Privacy policy

Ossy runs a shared loyalty card for independent cafés, bars and restaurants, the Ossy app, and the portal venues use to run their rewards. This policy explains what personal information we collect across all three, why we collect it, who we share it with, and the choices you have.

Ossy is operated by Ossy Technologies Inc., a Canadian corporation ("Ossy", "we", "us"). We follow Canada's federal privacy law (PIPEDA) and, where it applies, Quebec's privacy law. Our Privacy Officer is responsible for how we handle personal information and can be reached at privacy@ossyhq.com.

Each venue on Ossy is an independent business. When a venue receives your information through Ossy, its own privacy practices apply to what it does with it.

When you get your card

• Your phone number, or your email if you use that instead.
• Your name, if you give it to us or it's already on file at the venue.
• The venue where you joined, and whether you agreed to offers from participating venues.

When you use your card

• The venues you're a member of, and when you joined each one.
• The points you earn and redeem, and the rewards you use.
• Purchases at participating venues, from the venue's point-of-sale system: the date, the location, the total and the items bought.
• If you add your card to Apple Wallet, the identifiers Apple provides so we can keep the card on your device up to date.

When you use the Ossy app

• Your account details: email, name, username, and a password we store only in hashed form.
• Anything you choose to add, such as a profile photo, your home base, places you save and notes about them, friends, shared expenses and receipts, and reports about other users.
• To help you invite friends, the app can read the contacts on your phone if you allow it. Your contacts stay on your phone and aren't uploaded to Ossy.

Automatically

• When you sign in, your IP address and the type of device or browser you're using, stored with your session.
• Server logs of requests and IP addresses, to keep Ossy secure and working.
• This website doesn't use advertising trackers or third-party analytics.

If you work at a venue or ask about Ossy for your business

• Your name, email and role, and actions you take at the counter, such as redeeming a reward.
• Business details from the venue's point-of-sale account, such as locations and menu items.
• The venue name, city and email you give us when you request a demo.

• Run your card — keep your points and rewards at each venue, and match purchases to your card so points earn themselves.
• Send messages you need, like the text with a link to your card.
• Send offers and news, only if you've agreed. Every marketing message tells you how to stop.
• Run the app — saved places, friends, shared expenses and the rest.
• Give venues reports about their loyalty program, such as how often regulars come back.
• Keep Ossy safe — prevent fraud and abuse, and fix problems.
• Meet our legal obligations.

We don't sell your personal information, and we don't use it for third-party advertising.

Ossy is built so each venue only sees its own relationship with you.

• A venue you've joined sees your name, your points and rewards there, and your visits and purchases there. Staff at the counter see your name, the last digits of your phone number and your balance.
• Its point-of-sale system. So points can earn themselves, we add your name, phone number and email (if you've given one) to that venue's customer list in its point-of-sale system, such as Square.
• Other venues never see your balances, visits or purchases at the venues you've joined.
• Offers across Ossy. If you agree, participating venues can send you offers based on where you earn across Ossy. They still never see your individual activity at other venues.

We use service providers to run Ossy. We give each one only what it needs, and they may only use it to provide their service to us.

• Hosting, database and file storage providers.
• A text message provider, to send texts.
• Point-of-sale providers such as Square, when a venue connects its account, to receive purchases and keep the venue's customer list in sync.
• Apple, if you add your card to Apple Wallet.
• Google Maps Platform, to search for places. What you type into place search is sent to Google.
• A payment processor, for venues' Ossy subscriptions.

Text-message opt-in data and consent are never shared with, sold to or transferred to any third party. Our text message provider only delivers messages on our behalf.

We may also disclose information when the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of our business, in which case it stays protected by this policy.

Some of our service providers store or process information outside Canada, including in the United States. Information held there is subject to the laws of that country and may be accessible to its courts, law enforcement and national security authorities.

• Account and card details: for as long as your account is open.
• Points, rewards and purchase records: while you're a member of that venue, then only as long as needed to resolve disputes and meet legal and accounting obligations.
• If a venue signs you up at the counter and you haven't set up your card yet, we keep the record so your points are waiting when you do.

When we no longer need information, we delete it or make it anonymous.

• See your information — ask us for a copy.
• Correct it — update it in the app, or ask us.
• Delete it — ask us to close your account and delete your information. We may keep some records where the law requires it.
• Stop marketing — reply STOP to any text, use the unsubscribe link in any email, or contact us. You'll still get the messages you need to use your card.
• Withdraw consent to offers across Ossy at any time.

To make a request, email privacy@ossyhq.com. We may need to confirm it's you, and we'll respond within 30 days.

If you're not happy with how we handled your information, please tell us first. You can also complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

• Information is encrypted in transit between your device and Ossy.
• Venues' point-of-sale credentials are encrypted in our database.
• Passwords are stored only in hashed form.
• Access to personal information is limited to people who need it to run Ossy.

No system is perfectly secure. If a breach creates a real risk of significant harm, we'll notify you and the privacy regulators as the law requires.

If we change this policy, we'll post the new version here and update the date at the top. If a change significantly affects how we use your information, we'll tell you before it takes effect.

Questions about this policy or your information? Email the Privacy Officer at Ossy Technologies Inc.: privacy@ossyhq.com.

Ossy Technologies Inc.
400-80 Atlantic Ave, Toronto ON M6K 1X9, Canada