Privacy Policy

It explains what we do with information about you when you use Badger.

Badger is a loyalty app. You collect points at independent businesses (cafés, restaurants, shops) and exchange them for the rewards those businesses offer. To make that work, we have to know which visits were yours.

If anything is unclear, ask us: privacy@badgercards.ch.

Badger Service SA decides what information is collected through Badger and why, and is responsible for it under the Swiss Federal Act on Data Protection.

The business you visit is responsible for its own records: its till, its accounts, or a customer list it keeps outside Badger. This policy covers what we do. Where a business uses information it sees through Badger, it is bound by our agreement with it.

Badger Service SA was incorporated in April 2025 and took over the business, including its records, from the same operation in its earlier form.

Anyone who uses the Badger app, with or without an account, and anyone who visits our website. It does not apply to people using the Badger business dashboard on behalf of a shop or restaurant; that is covered by our agreement with the business.

4.1 What you give us

• Your username. Shown in the app, and to a business when you present your code.
• Your email address and phone number, if you create an account. How we reach you, and how a business can find your account at the counter if your phone will not scan.
• Your date of birth, if you give it. Used only for a birthday reward where a business offers one, and to make sure we do not build a profile of anyone under 16. A business sees it only on your birthday itself, and only where it offers such a reward. For the rest of the year it is not shown to it.
• Anything you tell us when you contact us.

We do not collect your real first and last name. We used to, and we are deleting what remains. We do not collect your gender.

4.2 What we collect when you use Badger

• Your visits and points. Which business, which location, when, how many points, which rewards you claimed.
• What you buy, at businesses with a connected till. When you pay at such a business and present your code, we receive a record of the purchase: the items on the bill, their categories and prices, the total, and the amount that qualified for points. We keep it, and it forms part of your history.
  
  We want to be straightforward about why, because it is more than we need simply to award points: we use it to understand what people buy, which helps businesses see how their products perform and helps us decide what to show you. Section 11 explains exactly what we do with it and how to stop us.
  
  We do not receive your payment details. No card number, no token, no bank information.
  
  If you would rather a purchase were not recorded, do not present your code. You forgo the points, and nothing about it reaches us.
• Where your device is, at the moment you ask. When you look at the map or nearby offers, the app reads your device's position to show you what is close. It is used to answer that request and then we stop using it: we build no history from it and we do not use it to track your movements. The calculation happens on our servers, but neither your position nor the result is written to our logs: we deliberately leave both out, so that where you were cannot be reconstructed afterwards. Your phone controls whether we can read it at all, and you can refuse; the app still works.
• Which notifications you received, opened or tapped, so we can tell whether our messages are useful.
• How you use the app: screens opened, features used, things that went wrong. We use PostHog for this, hosted in the European Union and reached through our own domain. If you have an account, it is associated with you.
• Your device and technical information: device type, operating system, app version, language, and an identifier for sending notifications.

4.3 What we receive from others

From a business's till, where connected: confirmation that a payment completed, and the purchase record. From a business, where its staff find your account using details you gave them. Nothing else. We do not buy information about you and we receive none from data brokers.

4.4 What we do not do

• The Badger app contains no advertising trackers. No Meta pixel, no TikTok pixel, no ad-network SDK, and no data passed to an advertiser.
  
  App analytics runs on two tools: PostHog, hosted in the European Union, and Google Analytics for Firebase, Google's measurement tool built into the app. Firebase gives your installation a random identifier and records which screens you open, your device model, its OS version and your country, but not your name, and not your precise position. On Android, Firebase can also read your device's advertising identifier; we do not use it for any advertising, and you can reset or switch it off in your phone's settings. Both tools exist to improve Badger, not to advertise to you. Our public website is different: see section 14.
• We do not track your location in the background, and we build no history of where you go.
• We never see how you pay.
• We do not buy information about you or add outside data to what we hold.
• We do not sell, rent or trade your information. Not to advertisers, not to anyone.
• We do not build profiles based on religion, health, pregnancy or anything like them. What people buy can hint at those things. We do not use it that way, we do not create groups on that basis, and we do not target anyone on it.

• To make the loyalty programme work: recording visits, calculating and holding points, showing you what you can claim, keeping an accurate account.
• To keep you informed about your own account: points earned, rewards available, points expiring, corrections made. These are not marketing; they are how you know what is in your account.
• To be able to help you when you contact us.
• To show you things that are relevant: we use your visits and your purchases to suggest businesses, products and offers. See section 11.
• To help businesses understand their own trade: we combine purchase records into reports for businesses. These are aggregated and do not identify you, and no business receives another's data.
• To improve Badger, by looking at how the app is used in aggregate.
• To prevent fraud and misuse, and to correct our own mistakes when the wrong number of points was credited.
• To comply with the law: retaining accounting records and responding to lawful requests.

