Privacy Policy for Flevario

1. Who We Are (Data Controller)

The entity responsible for processing your data is:

2. The Data We Collect

We collect data necessary to provide our coffee subscription and discount services. This includes:

A. Information You Provide to Us

• Account Data: Name, email address, and encrypted password.
• Subscription Details: Current plan (e.g., Launch Pass, Explorer), renewal dates, and payment status.
• Support Queries: Information you provide when contacting our support team.
• Marketing Preferences: Your consent status regarding newsletters and promotional offers.

B. Information We Collect Automatically

• Device Data (Security): To prevent fraud and enforce our "one active device per client" rule, we collect a unique device identifier (Device Hash) and your device model/OS version.
• Location Data (Optional): If you grant permission, we collect your precise location (GPS coordinates) solely to display nearby partner cafés on the map.
• Usage Logs & Analytics: We log your interactions with the app to improve the user experience, including:
  • Redemptions: Time of scan, participating store, and discount amount.
  • QR Generation: Timestamps of when you generate a discount token.
  • App Performance: Crash reports and navigation flows.

C. Information from Third Parties

• Payment Processors: We do not store your full credit card details. Payments are processed by Stripe, Apple Pay, or Google Pay, who provide us with a token to verify your subscription status.

3. Why We Process Your Data

4. How We Share Your Data

We do not sell your personal data. We share data only in strictly necessary scenarios:

1. Partner Cafés (Merchants): When you scan your QR code, the merchant receives confirmation of your eligibility and discount amount. They do not receive your email or phone number.
2. Service Providers: We use trusted third-party processors:
   • Microsoft Azure: Hosting & Server infrastructure.
   • Google Maps: To display the café map.
   • Stripe: Payment processing.
   • Analytics & Performance: Google Firebase, Sentry, Mixpanel.
3. Legal Authorities: If required by Romanian law or valid court order.

5. Data Retention

• Active Accounts: We keep your data while you have an account.
• Redemption History: Retained for 5 years for fraud analysis.
• Financial Records: Invoices kept for 10 years (Romanian fiscal law).
• Deleted Accounts: Identifiers are anonymized immediately. Non-personal logs may be kept for statistics.

6. Your Rights (GDPR)

• Right to Access & Rectification: Request a copy or correction of your data.
• Right to Deletion: Request account deletion via app settings or email.
• Right to Withdraw Consent: Unsubscribe from marketing anytime.
• Right to Data Portability: Receive your data in a readable format.

To exercise any of these rights, please email us at privacy@flevario.com or use the "Delete Account" option in the app settings.

7. Security

We protect your data using SSL/TLS encryption, cryptographic device binding (`jti`), and strict access controls.