Privacy Policy

Last updated: June 2026

This Privacy Policy explains how Messenger Marketing Experts Limited, trading as WalletPush ("we", "us", or "our"), handles personal data when you use walletpush.io and the WalletPush services. It is written to meet the EU and UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").

We do not sell personal information. We do not share it for cross-context behavioural advertising.

1. Who we are

The company responsible for this policy is:

2. Our role

We act in two different roles, and the difference matters:

• Controller. We decide why and how we use personal data about people who create a WalletPush, agency, or business account, people who contact us, and people who browse walletpush.io.
• Processor. When a business uses WalletPush to issue wallet passes, run a loyalty or membership programme, take bookings, or handle customer messages, that business decides why the data is used. We process that personal data only on the business's instructions. The business is the controller and must give its own privacy notice to its customers.

If you are a customer of a business that uses WalletPush, contact that business first for access, correction, or deletion of programme data. We will help that business respond. You may also write to us at support@walletpush.io.

3. Personal data we collect

In the 12 months before this policy's date, we have collected the categories below. The names in parentheses are the California categories.

• Identifiers: name, email address, phone number, account ID, wallet pass serial number, push-notification token, and IP address.
• Commercial information: loyalty points, membership tier, purchases, redemptions, bookings, and subscription or billing status. Card numbers are collected by Stripe, not stored by us.
• Internet or network activity: sign-in times, pass installs and updates, and pages requested on the service.
• Professional information: business or agency name, and your role on an account.
• Communications: messages you send to a business through a chat channel connected to WalletPush.
• Inferences: membership status or preferences calculated from the programme the business configures.
• Account credentials (sensitive personal information): your password, stored as a hash, used only to provide your account.

We do not ask you for a government identification number, precise location, or a payment card number. If a business records extra details, such as an appointment note, that business is the controller of those details.

4. Where it comes from

• You, when you register, install a pass, book, pay, or send a message.
• The business or agency that issues your pass or connects the conversation.
• Your device and browser, for security logs and to deliver the service.
• Stripe, which tells us whether a payment succeeded. We do not receive your full card number.

5. Why we use it, and the legal basis

• To provide the service you asked for (GDPR Art. 6(1)(b)): accounts, wallet passes, bookings, messages, and billing.
• Legitimate interests (GDPR Art. 6(1)(f)): securing the platform, preventing fraud, and understanding whether the product works. You can object. See section 10.
• Consent (GDPR Art. 6(1)(a)): marketing from us, where we ask for it. You can withdraw consent at any time.
• Legal obligation (GDPR Art. 6(1)(c)): tax, accounting, and responses to lawful requests.

We do not use your personal data for a decision based solely on automated processing that produces a legal effect, or a similarly significant effect, concerning you.

6. Selling and sharing

We do not sell personal information for money or other valuable consideration. We do not share personal information for cross-context behavioural advertising, and we do not use advertising cookies on walletpush.io. Because we do not sell or share personal information in the CCPA sense, we do not offer a "Do Not Sell or Share" toggle. If that changes, we will update this policy and provide a way to opt out before we do it.

7. Who we disclose it to

We disclose personal data to service providers that host and deliver WalletPush. They may use it only to perform that work:

• Supabase: database, authentication, and file storage, in London, United Kingdom (AWS eu-west-2).
• Vercel: application hosting. Personal data passes through in order to serve a request.
• Stripe: card payments. We do not store card numbers.
• Resend: transactional email, such as account and booking messages.
• Apple and Google: installing a pass in Apple Wallet or Google Wallet, and sending pass-update notifications.

We also disclose programme data to the business that issued your pass, because that business runs the programme. We disclose personal data if the law requires it, or to protect the service, our users, or the public from harm.

8. International transfers

We are established in Hong Kong. Our primary database is in the United Kingdom, which is covered by a European Commission adequacy decision. Apple, Google, Stripe, Resend, and Vercel may process personal data in the United States or on a global network.

Where personal data of people in the EEA or the UK is transferred outside that region, we use a lawful transfer tool. That is the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-U.S. Data Privacy Framework where the provider participates. Our staff may access the data from Hong Kong to operate the service.

9. How long we keep it

We keep account and programme data for as long as the account is open and we need it to provide the service. After an account closes, we delete or anonymise it unless we must keep a record for tax, accounting, fraud prevention, or to establish or defend a legal claim. Security logs are kept only as long as we need them to investigate abuse and keep the service reliable. Passwords are stored only as hashes.

10. Your rights in the EEA and the UK

If the GDPR or UK GDPR applies to you, you can ask us to:

• Provide a copy of your personal data.
• Correct inaccurate data.
• Delete your data, where a legal ground applies.
• Restrict how we use it.
• Give you, or another service, a portable copy of data you provided.
• Object to use based on legitimate interests, including any direct marketing.
• Withdraw consent, where we rely on consent. Withdrawal does not affect use that happened before you withdrew it.

We will respond within one month. We may extend that by a further two months for a complex request, and we will tell you if we do. You can also complain to the supervisory authority in your country. In the UK, that is the Information Commissioner's Office.

11. Your rights in California

If you are a California resident, the CCPA gives you the right to:

• Know the categories and specific pieces of personal information we collected about you, the sources, the purposes, and the categories of third parties we disclosed it to.
• Delete personal information we collected from you, subject to the legal exceptions.
• Correct inaccurate personal information.
• Opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. If we ever do, we will tell you and honour an opt-out.
• Limit use of sensitive personal information. We use account credentials only to provide the account. You may still ask us to limit any other use.
• Non-discrimination. We will not deny the service, charge a different price, or provide a different level of service because you exercised these rights.
• Appeal. If we deny a request, you may reply to that decision and ask us to review it.

You may use an authorised agent. The agent must provide proof that you gave them permission, and we may still ask you to confirm your identity directly.

We will confirm receipt and respond within 45 days. We may extend that once by another 45 days when reasonably necessary, and we will tell you why. You may also contact the California Privacy Protection Agency at cppa.ca.gov.

12. How to make a request

Email support@walletpush.io with the right you want to use and the email address on the account. We will ask you to confirm that you control that email address before we disclose or delete data. We will not ask you for a government ID unless we cannot confirm you another way.

13. Cookies

walletpush.io uses essential cookies so you can sign in and so the service can remember that session. We do not use advertising or cross-site tracking cookies on walletpush.io. A business that uses WalletPush may add its own analytics tags to that business's landing page. Those tags are controlled by that business, not by this policy.

14. Security

We protect personal data with encryption in transit (TLS), encryption at rest, access controls that separate each business's data, and backups. No online service can promise that security incidents will never happen. If a breach creates a risk to you, we will notify the people and authorities the law requires us to notify.

15. Children

WalletPush is not directed at anyone under 16. We do not knowingly collect personal data from children under 16. If you believe we have, email support@walletpush.io and we will delete it.

16. Hong Kong

We are established in Hong Kong. The Personal Data (Privacy) Ordinance also applies to personal data we control there. You may contact the Office of the Privacy Commissioner for Personal Data, Hong Kong, at pcpd.org.hk.

17. Changes

If we change this policy, we will update the date at the top. Where a change materially affects how we use personal data, we will also give notice in the product or by email before the change takes effect.

18. Contact