Privacy Policy

Overview

Streakzy ("we", "us", "our") is a milestone-based loyalty platform that helps local businesses reward their regular customers. We are committed to protecting the personal data of consumers and business owners who interact with our platform.

This Privacy Policy is published in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applies to all personal data processed by Streakzy, whether collected through our website, mobile application, or partner store interactions.

Data We Collect

From consumers (waitlist sign-ups and app users):

• Name
• Mobile phone number
• City / location (city-level, not precise GPS unless explicitly permitted)
• UPI ID (only when required for cashback processing)
• Visit and transaction data at partner stores (aggregates visible to the business; full detail visible only to you)

From business owners (store registration):

• Owner name
• Store name and category
• Mobile phone number
• City
• Bank / UPI details (only for reward disbursement; collected at onboarding, not on this website)

Automatically collected (website visitors):

• Browser and device type
• Pages visited, time on page, scroll depth (via analytics tools)
• Referring URL and UTM parameters
• IP address (for fraud prevention only; not stored long-term)

How We Use It

• To manage waitlist registration — contact you when Streakzy launches in your city
• To operate the loyalty programme — track visit and spend milestones, issue and process voucher redemptions
• To onboard and support business partners — set up store accounts, configure milestones, provide dashboard access
• To send service communications — transactional messages about your milestones or account (no promotional spam without consent)
• To improve the platform — aggregate, anonymised analytics on feature usage
• To prevent fraud and abuse — detect suspicious redemption patterns

We do not use your data for behavioural advertising, profiling for third-party benefit, or any purpose beyond what is listed here.

Sharing & Disclosure

We do not sell or rent personal data. We share data only in these circumstances:

• With partner stores — store dashboards show aggregate customer activity (visit counts, spend bands). Individual names and phone numbers are not shown to store owners unless you have opted in.
• With service providers — cloud hosting, SMS/OTP delivery, and payment processing. These providers process data only on our instructions.
• Legal requirements — if required by a court order, government authority, or applicable law.
• Business transfers — in the event of a merger or acquisition, we will notify affected users before data becomes subject to a different privacy policy.

Cookies & Analytics

• Essential cookies — theme preference (dark/light mode). No consent required.
• Analytics (Google Analytics 4) — page views and session data. IP addresses are not stored. Opt out via Google's opt-out tool.
• Session recording (Microsoft Clarity) — heatmaps and session recordings to improve UX. Clarity does not capture form input data.

We do not use advertising cookies or share cookie data with ad networks.

Retention

• Waitlist data — until the service launches and you are onboarded, or until you request deletion
• Active account data — for the duration of your account plus 12 months after deletion
• Transaction and milestone data — 3 years from the date of transaction (for dispute resolution)
• Analytics data — 14 months (Google Analytics default; Clarity: 13 months)

Your Rights

Under the DPDP Act 2023, you have the following rights as a Data Principal:

• Right to access — request a summary of what personal data we hold about you
• Right to correction — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data (subject to legal retention obligations)
• Right to grievance redressal — raise a complaint with our Grievance Officer and receive a response within 48 hours
• Right to nominate — nominate another individual to exercise rights on your behalf

To exercise any of these rights, email privacy@streakzy.com with the subject line "Data Rights Request". We will respond within 72 hours and resolve requests within 30 days.

Security

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Access controls — data accessible only to authorised personnel on a need-to-know basis
• Regular security reviews of infrastructure and code
• OTP-based authentication for all account access

If you become aware of a security issue involving your data, please notify us at security@streakzy.com.

Children

Streakzy is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, contact privacy@streakzy.com and we will delete it promptly.

Policy Changes

Material changes will be notified via email or via a prominent notice on our website at least 7 days before the change takes effect. Continued use of Streakzy after a policy update constitutes acceptance of the revised terms.

Contact & Grievance Officer

If you are not satisfied with our response, you may escalate to the Data Protection Board of India once constituted under the DPDP Act, 2023.