Privacy Policy
This Privacy Policy explains how MadeByNumo LTD ("MadeByNumo", "we", "us", "our"), registered in England and Wales with its registered office in London, United Kingdom, collects and uses personal data when you use Bargly (the "Service"). MadeByNumo LTD is the data controller.
Contact: legal@bargly.com (privacy requests) · support@bargly.com (general support)
1. Data we collect
Account data — email address, display name, handle, password credentials (stored in hashed form), language preference.
Profile data — avatar, bio, home city, interests, dietary preferences, social links, and the visibility settings you choose.
Location data — your home location (set by you during onboarding) and, where you grant browser or device permission, your current location. We use location data only to provide the Service: showing nearby shops and offers on the map, ordering results by distance, and delivering location-relevant features you have enabled. Location permission is optional and can be withdrawn at any time in your device or browser settings. We do not sell location data or use it for third-party advertising.
Loyalty and redemption data — loyalty cards you join, stamps and points collected, offers you redeem, and the shop and branch where each redemption occurred. We use this data only to provide the Service: operating your loyalty cards, showing your history, and giving the issuing shop its own customer analytics.
Content you create — reviews, collections, follows, saved shops and deals, imported loyalty card codes, and any images you upload.
Shop data (for shop accounts) — business name, address, opening hours, category, brand materials, campaign content, team member emails, and billing territory.
Payment data — processed by our payment provider. We receive confirmation of payment, subscription status, and the card's issuing country for pricing verification. We do not store full card numbers.
Usage and device data — log data, device and browser type, approximate region, and interactions with the Service, used for security, fraud prevention, and service operation.
AI interaction data — messages you exchange with Bargly AI and the shop context used to generate responses.
2. How we use data
- To provide, operate, and maintain the Service (contract performance)
- To process payments and manage subscriptions (contract performance)
- To send service notifications you control through your notification settings (contract performance / consent)
- To prevent fraud, abuse, and misuse, including duplicate redemption and fake referral detection (legitimate interest)
- To provide shops with analytics about activity at their own shop, in aggregate or per-transaction form limited to that shop (legitimate interest / contract performance)
- To operate Bargly AI for shop accounts (contract performance)
- To comply with legal obligations, including sanctions screening and tax law (legal obligation)
- To improve the Service using aggregated, de-identified usage information (legitimate interest)
We do not sell personal data. We do not use your data for third-party advertising.
3. What other users see
- Your public profile (handle, display name, avatar, bio, and any content you make public) is visible to other users and may be accessible without an account.
- Reviews you publish are shown with your public profile.
- Favourites, loyalty activity, and leaderboard presence are visible only if you enable the corresponding visibility toggle. Leaderboard participation is opt-in and off by default.
- Shops see redemption and loyalty activity at their own shop only. Shops do not see your activity at other shops.
4. AI processing
When a shop uses Bargly AI, the shop's own profile, brand context, and campaign information are processed by our AI infrastructure provider to generate responses. Shopper personal data is not included in AI prompts beyond aggregate counts. AI conversations are retained to provide conversation history and are not used to train third-party foundation models.
5. Service providers
We use a small number of vetted service providers to operate the Service, limited to the following categories: cloud hosting and database infrastructure, payment processing, map services, AI infrastructure, content delivery and security, wallet pass delivery, and email delivery. Each provider processes data only under contract, only on our instructions, and only to the extent needed to provide their function. A current list of providers is available on request at legal@bargly.com.
6. International transfers
Some providers process data outside the United Kingdom. Where data leaves the UK, we rely on adequacy regulations or appropriate safeguards, including the UK International Data Transfer Agreement or Addendum and standard contractual clauses.
7. Security
We apply industry-standard security measures, including encryption in transit, encrypted storage, row-level access controls, scoped and time-limited redemption tokens, rate limiting, and audit logging. Access to production data is restricted and logged. No system is completely secure; we notify affected users and the ICO of reportable breaches as required by law.
8. Retention
- Account and profile data: for the life of the account, then deleted or anonymised within 90 days of account closure
- Redemption and billing records: up to 6 years after the transaction, as required for tax and accounting law
- AI conversation history: for the life of the account, deletable by the shop
- Log and security data: up to 12 months
- Content you delete: removed from the Service promptly; residual copies in backups are purged on backup rotation
9. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict or object to processing based on legitimate interest
- Data portability
- Withdraw consent at any time where processing is based on consent
Exercise these rights at legal@bargly.com. We respond within one month. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk).
10. Cookies and local storage
The Service uses strictly necessary cookies and local storage for authentication, session management, and your preferences. We do not use third-party advertising cookies. Where analytics cookies are introduced, they will be subject to consent.
11. Children
The Service is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided data, contact legal@bargly.com and we will delete it.
12. Changes to this policy
We may update this policy. Material changes will be notified through the Service or by email before they take effect. The "Last updated" date shows the current version.
13. Contact
MadeByNumo LTD, London, United Kingdom
Privacy: legal@bargly.com
Support: support@bargly.com