Privacy policy

This privacy policy explains how WarmVisit (“WarmVisit”, “we”, “us”) collects, uses, shares and protects personal data when you use warmvisit.com, the WarmVisit wallet, the staff app and the owner dashboard (together, the “Service”). We follow the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000.

Who is responsible for your data

For customer accounts and the WarmVisit wallet, WarmVisit is the Data Fiduciary. When a shop uses WarmVisit to run its own loyalty programme, the shop decides how it uses the visit and reward data of its own customers, and WarmVisit processes that data on the shop’s behalf as a Data Processor.

What we collect

• Customers: mobile number (verified by OTP), name if you add it, optional birthday, language preference, the shops you join, visits, stamps, points, rewards and redemptions, and your wallet QR code.
• Shop owners and staff: name, mobile number, email, shop name, address, GSTIN if added, branch locations, staff roles and a hashed staff PIN.
• Device and security data: IP address, device type, browser, approximate location at the moment of a scan (only to check you are at the shop), and timestamps. We keep these in a security audit log to prevent fraud.
• Payments: plan and invoice details. Card and UPI details are handled by our payment partners and never stored by us.

Why we use it

• To create your account, verify your mobile number and keep you signed in.
• To add stamps and points, unlock rewards and let staff redeem them with a PIN.
• To send service messages such as OTPs, reward unlocked and reward expiry reminders.
• To send marketing messages from shops you joined, only where you have given consent. You can opt out at any time.
• To detect and prevent fraud, such as repeated scans or remote scans.
• To produce anonymous, aggregated statistics about the platform.

Consent

We ask for your consent in clear language when you sign up and before any optional use such as marketing messages or your birthday. You can withdraw consent at any time from your profile or by writing to us. Withdrawal does not affect processing done before it.

Who we share it with

• The shops you join see your name, masked mobile number, visits and rewards at their shop only. They never see your activity at other shops.
• Service providers who help us run the Service: hosting, SMS and WhatsApp delivery, email and payments. They process data only on our instructions.
• Authorities when required by law.

We never sell personal data and never share it with advertisers.

How long we keep it

We keep your data while your account is active. If you delete your account, we erase your personal data within 30 days, except records we must keep by law, such as tax invoices, which are kept for the legally required period. Security logs are kept for 180 days.

Your rights

Under the DPDP Act you can ask to access, correct, complete, update or erase your personal data, withdraw consent, nominate another person to act for you, and raise a grievance. Most of this you can do yourself from your profile. See Your data rights.

Children

The Service is meant for people aged 18 and above. We do not knowingly process the personal data of children without verifiable consent of a parent or lawful guardian. If you believe a child has signed up, write to us and we will delete the account.

Security

We use encryption in transit, hashed staff PINs, signed QR tokens, access controls so each shop only sees its own customers, and an audit log of sensitive actions. If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as the law requires.

Grievance officer

Write to our Grievance Officer at privacy@warmvisit.com. We acknowledge within 48 hours and resolve within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.

Changes

We will notify you in the app or by message before any material change to this policy.