Privacy policy

Business owners and their staff use the dashboard and the staff screen. For information about them, the Company is the database owner.

Customers of the businesses join a loyalty card. For information about them, the business they joined is the database owner, and the Company processes the information on its behalf and on its instructions, in order to provide the Service.

From business owners:

• Name and email from the Google account used to sign in.
• Business details: name, logo, colors, card name, the reward and the number of stamps.
• Plan details: plan, status, dates, the last four digits and expiry of the credit card, and a payment token. The full card number goes to Cardcom only.
• Actions in the dashboard and the staff screen (stamps, redemptions, messages).

From customers of businesses:

• Name, and email address and/or phone number, as the business asks at sign-up.
• Consent to receive messages from the business, and language.
• The number of stamps and rewards, and the dates of visits.
• IP address at sign-up, to protect against abuse.
• The card itself (business name, card name, stamps) is saved in the customer's wallet and works under Google's terms.

To provide the Service (card, stamps, rewards, messages), to verify sign-in, to charge and issue invoices, to give support, to keep things secure and prevent abuse, to improve the Service and to comply with the law. We do not sell information.

A customer may agree at sign-up to receive messages from the business. A message is sent only to those who agreed. You can ask the business or us (info@nexums.co.il) to be removed, and we will remove you.

We use providers that process information on our behalf:

• Supabase: the database and sign-in (data center in Ireland).
• Vercel: hosting and running the website and the Service.
• Google: sign-in with a Google account, and Google Wallet for the card.
• Cardcom: credit card clearing and invoices (Israel).

The business itself sees the information about its customers. Beyond that, we disclose information only if a law or a court order requires us to.

Some providers operate outside Israel (the European Union and the United States). Information is transferred to them only to provide the Service, and in accordance with the law.

We use only what the Service needs in order to work: a sign-in cookie (Supabase) that keeps you signed in, and local storage in the browser for the business you chose and for the staff screen's access key. There are currently no third-party advertising or tracking cookies. If we add measurement, we will update this page and ask for consent where it is required.

Information is kept while the account is active. After an account is closed, information is deleted within a reasonable time, except what must be kept: invoices and payment records are kept as tax law requires (in Israel, 7 years).

Communication is encrypted (HTTPS), every table in the database has row-level permissions, access to the staff screen uses a unique access key per business, sign-up is rate-limited, and stamping has a waiting time between stamps. No security is perfect, and we keep strengthening it.

Under the Israeli Privacy Protection Law, 5741-1981, you may review information about you, ask to correct it and ask to delete it. A customer of a business is welcome to contact the business first, as the database owner, and may also contact us and we will help. Contact: info@nexums.co.il. We will reply within 30 days.

Signing up to the dashboard is from age 18. The business is responsible for collecting details of minors only as the law allows.

We will update this policy from time to time. The date at the top of the page will change, and we will announce a material change in the dashboard or by email.

Privacy questions: info@nexums.co.il