Privacy Policy

Leaf ("we", "the Company") is committed to protecting your privacy. This policy explains what information we collect, how we use it, where it is transferred and what your rights are — in the spirit of Israel's Privacy Protection Law, 5741-1981, including Amendment 13 which came into effect on August 14, 2025, and in the spirit of the principles of the European GDPR.

The policy applies to Leaf's marketing website and to the Leaf system itself — the business management interface, the employee screens and the customer card screens.

With respect to information about end customers: the business you joined is the data owner and the database holder. It decides what details to request, what the rewards are and what messages to send. Leaf processes the information on its behalf and according to its instructions, in its capacity as the platform provider.

With respect to information about business owners and their employees: Leaf is the data owner, since these details are provided to it directly for the purpose of opening the account and operating the service.

A customer's card is associated with one business only. A customer who has joined two businesses appears in two separate databases, and the businesses do not see each other's customers.

The information collected depends on your role in the system:

IP addresses are used by us only temporarily, in memory, for the purpose of rate limiting requests and protecting against abuse. They are not stored in the database.

• Business owners: full name, email, phone, the business name and its contact details (address, opening hours, website, social media links) and a logo (optional).
• Employees: full name, email and phone.
• Customers: full name, phone, email (optional), date of birth (optional, recorded once only) and the selected card design.
• Card activity: punches, redemptions, undone actions, available rewards and the card status.
• Consent records: the type of consent (terms and privacy, or marketing mailings), whether it was given or withdrawn, the time, the source (joining or the preferences screen), and the version and language of the documents. The record is cumulative — a new record is added, and previous records are not deleted.
• Digital wallet: for Apple Wallet, the device identifier and the push token needed to update the card are stored; for Google Wallet, we store only an indication that the card was saved.
• Campaign delivery results: to which wallet the message was sent, whether it was delivered and the reason for failure if there was one, at the customer level.
• Operational event log: the type and time of the event, the business, the customer or user involved, the means of action and the source. For events of logged-in users — business owners, employees and system administrators — the browser and device type (user agent) is also stored.
• Inquiries from the website: the name, email and phone provided in the get-started form on the marketing website.

• Operating the loyalty program: recording punches and redemptions, displaying the card status and updating it in the digital wallet. This use is required to provide the service and is not conditional on consent to marketing mailings.
• Granting loyalty rewards, including the birthday reward — part of the service itself, and not conditional on consent to marketing mailings.
• Marketing messages on behalf of the business — only to customers who have given explicit consent, and only as a message on the digital card.
• Operations, security, preventing abuse and handling faults.
• Analyzing and improving the service. The analysis is based on the activity data collected in the system; it is not anonymous, but access to it is limited by role.
• We do not sell information to third parties and do not transfer it for advertising purposes.

A customer who joins a loyalty program accepts the Terms of Use and the Privacy Policy by clicking the join button. The acceptance is recorded together with its time, and the version and language of the documents.

Consent to marketing mailings is separate and explicit: the checkbox is not pre-checked, and joining the program is not conditional on it. A customer who does not check it receives a regular card for all intents and purposes.

Consent to mailings can be withdrawn at any time, independently, on the card preferences screen. The link to this screen also appears on the back of the digital card, so it remains available even if the original link is lost.

Muting the card's notifications in the wallet app is not a withdrawal of consent to mailings — it only stops the notification on the device. To withdraw consent, use the card preferences screen.

Customers receive messages from one source only — the digital card in the wallet. The notification itself is generated by Apple Wallet or Google Wallet following a card update, and is not sent from the browser.

Three types of updates are possible: an update of the card status after a punch or redemption; a campaign message from the business — only to customers who have consented to mailings; and a notice about a reward waiting for you, such as the birthday reward.

We do not send customers SMS messages and do not send them marketing emails. Emails on behalf of the system are sent to business owners and employees only, and relate to account operation — address verification, password reset, employee invitations and system messages.

Saving the card to a digital wallet is an option, not an obligation. The card can also be used directly from the link in the browser.

When saving to Google Wallet, the customer's name, the punch and reward status, the business details and design, and the barcode value are transferred to Google. On this channel we do not store device information — only an indication that the card was saved.

With Apple Wallet, the device is registered with us so that we can update the card: the device identifier and a push token are stored. A token that is no longer valid is deleted, and removing the card from the wallet cancels the registration.

The card does not include location information of any kind. We do not collect location information, and the card has no notifications based on where you are.

The transfer of information to Apple and Google is a technical condition for displaying the card in the wallet and takes place only if the customer chose to save it. The information is processed on the servers of these companies, which are not necessarily in Europe.

A request for camera access appears only on the business's scanning screens — for the business owner or employee. There is no camera access request on any customer screen.

The scan decodes the QR code inside the browser and passes on only the decoded value. We do not store or transmit any image, frame or video.

Using the camera is an option, not an obligation: a customer can also be found by phone number, and refusing camera permission does not prevent use of the system.

The information is stored in Supabase services in the Central Europe region (Frankfurt, Germany). Leaf's server functions also run in the Frankfurt region.

The information is encrypted in transit and at rest. Access to it is restricted by role using a row-level security (RLS) mechanism — a business sees only its own customers.

Information needed to display the card in a digital wallet is transferred to Apple and Google and processed on their servers, as detailed in Section 7 and in the sub-processors table.

A business's logo and previews of card designs are stored in publicly readable storage — meaning anyone who has the file's address can view it. Do not upload personal or sensitive information there.

We use service providers that process information on our behalf:

The fonts on the website and in the system are hosted by us and are not loaded from an external font service.

We keep the information for as long as the card or account is active, and for the purpose of operating and documenting the service.

The system has no automatic deletion mechanism for customer data, cards, activity or consent records. Deletion is performed manually, following a request.

The only things that expire on their own are displays on the card: the birthday reward at the end of the birth month, a campaign message after seven days and a test message after 24 hours. Their expiry does not delete the activity records.

Consent records are kept as cumulative documentation and are not deleted during normal use. This is intentional behavior, designed to preserve the history of consents.

A request to exercise rights regarding an end customer's information should be directed to the business you joined — it is the database holder. A request that reaches us will be forwarded to it, and we will act according to its instructions. Business owners and employees can contact us directly.

Withdrawing consent to marketing mailings does not require any request — it is done independently and immediately on the card preferences screen.

A deletion request is handled manually, since the system has no automatic deletion mechanism. We will handle it with the business within a reasonable time.

• Access to the personal information held about you.
• Correction of incorrect or outdated information.
• Deletion of information.
• Objection to the use of information for marketing mailings.
• Receiving the information in a readable format (data portability).
• To make a request about your rights: support@leaf-loyalty.com

The business is responsible for ensuring that information about its customers is collected lawfully and with their knowledge — especially when it enters a customer into the system manually, a path on which the system does not capture consent from the customer.

The business is responsible for the content of the messages it sends, for identifying itself in them, for the accuracy of the reward and for actually honoring it. Leaf provides the tool and is not the advertiser.

The business may export its customer list to a file. From the moment of export, responsibility for safeguarding the file and for its use is solely the business's.

The business owner is responsible for the employee accounts they created and for the actions performed through them.

Leaf's marketing website does not use cookies at all.

The system uses essential cookies only — authentication (session) cookies for business owners, employees and system administrators. End customers do not receive an authentication cookie; access to the card is through a secret link.

The system runs a loading-performance measurement service (Vercel Speed Insights), including on customer screens. It does not use cookies, but it transmits performance data to the provider.

There is no use of advertising cookies, advertising pixels or cross-site tracking tools.

For privacy questions: support@leaf-loyalty.com