Privacy policy

This policy covers two kinds of accounts: the businesses that run a loyalty program on Shena, and the customers who join one. Each business is the data controller for its own program — Shena acts as the processor that stores and operates the platform on its behalf.

Account data: name, email or phone number, and password hash for anyone who signs in, whether as a business owner, staff member or customer.

Loyalty activity: stamps, points, redemptions and visit timestamps recorded when a business confirms a transaction — never inferred or added automatically from a QR scan alone.

Business data: restaurant, branch and program details a business enters while setting up its loyalty program.

Technical data: IP address, device and browser information, and basic usage logs, used for security and to keep the service reliable.

Marketing measurement, only with consent: if you accept the cookie banner on our public website, the TikTok pixel records the pages you visit here together with your IP address, browser and, when you arrive from one of our ads, the click identifier TikTok added to the address. This applies to website visitors whether or not they have an account, and to no signed-in page.

Website analytics, only with consent: accepting the same banner also loads Microsoft Clarity, which records how the public website is used — clicks, scrolling and a replay of the pages as they appeared to you — along with your IP address, browser and approximate location. Text you type into forms is masked before it leaves your browser. Like the pixel, it runs on the public marketing pages only, and on no signed-in page.

Audience measurement, only with consent: the same answer also loads Google Analytics, which counts the public pages you visit and records your IP address, browser, device and approximate location, together with how you reached the site. It sets its own cookies to recognize the same visit across pages, and like the other two it runs on the public marketing pages only, and on no signed-in page.

To operate the loyalty program a customer joined — tracking stamps, points and rewards accurately.

To let a business manage its own program, branches, staff and customers.

To secure accounts, prevent fraud, and investigate abuse of the points system.

To send service messages — receipts, reward notifications, and account or security alerts. Marketing messages are opt-in only.

Running the loyalty program a customer joined — stamps, points, rewards, receipts — is processed under contract: it's what joining a program means. Account security and fraud prevention are processed under our legitimate interest in keeping the service safe and reliable. Marketing messages about new offers are processed only with consent, given per channel (email, SMS, WhatsApp, push) and withdrawable at any time in Profile → Notifications, with no effect on account activity notifications, which are unaffected either way.

Measuring our own advertising with the TikTok pixel is processed under consent as well, given in the cookie banner and withdrawable at the foot of our cookie policy. Refusing it changes nothing else on the site, and nothing is sent to TikTok unless it is accepted.

Understanding how our public pages are used, with Microsoft Clarity and Google Analytics, rests on that same consent and the same single answer in the banner. Refusing leaves the site working exactly as it does otherwise, and nothing is sent to Microsoft or Google unless it is accepted.

We do not sell personal data. We do not share a customer's data across unrelated businesses — a customer's activity at one restaurant is not visible to another business unless the customer separately joins that business's own program.

Infrastructure providers that host the database, application and file storage. Email and SMS/WhatsApp providers used to deliver messages the business or customer triggers. Payment processors, for businesses on a paid subscription. Each is bound by a data processing agreement and only receives what's needed to provide its service. Where a provider processes data outside the country you're in, we rely on Standard Contractual Clauses or an equivalent safeguard recognized under applicable data protection law.

TikTok, but only if you accept the pixel in our cookie banner. It is not a processor acting for us: TikTok decides for itself how it uses what the pixel sends, as a separate controller under its own privacy terms, and it may transfer that data outside the EU. What it receives is limited to your visit to our public marketing pages — never your loyalty activity, and never anything from a signed-in page.

Microsoft, on the same condition and with the same limits, for Clarity. Microsoft processes what Clarity records under its own privacy terms and may transfer it outside the EU. It receives your use of our public marketing pages only.

Google, on the same condition and with the same limits, for Google Analytics. Google processes what the tag sends under its own privacy terms, as a separate controller, and may transfer it outside the EU. It receives your visits to our public marketing pages only — never your loyalty activity, and never anything from a signed-in page.

Account and profile data is kept for as long as the account is active, and removed on request as described under "Your rights" below.

Loyalty ledger records — point transactions, redemptions and reward claims — are kept even after an account is deleted, because each business needs them for its own accounting, tax and fraud-prevention obligations. What's removed on deletion is the identity attached to them: name, email and phone number are erased from the account, so the ledger entries that remain can no longer be tied back to you.

A one-time login code (email or SMS) expires shortly after it's issued and is deleted once used or expired. Marketing consent records are deleted when an account is deleted, along with everything else that isn't part of a business's ledger obligations.

If you're a customer, you can exercise most of these yourself, at any time, from Profile in the app:

Access and portability — Profile → "Download my data" gives you a JSON file of everything tied to your account: your profile, every loyalty card you hold, transactions, claims, offers and notification preferences.

Erasure — Profile → "Delete my account" closes every loyalty card you hold and permanently erases your name, email and phone number. As described under "Data retention" above, the ledger entries a business needs for its own accounting are kept, but anonymized.

Rectification — update your name, email, phone number or birthday directly in Profile.

Objection and consent withdrawal — turn marketing messages on or off per channel in Profile → Notifications.

Restriction of processing, or a request handled by a business directly (for example, a business correcting a specific transaction on your account) — contact us or the business using the details on our contact page, and we'll act on it within the timeframe the law requires.

If you're not satisfied with how a request was handled, you have the right to lodge a complaint with your local data protection supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

We use a small number of strictly necessary cookies to keep you signed in and remember which business dashboard you're viewing. The only non-essential ones are the TikTok pixel, Microsoft Clarity and Google Analytics on our public marketing pages, and all three are loaded solely if you accept them — until then none of their code is even downloaded. See our cookie policy for the full list, and for the controls that change your answer.

Passwords are hashed, data in transit is encrypted, and access to customer data is limited to what a role needs — a cashier can confirm a visit but cannot see a business's billing details, for example.

If this policy changes in a material way, we'll update the date at the top of this page and, where required, notify account holders directly.

Questions about this policy or your data can be sent to the address on our contact page.