Privacy Policy

Last updated: 5 August 2026

Scope

This Policy describes how aesi (“we”, “us”) collects and uses personal data in connection with the aesi mobile app, website, and related services (the “Services”). aesi provides technology that lets participating businesses (each a “Merchant”) offer store credit and loyalty to their customers. For much of the personal data processed through the app, the relevant Merchant is a controller (or joint controller) in respect of its own customers. This Policy does not cover Merchants’ own privacy practices or third-party services we do not control (for example, a Merchant’s payment processor).

What We Collect

• Device and account identifiers: a cryptographic device key and related identifiers used to operate your account, secure transactions, and link your device to your store credit and points.
• Transaction and order data: your store-credit top-ups, balances, points activity, and the contents of orders you place with a Merchant.
• Order and fulfilment details you provide: for example, a name and pickup time attached to an order, or contact details you give when making a booking, so the Merchant can prepare and fulfil it.
• Push-notification identifiers: a push token / notification identifier so we can deliver order updates and Merchant messages you have opted into (we store this as a hashed identifier).
• Website contact data: email and name if you contact us or sign up for updates.
• Technical data: basic device and app diagnostics and interactions used for security and to improve the Services (no invasive tracking).

We do not take custody of your payment card or bank details for top-ups; those are handled by the Merchant’s own payment processor.

How We Use Data

• Operate your account and process store-credit top-ups, balances, points, orders, and bookings.
• Deliver order updates, receipts, and Merchant messages you have opted into.
• Secure the Services and prevent fraud, abuse, and duplicate-account manipulation.
• Improve and support the Services.
• Comply with applicable law and respond to lawful requests from authorities.

Legal Bases

We process personal data to perform our contract with you and to enable the Merchant’s services you use, for our legitimate interests in securing and improving the Services, with your consent where required (for example, push notifications and marketing messages), and to comply with legal obligations.

Sharing

We do not sell personal data. We share personal data with the Merchant you transact with, so it can fulfil orders and bookings and operate its store credit and loyalty programme. We also use service providers (for example, cloud hosting and push-notification delivery) under contracts that require appropriate safeguards and processing only on our behalf. Merchants use their own payment processors, which handle top-up payments under their own terms.

Retention

We keep personal data only as long as needed for the purposes above. Account, store-credit, and points data are retained while your account is active and your balance is live. Order, booking, and transaction records are retained while needed to operate the Services and to meet legal, accounting, and fraud-prevention obligations (typically up to six years for financial records). Website contact data is kept until you ask us to delete it or it is no longer needed. After the applicable period we securely delete or anonymise the data.

Security

We use reasonable technical and organisational measures to protect personal data, including on-device storage of keys and balances. However, no system is perfectly secure. Because your store credit and points are held on your device, a lost, reset, or wiped device may result in loss of unspent credit and points.

Your Rights

Subject to applicable law (including the UK GDPR), you have the right to access, correct, delete, restrict, or object to our processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. You can delete your account and its data at any time in the app under Settings → Security → Delete account (see Delete your account). To exercise any of these rights, email contact@aesi.app. Where a Merchant is the controller of the relevant data, we will route or assist your request to that Merchant. You can also turn off push notifications in your device settings, and you can unsubscribe from optional emails. You have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

International

Your data may be processed in locations where our providers operate. Where data is transferred outside the UK, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

Children

Our Services are not directed to children. Do not submit personal data if you are under the age of legal consent in your jurisdiction.

Changes

We may update this Policy. Material changes will be indicated by updating the “Last updated” date above.

Contact

Questions or requests? Email contact@aesi.app.