Swiss law does not require your permission for everything, but it does require a proper reason.

• Because it is necessary to provide what you asked for: your account, your visits, your points, your rewards, our replies to you.
• Because we have a legitimate interest we consider outweighs the intrusion: recording purchases and using them for personalisation and aggregated business reporting; preventing fraud; keeping Badger secure; improving the app. You can object: see sections 11 and 18. If you object to us using your purchases, we stop.
• Because you agreed: reading your device's location. You can withdraw it at any time.
• Because the law requires it.

7.1 The businesses you visit

A business with which you use Badger can see the information needed to operate your loyalty relationship with that business: the name you use in Badger, your points balance with it, your qualifying visits with it, your rewards and your eligibility for its rewards. On your birthday, the interface of a business offering a birthday reward can show your date of birth for that purpose. Outside that day it is not shown to it.

A business cannot see where else you use Badger, what you earn or spend elsewhere, or any cross-business lifetime points total. Your email address and phone number are not shown as ordinary loyalty data; if you provide them at the counter to be found, the interface can use them for that lookup and masks matches outside the business's community.

Being found at the counter. If you cannot present your code, you can give a business your phone number or email address to find your account. You can object to this processing by writing to us.

Businesses are subject to Badger's platform-use terms: data visible through Badger may be used only to operate their loyalty programme through Badger, unless the business has an independent basis and gives appropriate information. It must not be matched with external files to build an enriched Badger profile, exported to a sending tool, or passed to a third party in breach of those terms.

7.2 Companies that help us run Badger

They handle information on our instructions and cannot use it for their own purposes.

• Google Cloud Platform: hosting, databases, storage, analytics, notifications.
• PostHog: app usage analytics, EU-hosted.
• Google Analytics for Firebase: app usage analytics. Processed by Google, including in the United States.
• Intercom: customer support, EU-hosted.
• Lightspeed: the till system some businesses use.
• Apple Wallet and Google Wallet: if you add a Badger card. See 7.3.
• Stripe: business payments only. No consumer payment information passes through Badger.

The app stores. Badger is distributed through the Apple App Store and Google Play. Downloads, installs and updates go through them, and they collect information about that from your device under their own terms rather than on our instructions. What reaches us from them is the aggregate download, usage and crash reporting their consoles provide.

7.3 Apple and Google, if you use a wallet card

If you add your Badger card to Apple Wallet or Google Wallet, it contains your display name, the date you joined, your points total and a link to your card. For Google Wallet, that is sent to Google and updated when your points change. If you would rather it were not, do not add the card; everything works without it.

7.4 Where the law requires it

We disclose information where legally obliged, or to establish or defend a legal claim. We do not do so voluntarily.

7.5 If our business changes hands

If Badger is sold or reorganised, information may transfer with it. Whoever takes it on is bound by this policy, and we will tell you.

Information is kept principally in Switzerland and the European Economic Area, notably in Frankfurt. Switzerland recognises the EEA as providing adequate protection.

Some information reaches the United States: Intercom's parent company is established there, Apple and Google operate the app stores described in 7.2, Google receives the information described in 7.3, and the usage-measurement data collected by Google Analytics for Firebase (section 4.4) is processed by Google, including in the United States. For those transfers we rely on the safeguards Swiss law recognises: the recipient's certification under the Swiss-US Data Privacy Framework, which Switzerland has recognised as providing adequate protection since 15 September 2024, or the standard contractual clauses recognised by the Federal Commissioner. We should be honest that no safeguard entirely removes the possibility of access by foreign authorities.

If we add a hosting location, we will name it here before we start using it.

No. We do not handle information about health, religion, political views, trade union membership or origin.

Your date of birth is the most personal thing we hold. It is used only for birthday rewards and to protect under-16s, and it is never shown to a business.

What you buy can hint at things of that nature. Section 11 explains why we do not use it that way.

There is no minimum age to use Badger, and collecting points is free.

Where the date of birth we hold shows that someone is under 16, we do not build a profile of them and we do not send them personalised or location-based offers.

What we know

At businesses with a connected till, we hold what you bought: the items, their categories and prices. Together with your visits over time, that shows patterns: what you tend to order, when, how often, how much you usually spend.

