen the app asks your browser for your position. If your browser gives one, it is sent with the scan so the server can check you are actually at the venue, which is what stops somebody stamping a card from home. The coordinates are not stored. What is stored, and only when the scan was out of range or arrived with no position at all, is a single number — how far away you were, in metres — on a fraud record for that venue.
If you refuse the permission, or your browser cannot give a position, scanning still works. Nothing about the reward depends on it.
3. What we do not collect
No password. No year of birth. No continuous location tracking — the position is asked for on the Scan screen and nowhere else, and it is never kept. No advertising identifiers, no third-party analytics, no tracking pixels. No cookies at all: your session is kept in your own browser's storage, not in a cookie sent to us. No payment card details — Kai never takes a payment from you.
4. Why we are allowed to hold it
| Purpose | Basis |
|---|---|
| Running your card — stamps, balance, rewards | Performance of a contract (Art. 6(1)(b)) |
| Messages about your account, e.g. a redemption confirmation | Your consent, recorded separately (Art. 6(1)(a)) |
| Marketing messages from a venue you hold a card with | Your consent, recorded separately, withdrawable at any time (Art. 6(1)(a)) |
| Sending you a sign-in code | Performance of a contract (Art. 6(1)(b)) |
| Rate limiting, CAPTCHA, fraud prevention | Our legitimate interest in a service that is not abused (Art. 6(1)(f)) |
| Keeping consent records after a withdrawal | Legal obligation — we must be able to demonstrate what was agreed (Art. 6(1)(c), Art. 7(1)) |
Marketing is never bundled. Refusing it costs you nothing and does not close your card.
5. Who else sees it
We use a small number of service providers. Each one is under contract, processes data only on our instructions, and gets only what it needs.
| Provider | What it handles | Where |
|---|---|---|
Supabase (Ireland — AWS eu-west-1) | The database, sign-in, and file storage. Everything above is stored here. | EU |
| Vercel | Serves the app and dashboard to your browser. | Global CDN; the app itself holds no data at rest |
| SMSAPI (Poland) | Delivers your one-time code by SMS. Receives your phone number and the message. | EU |
| Resend (United States) | Delivers e-mail — one-time codes and account e-mails. Receives your e-mail address and the message. | US, under Standard Contractual Clauses |
| Cloudflare (United States) | The CAPTCHA on the sign-in form. Receives your IP address and a challenge token, not your phone number. | US, under Standard Contractual Clauses |
The venue sees your first name, your phone number, your card, your visit history with it, your language, your birthday if you gave one, and its own notes about you. It sees nothing about any other venue you hold a card with. That separation is enforced by the database itself, not by the app.
Other venues see nothing about you. We do not sell your data, and we do not share it for anybody else's advertising.
The list of providers above is published and kept current at Sub-processors, in the same place as this notice.
6. How long it is kept
| What | How long |
|---|---|
| Your card and stamps | While the card is open. If the venue leaves Kai, 30 days after it stops (see the Terms of Use). |
| Your customer record after you ask to be erased | Erased. What remains is a tombstone with no personal data in it, so the record of a deletion having happened survives. |
| Consent records, including withdrawals | Kept after you withdraw — that is the whole point of them. |
| Log of one-time codes sent — channel, time, cost, language | For as long as your card is open. A shorter fixed period has not been set yet, and we would rather say that than quote one the software does not enforce. |
| Hashed identifiers used for rate limiting | 25 hours, then deleted by the database itself. |
| A scan the counter turned away — which venue, when, and the reason you were shown (you had already collected one that day, the code on the screen had changed, and so on) | 90 days, then deleted by the database itself. |
| A security record — a scan sent from outside the venue, with how far away it was in metres, and similar signals of misuse | 12 months, then deleted by the database itself. |
The last two are different lengths on purpose. A refused scan is the system working normally — you were a few minutes early, or the code on the counter screen had already changed — and it is kept only long enough for the venue to be able to answer "the app did not work for me on Tuesday". A record of a scan sent from somewhere other than the venue is evidence of somebody trying to collect stamps they were not present for, and a pattern like that is not visible in a fortnight.
Both are deleted by a job that runs inside the database every day, keyed on the age of each record. Nobody has to remember to run it, and there is no screen anywhere that can turn it off.
7. Your rights
You have the right to access your data, correct it, erase it, restrict or object to processing, withdraw consent at any time, and to receive your data in a portable form.
In the app, under Consents and privacy, you can:
- see every consent you have given, and its exact wording;
- turn any consent on or off, per venue, immediately;
- ask to be erased.
Erasure is a request, not a button that fires instantly, and we would rather say so than pretend otherwise. It is recorded, the venue that holds your card is notified, and it must be completed within one month — the deadline the GDPR sets. You will see the request and its status in the app.
Withdrawing consent does not affect anything that was lawfully done before you withdrew it.
To exercise any right you can also simply write to akaiyum@gmail.com.
8. Complaining
If you think your data has been handled wrongly, you can complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) — or to the supervisory authority where you live. We would rather you told us first.
9. Automated decisions
There are none. Nothing about your card is decided by a machine on its own, and there is no profiling that produces legal effects for you. Which venues can message you is decided solely by which consents you gave.
10. Changes
A new version of this notice is published here with a new version date. Where a change matters to you, the app will say so.