Privacy Policy

Villa Nar Bhim Marketplace operates a shared loyalty rewards program across a network of partner cafes, restaurants, lounges and hotels. In this policy, “we” and “us” mean Villa Nar Bhim and its operators; “you” means the registered member. This policy sits alongside our Terms & Conditions.

When you create an account, we collect the details you type in:

• Your name.
• Your mobile phone number — this is your membership ID, and it is how staff find your points at the counter.
• Your email address, used to send you a sign-in code and to recover your account.
• Your password, which is stored only as a one-way hash and is never visible to us or to any venue.

Optionally, if you choose to add them, we collect a profile photo, your date of birth, your address, your gender, and a photograph of a national identity document where a venue requires age or identity verification. None of these are needed to earn or spend points, and you can use your membership without providing any of them.

As you use your membership, we record your transactions: the venue, the date and time, the amount of the bill, the points earned or redeemed, and which member of staff recorded it. This ledger is what your points balance is calculated from.

We do not collect your location, we do not use advertising or cross-site tracking cookies, and we do not buy personal information about you from third parties. The only cookies we set are the ones that keep you signed in and remember whether you asked us to.

An identity document or profile photograph is sensitive in a way a phone number is not, so it is handled differently from the rest of your data:

• It is stored in a private location that is not reachable from a public link — unlike venue photographs, which are public by design.
• Access is granted per file: you can see your own, and authorised administrators can see one when reviewing a verification request. Venue staff working the counter cannot.
• Every view is served through a short-lived link that expires, rather than a permanent URL that could be forwarded.
• An identity document is used only to verify you. It is never shared with a venue, never used for marketing, and never sold.

You can ask us to delete an uploaded document at any time without closing your account, though a venue may then be unable to offer you age-restricted rewards.

We use your information only to run the program:

• To create and maintain your membership and keep your points balance accurate.
• To let venue staff identify you at the counter so a purchase can be credited to you.
• To send you the codes that sign you in or reset your password. These are service messages, not marketing.
• To verify your identity or age where a specific reward requires it.
• To detect and investigate fraud or misuse — for example points recorded against an account that never made the purchase.
• To understand, in aggregate, how the program is performing. The reports our partners see are totals and counts, not profiles of individuals.

We do not use your information to make automated decisions that have a legal or similarly significant effect on you, and we do not sell your personal information to anyone.

Venue staff at a partner venue can look you up by name or phone number in order to record a purchase, and can see your name, phone number, points balance and transaction history. They cannot see your password, your email verification codes, your identity documents, or your activity at other venues’ counters beyond what your balance reflects.

Venue managers can additionally see reports for the venues they are assigned to, and the staff they manage.

Administrators can see the full member record, including verification documents when reviewing a request. Access is enforced in the database itself, not only in the app, and administrative actions are written to an audit log.

Service providers. We use Supabase to host the database, authentication and file storage, and an email delivery provider to send sign-in and password-reset codes. They process this data on our instructions and for no other purpose.

We may also disclose information where the law requires it, or where it is necessary to establish or defend a legal claim.

We keep your account information for as long as your membership is open. Transaction records are kept for as long as they are needed to operate the program and to meet accounting and tax obligations, which may outlast the account itself.

When you close your account we delete or anonymise your personal details. Identity documents are deleted. Individual transaction records may be retained in a form that no longer identifies you, so that a venue’s historical totals remain correct.

You can, at any time:

• See and update your profile details from your member dashboard.
• Ask for a copy of the personal information we hold about you.
• Ask us to correct anything that is wrong.
• Ask us to delete an uploaded identity document or profile photo.
• Close your account. Unredeemed points are generally forfeited on closure — see the Terms.

To make any of these requests, contact us using the details in section 9. We may need to verify who you are before we act on a request, so that nobody else can make it on your behalf.

Access rules are enforced by the database on every single query, so a mistake in the app cannot expose a record the rules would refuse. Traffic is encrypted in transit. Passwords are stored only as one-way hashes. Identity documents and profile photographs are kept in private storage reachable only through short-lived links.

No system is perfectly secure. If a breach ever affects your personal information, we will tell you and the relevant authorities as required by law.

Villa Nar Bhim membership is for people aged 16 and over. We do not knowingly collect information from anyone younger. If you believe a child has created an account, contact us and we will remove it.

We may update this policy. Where a change materially affects how we use your information we will take reasonable steps to tell you before it takes effect, and the date at the top of this page will change.

Questions, requests, or a complaint about how we have handled your information? Reach us through the contact options in the site footer, and we will respond as quickly as we can.