What we do with it

• We suggest things to you. If you regularly order a particular kind of thing, we may show you offers involving it. If a new place nearby sells what you like, we may suggest it.
• We decide what to show you, and in what order.
• We tell businesses how their products are doing: in aggregate, never individually. A café can see that a pastry sells well on weekday mornings. It cannot see that you bought one.

What we will not do with it

How to stop it

You remain free not to present your Badger code: in that case the purchase is not associated with your wallet and you do not earn points for that purchase.

You can control notifications in the app and you can object to processing of your personal data by writing to privacy@badgercards.ch.

You can also ask to delete your account. See section 17.

Points are calculated automatically, and they expire automatically twelve months after your last visit that earned points. Those are arithmetic, applied identically to everyone, and described in our terms and conditions.

No automated system decides anything significant about you. If we correct your balance, a person decides it, records why, and tells you. You can challenge it.

We use AI for internal processes. No AI system makes decisions about you, and none is answering you directly today. If that changes, we will update this policy first.

Messages about your own account (points earned, rewards, expiry, corrections) are part of the service. You can silence them in your phone's settings, but you will stop knowing what is in your account.

Everything else is yours to control, in the app's notification settings: offers and news from individual businesses (one at a time, or all at once), community activity and events, and news about Badger.

Email. We do not send marketing email. If we ever do, it will only be with your prior explicit agreement, and every message will carry a working unsubscribe link.

badgercards.ch is different from the app, and we want to be straightforward about it.

Our public website uses PostHog (analytics), Intercom (chat) and a Meta pixel, which measures whether our advertising works and shares information with Meta for that purpose. These tools are disclosed by the banner on the site, provided by c15t, before your visit is measured. You can refuse them from that banner, and change your mind at any time; refusing does not stop the site working. If you refuse, we stop using them to measure your visit or how well our advertising works.

None of these are in the Badger app.

Encryption in transit and at rest; access limited to the people who need it; separate credentials for each part of our system; and a points ledger that cannot be edited or deleted, only added to, so your history cannot be quietly rewritten.

Access to internal tools that can see your details or correct a balance is restricted and logged.

No system is perfectly secure. If a data security breach is likely to result in a high risk to your rights, we will notify the Federal Data Protection and Information Commissioner as soon as possible, as the law requires, and we will tell you where that is necessary to protect you.

We keep personal data only for as long as it is needed for the purposes described in this policy, for security and dispute handling, or to meet a legal obligation. The period depends on the category of information and what it is used for.

For temporary evidence from a connected till, the currently approved launch limits are no more than 7 days for accepted raw provider events/evidence and no more than 30 days for a minimised record of a refused transaction.

When you delete your account, we remove direct identifiers and identity links from active systems through our deletion process. Residual copies can remain in backups for their rotation lifecycle, currently up to 30 days. Certain loyalty, security, dispute or accounting records may be kept longer where law, an overriding interest or the need to defend a legal claim justifies it; in that case we limit the identifiers retained and, where possible, use a pseudonymous reference.

For other categories, we apply an internal retention schedule and periodically review whether identified data remains necessary. When it is no longer needed, we delete it, de-link it from you or irreversibly anonymise it. Truly anonymous information may be retained for statistical purposes.

You can delete your account in the app at any time, whether or not you ever created one.

We remove what identifies you (profile, contact details, date of birth, login, notification tokens) immediately and permanently from our live systems. Copies persist in our encrypted backups for up to 30 days on a rolling basis and are then gone. Your past visits and purchases stay in our records but are anonymised and detached from you. The financial record of points is kept for ten years under an anonymous reference that cannot identify or contact you.

Exercising your rights never costs you points. Deleting your account does, which is why we ask before you confirm.

• Know what we hold and, where the law provides, receive a copy in a commonly used electronic format.
• Correct inaccurate information.
• Ask for deletion: see section 17, subject to information we are entitled or required to retain.
• Object to processing. After an objection, we must stop the processing concerned or be able to justify continuing it despite your wishes. Direct marketing stops when you object to it.
• Withdraw consent where a particular processing activity relies on your consent, without retroactively invalidating earlier processing.
• Contact the Federal Data Protection and Information Commissioner (FDPIC).

To exercise these rights: privacy@badgercards.ch. We may verify your identity and apply the exceptional restrictions, time limits or fees permitted by Swiss law.

We update this policy when our processing or the information required by law changes. The current version is available at badgercards.ch with its effective date. Where Swiss law requires information to be provided before new processing begins, we provide it in time; we may also notify you in the app or by email.