Privacy Policy
Last updated 1 September 2026.
This policy explains what Perklet collects, why, and the rights you have over your data. We keep data collection deliberately minimal and never sell it. It is written to comply with the UK GDPR and the Data Protection Act 2018.
Who we are
Perklet is a digital loyalty platform for independent businesses. The service is operated by CACHE22 LTD (company no. 17419941), which is the data controller responsible for your personal data. Our registered address is 124 City Road, London, EC1V 2NX, United Kingdom.
What we collect
- Merchants: your name, email, business name, category, and optional address and logo — to run your account and programme.
- Customers: your name and email (for sign-in), and the loyalty stamps and rewards you earn at businesses you join. We don't ask for date of birth, phone number, or postal address.
- Sign-in with Google or Apple (optional): if you choose social sign-in, we receive only your name and verified email from the provider to create or match your account — nothing else.
- Payments: handled by Stripe. We never see or store full card details — only a Stripe reference to your subscription.
- Technical data: basic information your browser sends (IP address, device and browser type) and a signed session cookie, so we can keep you signed in and protect the service from abuse.
- Product analytics: a small set of usage events to understand and improve the sign-up and loyalty flow.
How we use it & our legal bases
Under the UK GDPR we rely on the following lawful bases:
- To provide the service — operate your loyalty programme, sign you in via a one-time email code or your chosen social provider, and support you (performance of a contract).
- To take payment — process your subscription through Stripe (performance of a contract).
- To keep the service secure and improve it — prevent fraud and abuse, and analyse aggregate usage (our legitimate interests in running a reliable product).
- To measure our advertising — only if you accept marketing cookies on our website (your consent, which you can withdraw at any time — see Cookies below).
- To meet legal obligations — for example retaining records needed for tax and accounting (legal obligation).
Your universal customer QR contains only an opaque code — never your identity, balances, or any ability to award yourself stamps.
Who we share it with
A business only ever sees data for its own customers' participation in its own programme. We don't sell your data. We use a small number of trusted processors who act only on our instructions:
- Stripe — subscription payments.
- Resend — transactional email (sign-in codes and account notices).
- Our hosting and database providers — to run the application and store your data.
Some of these providers are based outside the UK. Where personal data is transferred internationally, it is protected by appropriate safeguards such as the UK International Data Transfer Agreement or the equivalent standard contractual clauses.
How long we keep it
We keep your account data for as long as your account is active. If you close your account or ask us to delete your data, we remove your personal information, except where we must retain limited records to meet legal obligations or to preserve the integrity of a business's loyalty ledger (which is append-only). Anonymous analytics may be retained indefinitely as it no longer identifies you.
Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, where applicable;
- restrict or object to certain processing;
- receive your data in a portable format; and
- complain to the ICO (ico.org.uk) if you believe we have mishandled your data — though we'd appreciate the chance to put things right first.
To exercise any of these, email support@perklet.co.uk.
Cookies
We use a signed session cookie to keep you securely signed in — it is essential to the service and not used for advertising. Inside the app — customer wallets, the scanner and the merchant dashboard — we set no advertising or cross-site tracking cookies at all.
Advertising measurement (only with your consent): on our public website and merchant sign-up pages we ask before loading the Meta Pixel, which helps us see whether our adverts bring independent businesses to Perklet. If you accept, Meta Platforms Ireland Ltd sets cookies (such as _fbp) and receives the pages you visit there, the sign-up steps you complete and, if you subscribe, the amount paid — never your name, email address, or anything from inside the app. Meta uses this data under its own privacy policy. Your choice is remembered in a small first-party cookie for six months.
Security
Data is encrypted in transit over HTTPS. Sign-in uses one-time email codes or your chosen provider — there is no password to leak. Loyalty mutations are server-authoritative, so no customer can alter balances.
Children
Perklet is intended for businesses and their adult customers and is not directed at children under 13. We don't knowingly collect data from them.
Changes to this policy
We may update this policy as the product evolves. Material changes will be reflected here with a revised “last updated” date.
Contact
Privacy questions or requests: support@perklet.co.uk.