Privacy Policy

This Privacy Policy explains what information CoreRift Rewards (the "Service") collects, why, who handles it and the choices you have. The Service is operated by Core Rift LLC, a Virginia limited liability company doing business as CoreRift Technologies ("CoreRift," "we," "us"). It is part of our Terms of Service.

1. Scope

The Service deals with two groups of people:

• People who sign in to the Service to run a shop (owners, managers and staff). For your account, CoreRift decides how your information is used, as described here.
• Customers of a shop that uses the Service: people who scan a shop's QR code, keep a rewards pass, link a payment card or redeem a reward. The shop decides how its customers' information is used, and the shop's own privacy practices apply to them. We process the information on the shop's behalf and on its instructions. To see, change or delete it, contact the shop, or delete your rewards pass yourself (section 8). If you contact us, we will pass your request to the shop.

2. Information We Collect

2.1 People who sign in

• Account details from Google sign-in: your email address and, when Google provides it, your name, and when you accepted these policies and which version.
• Shop access: the shops shared with you and your role.
• Activity records: which person changed what in a shop, such as changing the rewards settings, redeeming a reward, downloading the customer list or sharing the shop.
• Messages to us, including the email address you write from.

2.2 Information processed for shops (Rewards Data)

• Rewards passes: each customer's email address, a first name only if the shop asks for one and the customer enters it, the customer's visit counts, rewards earned and used, the reward codes, and when each visit was added or redeemed. A customer's phone keeps a cookie with a random identifier so the rewards pass opens on later visits.
• Location check: when a shop turns on its location check, the customer's phone may share its position with a visit request. The Service uses it only to work out the distance from the shop, keeps that distance and not the position, and a customer can decline. The shop's own location is kept to make the comparison.
• Payment cards (shops that use automatic earning): the brand and last four digits of each payment card a customer links, whether it is confirmed, and the number of wrong purchase totals entered during confirmation. We never receive or store a full payment card number, a security code or an expiration date.
• Payment reports (shops that use automatic earning): for each payment the shop's payment processor reports, the payment card brand and last four digits, the amount, the time, the processor's payment identifier and what became of it (a visit added, waiting for confirmation, held, unmatched or refunded). We also keep the identifier of the shop's processor account. We hold no key to the shop's processor account and cannot move money.
• Business details: the shop's name, tagline, address, phone, public email, website, hours, color and logo, shown on printed pieces and the shop's business page.
• Email: the recipient, subject and delivery status of each message the Service sends to a shop's customers: the link to open a rewards pass on a new phone, the reward-ready message, and the payment card confirmation link.

2.3 Information collected automatically

Our hosting provider keeps short-lived request logs, such as IP address, browser type, the page requested and the time, for security and troubleshooting. The Service uses the IP address briefly to limit abuse, for example to stop a script from creating thousands of rewards passes.

3. How We Use Information

• To sign you in and show you the shops shared with you.
• To provide the Service to each shop: keep its program, passes and visits, show requests on the counter screen, email reward codes, connect to its payment processor, print its codes and publish its business page.
• To keep the Service secure, prevent abuse and fix problems.
• To meet legal obligations.

We do not sell personal information, share it for advertising, or use it to build profiles. We do not use Rewards Data for anything except providing the Service to the shop it belongs to. We do not send advertising to customers.

4. How We Share Information

• Service providers that host, store and deliver data for us (section 6).
• The shop's owners and managers, who see that shop's Rewards Data.
• Payment processors: a shop that connects Stripe or Square lets that processor tell us about its payments. We send the processor only what the connection needs, such as a request to end the connection.
• Legal and safety: when the law requires it, or to protect people, the Service or our rights.
• A sale or reorganization: if the Service is sold or transferred, information may transfer with it under the commitments in this policy.

5. Cookies and Similar Technologies

The Service uses only what it needs: a cookie that keeps you signed in and protects sign-in, a short-lived cookie recording that you agreed to the Terms at sign-in, a setting in your browser's storage for your light or dark choice, and, for customers, a cookie with the random identifier of their rewards pass. There are no advertising or analytics cookies.

6. Service Providers

Our providers process information in the United States.

7. How Long We Keep Information

8. Your Privacy Rights

• Customers: every rewards pass has a "Remove my rewards pass" button that deletes your email, your visits and rewards, the payment cards you linked and the payments reported for them. The shop can also remove you.
• Everyone: you can ask to see, correct or delete the information we hold about you by emailing us. We honor these requests from anyone, whether or not a particular privacy law, such as the Virginia Consumer Data Protection Act, requires it, and we will not treat you differently for making one. We may need to confirm it is you. If we decline a request, you can appeal by replying to our answer, and you may also contact your state attorney general.

9. Security

All traffic is encrypted in transit. A customer's rewards pass is opened only by its private link, which is kept on the customer's own phone, and customers cannot see each other's passes. A payment card is linked only after the customer confirms it with the total of a purchase, so typing someone else's last four digits does not claim their payments. Only the people a shop is shared with can see its data. No system is perfectly secure; if a breach affects your information, we will notify you and affected shops as the law requires.

10. Children

The Service is for adults who run shops and is not directed at children. We do not knowingly collect information from anyone under 18 who signs in. Shops may not send us information about children under 13, and the Service does not ask customers for their age.

11. Changes to This Policy

We may update this policy. Each version is posted here with its effective date, and earlier versions remain available. We will tell shop owners about material changes before they take effect.

12. Contact

Core Rift LLC, doing business as CoreRift Technologies, Virginia. Email: admin@corerift.com.